A computing system usable for any prime field elliptic curve

Abstract

The application discloses a computing system for an arbitrary prime field elliptic curve, which comprises a processor, a bus connected with the processor, and an operation acceleration unit connected with the bus, wherein the operation acceleration unit comprises a register module, a control module, a computing module, a storage control module and a storage module; the register module is used for providing configuration and instructions to the control module, and providing operation state, computing symbol bit, operation result of size comparison and interruption to the processor through the bus; the control module is used for controlling the storage module to read and write data and controlling the computing module to compute; the computing module realizes module addition, module subtraction, module multiplication, shift, comparison and point multiplication operations of the elliptic curve; the storage control module is used as a storage module controller, and data is written into the storage module by the processor through the bus; and the storage module is used for storing data. The system realizes elliptic curve related computation on an arbitrary self-defined prime field within a width requirement with small area and circuit complexity.

Description

Technical Field

[0001] This invention relates to the fields of digital circuits and cryptography, and in particular to a computational system for elliptic curves in arbitrary prime number fields. Background Technology

[0002] In communication and security applications, encryption and digital signatures are required to ensure that transmitted data is not tampered with or accessed by unauthorized parties during communication. This is further divided into symmetric and asymmetric encryption. Among asymmetric encryption algorithms, elliptic curve cryptography algorithms, such as elliptic curve encryption, elliptic curve digital signatures, and elliptic curve Diffie-Hellman key exchange, are widely used due to their short key lengths and high encryption strength. Elliptic curve encryption is further divided into binary field and prime field types, with prime field-based elliptic curve encryption algorithms being the most widely used.

[0003] Elliptic curve cryptography (ECC) algorithms based on prime number fields primarily involve computations over these fields. However, for encryption strength, the prime number fields used in ECC are often extremely long, exceeding 192 bits, exceeding the processing capacity of ordinary processors. Therefore, specialized algorithms are often required to perform these calculations. For example, multiplying a 192-bit integer requires 36 32-bit multiplications. For a 384-bit multiplication, 144 multiplications are needed, resulting in a significant time overhead.

[0004] For low-performance edge computing devices, such as microcontrollers, directly using the processor for software elliptic curve cryptography calculations is extremely time-consuming, has poor real-time performance, and consumes significant processor resources, impacting other functions. Existing hardware implementations, limited by algorithm implementation constraints, are often only suitable for prime number field calculations that meet specific requirements, lacking versatility. The inability to customize prime number fields may also lead to security risks, as general prime number field parameters can be compromised. Some faster hardware solutions also suffer from complex structures and throughput far exceeding requirements, hindering cost control. Summary of the Invention

[0005] Purpose of the invention: The technical problem to be solved by the present invention is to provide a computational system for elliptic curves that can be used in any prime number field, in order to overcome the shortcomings of the prior art.

[0006] To address the aforementioned technical problems, this invention discloses a computational system applicable to elliptic curves over arbitrary prime number fields, comprising a processor, a bus connected to the processor, and a computation acceleration unit connected to the bus. The computation acceleration unit includes a register module, a control module, a computation module, a storage control module, and a storage module.

[0007] The register module is used to provide configuration and instructions to the control module, and to provide the processor with the running status, calculation sign bit, size comparison (greater than, equal to, less than) operation results and interrupt signals through the bus;

[0008] The control module is used to control the storage module to read and write data according to the configuration and instructions, and to control the calculation module to perform calculations; the data reading and writing includes reading the original data from the storage module, writing the calculation results into the storage module, and transferring data within the storage module;

[0009] The calculation module is used to read and write data from the storage module and implement modular addition, subtraction, multiplication, shifting, comparison and dot multiplication operations of elliptic curves. Other operations such as inversion, dot addition and dot multiplication of elliptic curves can be achieved by combining modular addition, subtraction, shifting, comparison and modular multiplication.

[0010] The storage control module is used as a storage module controller, and the processor writes and reads data to and from the storage module via a bus.

[0011] The storage module is used to store data.

[0012] Furthermore, the calculation module for implementing modular multiplication includes:

[0013] Let A and B be two n-bit binary data, where n is the maximum number of bits supported by the computing module design. m Let A be the m-th bit of A, where 0 ≤ m ≤ n-1, and the least significant bit of A be A0. The modular multiplication operation A × B mod P, where P is the eigenvalue of the prime field GF(P), is expressed in the following form:

[0014] A×B mod P=(B×A n-1 << (n-1)+B×A n-2 <<(n-2)+…+B×A0<<0)mod P

[0015] =(((B×A) n-1 +0)<<1+B×A n-2 )<<1...)+B×A0)mod P

[0016] =(((B×A) n-1 +0)mod P<<1+B×A n-2 )mod P<<1...)mod P+B×A0)mod P

[0017] That is, A×B mod P can be expressed as taking the modulus of the intermediate result of each step of the A×B shift-add multiplication method, where << indicates a left shift by one bit.

[0018] Modulo is taken from the intermediate results of each step of the shift-add multiplication, rather than from the overall result. The advantage of this approach is that for n-bit A and B, direct multiplication results in a 2^n-bit product, requiring not only additional registers or static memory to store the increasing bit width but also additional time overhead for the modulo operation. By allocating the modulo operation to the shift-add multiplier, it can be performed simultaneously with the shift-add multiplication calculation, thus achieving modular multiplication. Decomposing modular multiplication into a combination of multiple modular additions allows reuse of the circuitry and control unit used for modular addition, reducing circuit area and complexity.

[0019] Furthermore, for A×B mod P in the prime field GF(P), observe the objects of modulo operation. Their forms are all Q<<1+R, where Q has already been moduloed, and R=0 or B, B<P. Therefore, Q<<1+R<3P, which means that Q<<1+R mod P=Q<<1+R or Q<<1+RP or Q<<1+R-2P. By judging the magnitude of Q<<1+RP, Q<<1+R-2P and 0, i.e., the sign bit of Q<<1+RP or Q<<1+R-2P, we can obtain the value of Q<<1+R mod P. When Q<<1+RP<0, Q<<1+R mod P=Q<<1+R; when Q<<1+R-2P<0, Q<<1+R mod P=Q<<1+RP; when Q<<1+R-2P≥0, Q<<1+R mod P=Q<<1+R-2P.

[0020] The above modular multiplication method can perform modular multiplication and addition on any prime number field without requiring the pre-computation needed for Montgomery modular multiplication, thus increasing the flexibility of algorithm implementation and allowing the prime number field to be freely changed as needed. The computation time is the same on different prime number fields, therefore changing the prime number has no impact on the computation time.

[0021] Furthermore, the calculation module is used to implement the modulo addition operation by: for A+B mod P in the prime field GF(P), the result value is obtained by judging the magnitude of A+BP and 0. When A+BP < 0, A+B mod P = A+B; when A+BP ≥ 0, A+B mod P = A+BP.

[0022] Furthermore, the calculation module is used to implement the modulo subtraction operation by: taking AB mod P in the prime field GF(P), and obtaining the result value by judging the magnitude of AB and 0. When AB < 0, AB mod P = A - B + P; when AB ≥ 0, A - B mod P = AB.

[0023] Furthermore, the calculation module includes a right shift unit, a left shift unit, a first addition / subtraction unit, an AND logic unit, a first multiplexer, a second multiplexer, and a register.

[0024] The right shift unit is used to perform right shift calculations in elliptic curve calculations;

[0025] The left shift unit is used to perform left shift calculations in the shift-add-multiplication method;

[0026] The first addition and subtraction unit is used to implement addition, subtraction, and linear combination addition and subtraction to achieve modular addition, modular subtraction and modular multiplication functions;

[0027] The aforementioned logic unit is used to implement B×A in the shift-add multiplication method. m ;

[0028] The first multiplexer is used to select the input of the first addition / subtraction unit, and the second multiplexer is used to select the appropriate output update register;

[0029] The register is used to temporarily store the calculation results.

[0030] The computation module simplifies the circuit structure and reduces the circuit area to accommodate the characteristics of operations in the prime number field. Specifically, modular multiplication is decomposed into a combination of complex modular additions, thereby reusing the circuitry and control unit used for modular addition, reducing the circuit area and complexity. All operations of elliptic curve cryptography in the prime number field can be decomposed into modular multiplication and modular addition / subtraction; therefore, a fully functional elliptic curve cryptography algorithm can be designed and implemented based on this.

[0031] Furthermore, the calculation module also includes a first subtraction unit and a second subtraction unit, which are connected in series after the first addition / subtraction unit. By connecting two subtraction units for -P in series, the calculation of Q << 1 + R mod P can be completed in one cycle, reducing the modular multiplication time from 3n cycles to n cycles, thereby improving the calculation speed.

[0032] Furthermore, the calculation module also includes at least one expansion unit, which is used to perform multiple calculations of Q << 1 + R mod P within one cycle. The expansion unit includes a second addition / subtraction unit, a third subtraction unit, a fourth subtraction unit, and a third multiplexer. The second addition / subtraction unit, the third subtraction unit, and the fourth subtraction unit are connected in series. The third multiplexer is used to select the appropriate output to connect to the input of the second addition / subtraction unit, and the second multiplexer selects the appropriate output to update the register. For example, if the calculation module also includes an expansion unit, with pipelined design, two calculations of Q << 1 + R mod P can be completed within one cycle, further improving the computation speed.

[0033] Furthermore, the memory in the storage module selects two large-width static random access memories based on the elliptic curve calculation to be performed, in order to increase data throughput; when the computing acceleration unit is idle, the memory can be used as internal system storage for the processor to reduce system resource waste.

[0034] Furthermore, the register module and the storage control module have a bus interface, allowing the processor to directly access them via the bus. Instructions for the register module can be stored in two ways: either the processor writes them from the bus into the register module's FIFO (First-In, First-Out) memory, or, depending on the application, they are pre-stored in a lookup table or read-only memory, and then read and executed sequentially by the control module. A hybrid hardware-software approach, employing either software-written FIFO memory or hardware-designed read-only memory, is used to improve computational efficiency.

[0035] Furthermore, the register module, storage control module, and control module are located in the first clock domain, while the computation module is located in the second clock domain; both the first and second clock domains are asynchronous. This asynchronous design of the two clock domains can improve computation speed and reduce wiring complexity.

[0036] Furthermore, the control module controls the storage module to perform data transfer according to the configuration and instructions, including directly transporting data from one large-width static random access memory to another large-width static random access memory.

[0037] Beneficial Effects: This invention proposes a computational system applicable to elliptic curves over arbitrary prime fields. It enables elliptic curve-related calculations over any custom prime field within a specified width requirement with minimal area and circuit complexity, thereby implementing various elliptic curve cryptography-related encryption algorithms. Furthermore, by adjusting the design, the computational module can be easily expanded, achieving a balance between power consumption, area, and speed. Through hardware-software co-processing, the more complex logical judgments are handled by software, while the simpler but time-consuming calculations are performed by hardware. This collaborative processing significantly reduces processor time while improving computational efficiency. Simultaneously, it avoids introducing overly complex logic into the hardware, reducing the probability of errors and increasing usability. Attached Figure Description

[0038] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments, and the advantages of the present invention in the above and / or other aspects will become clearer.

[0039] Figure 1 This is a schematic diagram of the structure of a computational system for elliptic curves in any prime field, provided as an embodiment of this application.

[0040] Figure 2This is a schematic diagram of the computation module structure in a computation system that can be used for elliptic curves in any prime field, as provided in an embodiment of this application.

[0041] Figure 3 This is another schematic diagram of the structure of a computation module in a computation system for elliptic curves in any prime field, provided as an embodiment of this application.

[0042] Figure 4 This is a schematic diagram illustrating how the storage space of the memory module is used as internal system storage for the processor in a computational system that can be used for elliptic curves in any prime field, as provided in an embodiment of this application.

[0043] Figure 5 This is a schematic diagram illustrating the instruction storage method of a register module in a computational system applicable to elliptic curves over arbitrary prime fields, provided as an embodiment of this application. Detailed Implementation

[0044] The embodiments of the present invention will now be described with reference to the accompanying drawings.

[0045] Chinese patent application CN201610116729.4 discloses a prime field elliptic curve cryptography system for a VLSI-implemented accelerator, employing two 64-bit adders, two 128-bit adders, two 64-bit multipliers, and several 64-bit registers to achieve hardware acceleration and a three-stage pipelined structure. This technical solution has a complex data path, a large design area, and is not friendly to low-power, low-area chip designs. It uses the Montgomery modular multiplication algorithm, which lacks sufficient freedom in prime field selection, and changing the prime field requires pre-calculation.

[0046] Chinese patent application CN202210915662.6 discloses a prime-field elliptic curve cryptography coprocessor, which uses a large amount of hardware resources, approximately 222.4kGEs (equivalent gates). This results in high hardware consumption and excessive throughput, making its performance unsuitable for general applications. It uses NIST primes for fast modulo reduction, which cannot be customized. This technical solution has a large design area and its throughput far exceeds requirements, making it unfriendly to low-cost designs. Due to its fixed architecture, it is difficult to modify it to improve operating speed or reduce area according to application needs. Modulo is performed using a special form of prime number, preventing free selection of the prime field.

[0047] This application proposes a computational system for elliptic curve cryptography (ECC) over arbitrary prime fields. This system addresses the issues of time-consuming software computations using processors, which hinder real-time performance requirements for ECC encryption. It improves communication encryption / decryption speed, thereby enhancing overall system security. Furthermore, it overcomes the limitations of existing hardware solutions that restrict prime field types and complex structures. This system proposes a simplified structure and a customizable prime field computation mode, improving system efficiency, reducing potential security risks, and increasing the versatility of the encryption / decryption hardware. It can be applied to systems-on-chips and microcontrollers, particularly to IoT chips and communication chips requiring data encryption.

[0048] This application discloses a computational system applicable to elliptic curves over arbitrary prime number fields, including a processor, a bus connected to the processor, and a computation acceleration unit connected to the bus. The computation acceleration unit includes a register module, a computation module for calculation, a control module for controlling the computation module, a storage control module, and a storage module for storing computational data. Figure 1 As shown.

[0049] The register module is used to provide configuration and instructions to the control module, and to provide the processor with the running status, calculation sign bit, size comparison results and interrupt signals through the bus; the configuration includes specifying the prime field, enabling the module, interrupt generation control enable configuration, etc.

[0050] The control module is used to control the storage module to read and write data according to the configuration and instructions, and to control the calculation module to perform calculations; the data reading and writing includes reading the original data from the storage module, writing the calculation results into the storage module, and transferring data within the storage module;

[0051] The calculation module is used to read and write data from the storage module and implement modular addition, subtraction, multiplication, shifting, comparison and dot multiplication operations of elliptic curves. The remaining inversion, dot addition and dot multiplication operations of elliptic curves are implemented by combining modular addition, subtraction, shifting, comparison and modular multiplication.

[0052] The storage control module is used as a storage module controller, and the processor writes and reads data to and from the storage module via a bus.

[0053] The storage module is used to store data.

[0054] First, let's introduce the modular multiplication algorithm used. Considering the implementation of multiplication, the multiplication of two n-bit binary numbers can be achieved through n-1 additions and n-1 shifts. Let the two numbers be A and B, where A... m Let A be the m-th bit of A, and let A0 be the least significant bit of A. The multiplication process of shifting and adding can be represented as follows:

[0055] A×B=B×An-1 << (n-1)+B×A n-2 << (n-2)+…+B×A0<< 0

[0056] =((B×A n-1 +0)<<1+B×A n-2 )<<1...)+B×A0

[0057] Where B×A m Because A m It uses only 1 bit and can be implemented with simple logic, without requiring actual multiplication; << indicates left shift by one bit, i.e., multiplying by two. Each time, the multiplier shifts the previous result left by one bit and adds the new B×A. m n represents the maximum number of bits supported by the calculation module design. Common values ​​are 192, 384, or 521, depending on the requirements of the selected elliptic curve prime field.

[0058] For any four natural numbers C, D, E, F, we have

[0059] (C+D+E)mod F=((C+D)mod F+E)mod F

[0060] Therefore, A×B mod P, where P is the eigenvalue of the prime field GF(P), can be written in the following form: A×B mod P=(((B×A n-1 +0)mod P<<1+B×A n-2 )mod P<<1...)mod P+B×A0)mod P

[0061] This means taking the modulo of the intermediate results at each step of the shift-add multiplication, rather than taking the modulo of the overall result. The advantage of this approach is that for n-bit A and B, the product has a bit width of 2^n bits. This not only requires additional registers or static memory to store the increasing bit width but also incurs additional time overhead to perform the modulo operation. By allocating the modulo operation to the shift-add multiplier, the modulo can be performed simultaneously with the shift-add multiplication calculation, thus achieving modular multiplication.

[0062] For A × B mod P in the prime field GF(P), observing the objects of the modulo operation, we find that they can all be expressed as Q << 1 + R, where Q has already been moduloed, and R = B × A m=0 or B, B < P, therefore Q << 1 + R < 3 P, that is, there must be a value of Q << 1 + R mod P = Q << 1 + R or Q << 1 + R or Q << 1 + R - 2 P. By judging the magnitude of Q << 1 + R, Q << 1 + R - 2 P and 0, that is, the sign bit of Q << 1 + R or Q << 1 + R - 2 P, we can obtain the specific value of Q << 1 + R mod P. When Q << 1 + R < 0, Q << 1 + R mod P = Q << 1 + R; when Q << 1 + R - 2 P < 0, Q << 1 + R mod P = Q << 1 + R; when Q << 1 + R - 2 P ≥ 0, Q << 1 + R mod P = Q << 1 + R - 2 P.

[0063] Similarly, for A+B mod P in the prime field GF(P), the result can be obtained by comparing A+BP with 0. When A+BP < 0, A+B mod P = A+B; when A+BP ≥ 0, A+B mod P = A+BP.

[0064] For AB mod P in the prime field GF(P), the result value is obtained by comparing AB with 0. When AB < 0, AB mod P = A - B + P; when AB ≥ 0, AB mod P = AB.

[0065] These operations are highly similar and can reuse the same computing unit. The algorithm used in this invention performs modular addition and modular multiplication operations without special requirements on the form of the prime number P, and can give results in the same amount of time for any P.

[0066] In summary, the simplest computation module includes a right shift unit, a left shift unit, a first addition / subtraction unit, an AND logic unit, a first multiplexer, a second multiplexer, and a register, such as... Figure 2 As shown. The right shift unit is used to implement the right shift calculation in elliptic curve calculation, and the left shift unit is used to implement the left shift calculation in shift-addition-multiplication. The first addition and subtraction unit is used to implement addition, subtraction, and linear combination addition and subtraction to realize the modular addition, modular subtraction, and modular multiplication functions mentioned above. The AND logic unit is used to implement B×A in shift-addition-multiplication. m The first multiplexer is used to select the input of the first addition and subtraction unit, and the second multiplexer is used to select the appropriate output update register. The register is used to temporarily store the calculation result for subsequent operations, such as temporarily storing the result of A+B, which is then used to calculate A+BP.

[0067] Specifically, the register module controls modulo addition, modulo multiplication, and modulo subtraction instructions, while the control module is responsible for instruction execution. Figure 2In this context, is_add, is_sub, is_mult, is_mod, and is_rshift are control signals, representing addition, subtraction, multiplication, modulo, and right shift, respectively. The intermediate result Q from the aforementioned modular multiplication is stored in a register, so the register is denoted as Q. Initially, the register value is 0. When implementing modular multiplication, the following steps are executed:

[0068] Step 11, Figure 2 The mask in the image is one bit of the n-bit binary data A. m B and the mask can be used to implement B×A through a logic unit. m That is, R in the aforementioned modular multiplication, the first multiplexer selects the output B×A of the AND logic unit according to the control signal. m And the register value Q, after being shifted left by the unit, outputs Q << 1. The first addition / subtraction unit can implement B × A. m +Q << 1. The second multiplexer selects the output of the first addition / subtraction unit, and the register value is updated to B × A. m +Q << 1.

[0069] Step 12: Enter the modulo stage is_mod. The first multiplexer selects the output of the register from the previous cycle and the prime number P; the first addition / subtraction unit performs subtraction to achieve Q << 1 + B × A. m -P, the output of the second multiplexer is Q << 1 + B × A m -P. If the sign bit of the first addition / subtraction unit output indicates that the result is less than 0, then (Q << 1 + B × A) m )mod P=Q<<1+B×A m The register value is not updated and remains B×A. m +Q << 1, continue to step 11. If the sign bit of the first addition / subtraction unit output indicates that the result is greater than or equal to 0, update the register value to the output of the second multiplexer, i.e., Q << 1 + B × A. m -P, proceed to step 13.

[0070] Step 13, still in the modulo stage is_mod, the first multiplexer selects the output of the register from the previous cycle and the prime number P; the first addition / subtraction unit performs subtraction to achieve Q << 1 + B × A m -PP, the output of the second multiplexer is Q << 1 + B × A m -2P. If the sign bit of the first addition / subtraction unit output indicates that the result is less than 0, (Q << 1 + B × A) m )mod P=Q<<1+B×A m -P, the register value is not updated and remains B×A. m+Q << 1 - P, continue to step 11. If the sign bit of the first addition / subtraction unit output indicates that the result is greater than or equal to 0, the output of the second multiplexer is Q << 1 + B × A. m -2P, the register value is updated to the result of the second multiplexer, i.e., Q << 1 + B × A. m -2P, continue with step 11.

[0071] When implementing modular addition, the mask value is 1, and the following steps are performed:

[0072] Step 21: The AND logic unit takes the value B, the first multiplexer selects A and B, the first addition / subtraction unit can implement A+B, the second multiplexer selects A+B and inputs it into the register, and the register value is updated to A+B.

[0073] Step 22: Entering the modulo stage, the first multiplexer selects the previous cycle's register result A+B and the prime number P. The first addition / subtraction unit performs subtraction to achieve A+BP. The output of the second multiplexer is A+BP. If the sign bit of the first addition / subtraction unit's output indicates that the result is less than 0, then A+B mod P = A+B, and the register value is not updated, remaining A+B. If the sign bit of the first addition / subtraction unit's output indicates that the result is greater than or equal to 0, then A+B mod P = A+BP, and the register value is updated to the output of the second multiplexer, i.e., A+BP.

[0074] When performing modulo subtraction, the mask value is 1, and the following steps are executed:

[0075] Step 31: The AND logic unit takes the value B, the first multiplexer selects A and B, the first addition / subtraction unit can implement AB, the second multiplexer selects AB, and the register value is updated to AB; if the sign bit of the first addition / subtraction unit output indicates that the result is less than 0, AB mod P = A - B + P, and continue to step 32. If the sign bit of the first addition / subtraction unit output indicates that the result is greater than 0, AB mod P = AB, and the calculation ends.

[0076] Step 32: Enter the modulo stage. The first multiplexer selects the previous cycle's register result AB and the prime number P. The first addition / subtraction unit performs addition to achieve A - B + P. The output of the second multiplexer is A - B + P. The register value is updated to the output of the second multiplexer, i.e., A - B + P.

[0077] The simplest calculation module described above requires 3n cycles to calculate the modular multiplication of two n-digit numbers, specifically for calculating Q << 1 + R, Q << 1 + R P, and Q << 1 + R - 2P. The scalability of this embodiment lies in the ability to increase the computation speed by expanding the addition and subtraction units and increasing hardware resource consumption. For example, by connecting two subtraction units for -P in series, the calculation of Q << 1 + R mod P can be completed in one cycle, reducing the modular multiplication time to n cycles. Therefore, the calculation module also includes a first subtraction unit and a second subtraction unit, which are connected in series after the first addition and subtraction unit.

[0078] Building upon the aforementioned expansion, the calculation module further includes at least one extension unit. This extension unit is used to perform multiple calculations of Q << 1 + R mod P within one cycle. The extension unit includes a second addition / subtraction unit, a third subtraction unit, a fourth subtraction unit, and a third multiplexer. The second, third, and fourth subtraction units are connected in series. The third multiplexer selects the appropriate output to connect to the input of the second addition / subtraction unit, and the second multiplexer selects the appropriate output to update the register. For example, adding one extension unit, combined with a pipelined design, can complete two calculations of Q << 1 + R mod P within one cycle, such as... Figure 3 As shown.

[0079] The register module and memory control module have a bus interface, which can be directly accessed by the processor via the bus.

[0080] The control module accesses data in the storage module via a direct pass-through for use by the computation module. The storage module utilizes two large-width static random access (SRAM) memory blocks, selected based on the elliptic curve calculation to be performed. The bit width of the memory blocks is chosen according to the elliptic curve calculation; for example, a 521-bit elliptic curve digital signature algorithm requires two 521-bit SRAM blocks. Using two SRAM blocks effectively increases data throughput and minimizes the use of large registers. The storage control module, acting as the SRAM controller for the storage module, allows the processor to write data to the storage module via the bus. When the computation acceleration unit is idle, the memory can be used as internal system storage for the processor. In the implementation, this can be achieved through appropriate address allocation, such as mapping the lower 512 bits of the 521-bit memory to address space 0x00-0x40 for internal system storage. Figure 4 As shown. This part of the storage module is a separate hardware component, and it will not affect the operation of the system, especially the response to interrupts, even during elliptic curve calculations.

[0081] The control module receives relevant configurations and instructions from the registers, and controls the storage module to perform data read / write operations and the calculation module to perform calculations based on these configurations and instructions. The data read / write operations include reading raw data from the storage module, writing calculation results into the storage module, and transferring data between the two static random access memories (SRAMs) of the storage module. Instructions can be written from the bus to the register module's First-In-First-Out (FIFO) memory by the processor software. This design ensures that even if the processor is suspended due to interrupts or other operations during computation, the modules of the computation acceleration unit can still run at full speed. Alternatively, instructions can be pre-stored in a lookup table or read-only memory according to different application needs, and then read and executed sequentially by the control module to implement functions such as dot addition, doubling, and multiplication. Figure 5 As shown, the two instruction input methods ensure the configurability and speed of the computation acceleration unit.

[0082] The control module controls the storage module to perform data transfer according to the configuration and instructions, including directly transporting data from one large-width static random access memory to another large-width static random access memory.

[0083] In the overall design of the computing acceleration unit, the register module, storage control module, and control module are located in the first clock domain, while the computing module is located in the second clock domain. The first and second clock domains are asynchronous; in practice, the first clock domain is a low-speed clock domain, while the second clock domain is typically a high-speed clock domain. Because the computing module requires multiple cycles to complete one operation in the minimum area design, and no other modules are needed during its operation, increasing the operating clock frequency of the computing module can improve the overall operating speed. Simultaneously, this asynchronous design of the first and second clock domains reduces the system's wiring complexity, which is beneficial for subsequent design.

[0084] This application proposes a computational system for elliptic curve cryptography (ECC) over any prime number field. Taking into account the characteristics of operations over prime numbers, it simplifies the circuit structure and reduces the circuit area. Specifically, modular multiplication is decomposed into a combination of complex modular additions, thereby reusing the circuitry and control unit used for modular addition, reducing circuit area and complexity. All operations of elliptic curve cryptography over prime number fields can be decomposed into modular multiplication and modular addition; therefore, a fully functional elliptic curve cryptography algorithm can be designed and implemented based on this.

[0085] The special modular multiplication algorithm of this application embodiment can perform modular multiplication and modular addition on any prime number field without requiring the pre-computation required by Montgomery modular multiplication, thus increasing the degree of freedom in algorithm implementation and allowing the prime number field to be freely changed as needed. Changing to different prime numbers has no impact on the operation time, and the operation time is the same on different prime number fields.

[0086] Compared to Chinese Patent Application No. CN202210915662.6, the computational acceleration unit of the computing system proposed in this application, which can be used for elliptic curves in any prime number field, consumes only 27 kGEs, just 12% of the latter. Furthermore, the computational speed does not decrease in non-special prime number fields. The unit structure of this application can be adjusted to adapt to different system designs with varying speed requirements.

[0087] This invention provides a computational system applicable to elliptic curves over arbitrary prime fields. Many methods and approaches exist for implementing this technical solution; the above description is merely a preferred embodiment. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications should also be considered within the scope of protection of this invention. All components not explicitly stated in this embodiment can be implemented using existing technologies.

Claims

1. A computational system applicable to elliptic curves over arbitrary prime fields, characterized in that, It includes a processor, a bus connected to the processor, and a computing acceleration unit connected to the bus. The computing acceleration unit includes a register module, a control module, a computing module, a storage control module, and a storage module. The register module is used to provide configuration and instructions to the control module, and to provide the processor with the running status, calculation sign bit, size comparison results and interrupt signals through the bus; The control module is used to control the storage module to read and write data according to the configuration and instructions, and to control the calculation module to perform calculations; the data reading and writing includes reading the original data from the storage module, writing the calculation results into the storage module, and moving data within the storage module. The calculation module is used to read and write data from the storage module and implement modular addition, subtraction, multiplication, shifting, comparison and dot multiplication operations of elliptic curves. The remaining inversion, dot addition and dot multiplication operations of elliptic curves are implemented by combining modular addition, subtraction, shifting, comparison and modular multiplication. The storage control module is used as a storage module controller, and the processor writes and reads data to and from the storage module via a bus. The storage module is used to store data; The register module, storage control module, and control module are in the first clock domain, and the calculation module is in the second clock domain; the first and second clock domains are asynchronous clock domains. The calculation module is used to perform modular multiplication operations, including: Let A and B be two n-bit binary data, where n is the maximum number of bits supported by the computing module design. m Let A be the m-th bit of A, where 0 ≤ m ≤ n-1, and the least significant bit of A be A0. Then, perform modular multiplication. Where P is the prime field The eigenvalues ​​of are expressed in the following form: ， Right now Can be represented as a pair The intermediate result of each step in the shift-addition multiplication is moduloed, where This indicates a left shift by one bit; For prime number fields In Observe the objects from which the model is taken; their forms are all... ,in It has already been molded, and or , ,therefore That is, there must be By judgment , The magnitude of 0, i.e. The sign bit can be used to obtain The value when hour, ;when hour, ;when hour, .

2. The computational system for elliptic curves applicable to any prime field according to claim 1, characterized in that, The calculation module is used to implement modular addition operations, including: for the prime number field In By judgment The result value is obtained by comparing it with the magnitude of 0. hour, ;when hour, .

3. The computational system for elliptic curves applicable to any prime field according to claim 1, characterized in that, The calculation module is used to implement modular subtraction operations, including: for prime number fields. In By judgment The result value is obtained by comparing it with the magnitude of 0. hour, ;when hour, .

4. A computational system for elliptic curves applicable to any prime field according to any one of claims 1-3, characterized in that, The calculation module includes a right shift unit, a left shift unit, a first addition / subtraction unit, an AND logic unit, a first multiplexer, a second multiplexer, and a register. The right shift unit is used to perform right shift calculations in elliptic curve calculations; The left shift unit is used to perform left shift calculations in the shift-add-multiplication method; The first addition and subtraction unit is used to implement addition, subtraction, and linear combination addition and subtraction to achieve modular addition, modular subtraction and modular multiplication functions; The aforementioned logic unit is used to implement the shift-add-multiplication method. ; The first multiplexer is used to select the input of the first addition / subtraction unit, and the second multiplexer is used to select the appropriate output update register; The register is used to temporarily store the calculation results.

5. A computational system for elliptic curves applicable to any prime field according to claim 4, characterized in that, The calculation module further includes a first subtraction unit and a second subtraction unit, which are connected in series after the first addition / subtraction unit.

6. A computational system for elliptic curves applicable to any prime field according to claim 5, characterized in that, The computing module further includes at least one expansion unit, which is used to complete multiple operations within one cycle. The calculation; the expansion unit includes a second addition / subtraction unit, a third subtraction unit, a fourth subtraction unit and a third multiplexer. The second addition / subtraction unit, the third subtraction unit and the fourth subtraction unit are connected in series. The third multiplexer is used to select a suitable output to be connected to the input terminal of the second addition / subtraction unit. The second multiplexer selects a suitable output to update the register.

7. The computational system for elliptic curves applicable to any prime field according to claim 1, characterized in that, The memory module selects two large-width static random access memories based on the elliptic curve calculation to be performed; when the computing acceleration unit is idle, the memory can be used as internal system storage for the processor.

8. A computational system for elliptic curves applicable to any prime field according to claim 1, characterized in that, The register module and the storage control module have a bus interface, which can be directly accessed by the processor through the bus. The instructions of the register module are stored in the following ways: the processor writes them from the bus to the register module's first-in-first-out memory, or they are stored in a lookup table or read-only memory in advance according to different application needs, and then read and executed one by one by the control module.

9. A computational system for elliptic curves applicable to any prime field according to claim 7, characterized in that, The control module controls the storage module to perform data transfer according to the configuration and instructions, including directly transporting data from one large-width static random access memory to another large-width static random access memory.

Images