Parallel point addition method of elliptic curve based on AVX512IFMA

Abstract

The invention discloses a parallel point addition method of an elliptic curve based on AVX512IFMA, and belongs to the technical field of computers. The method comprises the following steps: determining each coordinate in coordinates of multiple pairs of point data participating in parallel point addition; determining a target number field corresponding to the multiple pairs of point data, wherein the target number field is a finite field of an elliptic curve or a secondary expansion field of the finite field; determining a large number operation rule corresponding to the target number field; based on the relation between the Z coordinate value Z1 of the point data and the Z coordinate value Z2 of the added point data in each pair of point data in the multiple pairs of point data, determining a target point adding formula of the multiple pairs of point data; converting the coordinate values of the multiple pairs of point data into target data corresponding to a data structure of AVX512IFMA; and processing the target data based on the target point addition formula and the large number operation rule to obtain a point addition result of the multiple pairs of point data. According to the method, the 8 * 1 path parallel acceleration of elliptic curve point addition is realized, and the performance can be greatly optimized and improved.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and in particular to a parallel point addition method of elliptic curve based on AVX512IFMA. Background Art

[0002] In modern cryptography, elliptic curve cryptography (ECC) has been widely used in various information security fields, such as digital signatures, blockchain, SSL / TLS protocols, etc., due to its high security and low computational complexity. Elliptic curve point addition and point multiplication are the basic operations of ECC, and their efficiency directly affects the performance of the entire cryptographic system. Therefore, how to optimize these basic operations, especially the speed of point addition, has become a hot research issue.

[0003] Traditional ECC point addition implementation methods usually rely on large integer operations. Since the points on the elliptic curve are represented as large integer pairs, these operations involve a large number of modular addition, modular subtraction, modular multiplication and other operations. Although the computing power of modern processors has been significantly improved, there are still performance bottlenecks in the face of large-scale elliptic curve point operations. In addition, traditional methods have low utilization rates in parallel computing and cannot give full play to the advantages of modern multi-core processors.

[0004] AVX512IFMA (AVX-512Integer Fused Multiply-Add) is a single instruction multiple data (SIMD) instruction set introduced by Intel and is part of the AVX-512 instruction set. It provides efficient vectorized integer computing capabilities, especially supporting fused multiply-add operations (Fused Multiply-Add), that is, performing multiplication and addition operations simultaneously. This operation can significantly reduce the number of instructions and increase the computing speed. In addition, AVX512IFMA supports 512-bit vector registers, allowing each instruction to process more data, thereby further improving the efficiency of parallel computing.

[0005] Nowadays, many cryptographic implementations have begun to use SIMD to accelerate operations, such as using it in encryption, digital signatures, and TLS protocols to improve computing efficiency and response speed. The BLS12-381 curve is a high-security elliptic curve that is widely used in the field of cryptography, especially in zero-knowledge proof systems and public key cryptography. However, there is currently a lack of optimization solutions for the AVX512IFMA instruction set for this curve.

[0006] Therefore, there is a problem in the related art that the AVX512IFMA instruction set has not been used to optimize the point addition calculation in the elliptic curve. Currently, there is no solution that uses the parallel data processing advantages of the AVX512IFMA instruction set to achieve the calculation acceleration of the elliptic curve point addition. Summary of the invention

[0007] This application aims to solve at least one of the technical problems existing in the related art. To this end, this application proposes a parallel point addition method for elliptic curves based on AVX512IFMA, which uses the characteristics of the AVX512IFMA single instruction multiple data instruction set to simultaneously process multiple data elements of the same type in the same instruction cycle, and implements 8×1 parallel acceleration for the elliptic curve point addition part, which can achieve significant performance optimization and improvement.

[0008] In a first aspect, the present application provides a parallel point addition method for an elliptic curve based on AVX512IFMA, the method comprising:

[0009] Determine each coordinate of the coordinates of multiple pairs of point data involved in parallel point addition, each pair of point data includes two types of point data: adding point data and added point data;

[0010] Determine a target number field corresponding to multiple pairs of point data, where the target number field is a finite field of an elliptic curve or a quadratic extension of a finite field;

[0011] Determine the large number operation rules corresponding to the target number domain;

[0012] Determine the target point adding formula for the multiple pairs of point data based on the relationship between the Z coordinate value Z1 of the added point data and the Z coordinate value Z2 of the added point data in each pair of point data in the multiple pairs of point data;

[0013] Convert the coordinate values ​​of multiple pairs of point data into target data corresponding to the data structure of AVX512IFMA;

[0014] The target data is processed based on the target point addition formula and large number operation rules to obtain the point addition results of multiple pairs of point data.

[0015] According to the parallel point addition method of elliptic curve based on AVX512IFMA of the present application, by utilizing the characteristic of single instruction multiple data instruction set that can simultaneously process multiple data elements of the same type in the same instruction cycle, the underlying 8×1-way finite field operation and the upper-level 8×1-way point addition operation of the elliptic curve are implemented. At the same time, since the underlying large number operation rules are determined based on the target number field, and the point addition formula varies with the change of the coordinate relationship of the point data involved in the point addition calculation, therefore, multiple types of point addition operation interfaces can be provided, and the AVX512IFMA instruction set is used to implement 8×1-way parallel acceleration of the point addition part of the elliptic curve, which can achieve substantial performance optimization and improvement.

[0016] According to an embodiment of the present application, there are three types of relationships between the Z coordinate value Z1 of the added point data and the Z coordinate value Z2 of the added point data in each pair of point data in the multiple pairs of point data, which are:

[0017] Z1=Z2=1, Z1≠Z2=1, and Z1≠Z2.

[0018] According to one embodiment of the present application, the coordinate values ​​of multiple pairs of point data are converted into target data corresponding to the data structure of AVX512IFMA, including:

[0019] Each coordinate value in the coordinates of the plurality of pairs of point data is converted into a coordinate value vector corresponding to the target operation base of AVX512IFMA;

[0020] Multiple coordinate value vectors corresponding to each coordinate value of each point data form a vector set to obtain target data.

[0021] According to one embodiment of the present application, each coordinate value in the coordinates of multiple pairs of point data is converted into a coordinate value vector corresponding to the target operation base of AVX512IFMA, including:

[0022] Determine the data types corresponding to multiple pairs of point data;

[0023] If the data type is a standard element corresponding to the finite field where the elliptic curve is located, each coordinate value in the coordinates of the multiple pairs of point data is converted into a coordinate value vector corresponding to the target operation base of AVX512IFMA based on a preset rule;

[0024] If the data type is a preset data type expressed on a Montgomery domain, each coordinate value in the coordinates of the plurality of pairs of point data is converted into a coordinate value vector corresponding to the target operation base of AVX512IFMA based on the Montgomery domain conversion rule corresponding to the target number domain.

[0025] According to one embodiment of the present application, if the data type is a standard element corresponding to the finite field where the elliptic curve is located, each coordinate value in the coordinates of the plurality of pairs of point data is converted into a coordinate value vector corresponding to the target operation base of AVX512IFMA based on a preset rule, including:

[0026] For any coordinate value f in the coordinate values ​​of the multiple pairs of point data, the data type of any coordinate value f is a standard element corresponding to the finite field where the elliptic curve is located, and the coordinate value vector F corresponding to the target operation base of AVX512IFMA corresponding to any coordinate value f is determined by the following formula:

[0027] f=f0+2 52 f1+2104 f2+2 156 f3+2 208 f4+2 260 f5+2 312 f6+2 364 f7

[0028] F=[f0, f1, f2, f3, f4, f5, f6, f7]

[0029] Where 0≤f i <2 52 And 0≤i<8, i is an integer, and the target operation base is 2 52 .

[0030] According to an embodiment of the present application, a plurality of coordinate value vectors corresponding to each coordinate value of each type of point data constitute a vector set, including:

[0031] The vector set V is determined by the following formula:

[0032]

[0033] Among them, the multiple coordinate value vectors corresponding to any coordinate of any point data are F a , F b , F c , F d , F e , F f , F g and F h , any column of the vector set V corresponds to a coordinate value vector, and the i-th row of the vector set V corresponds to a register vector v i =[f i a , f i b , f i c , f i d , f i e , f i f , f i g , f i h ], 0≤i<8, i is an integer.

[0034] In a second aspect, the present application provides a parallel point addition device for an elliptic curve based on AVX512IFMA, the device comprising:

[0035] A first determination module is used to determine each coordinate of the coordinates of multiple pairs of point data participating in parallel point addition, each pair of point data includes two types of point data: adding point data and added point data;

[0036] A second determination module is used to determine a target number field corresponding to multiple pairs of point data, where the target number field is a finite field of an elliptic curve or a quadratic extension field of a finite field;

[0037] A third determination module is used to determine a large number operation rule corresponding to the target number domain;

[0038] A fourth determination module, for determining a target point addition formula for the plurality of pairs of point data based on a relationship between a Z coordinate value Z1 of the added point data and a Z coordinate value Z2 of the added point data in each pair of point data in the plurality of pairs of point data;

[0039] A data arrangement module, used for converting the coordinate values ​​of multiple pairs of point data into target data corresponding to the data structure of AVX512IFMA;

[0040] The data processing module is used to process the target data based on the target point addition formula and large number operation rules to obtain the point addition results of multiple pairs of point data.

[0041] According to the parallel point addition device of elliptic curve based on AVX512IFMA of the present application, by utilizing the characteristic of single instruction multiple data instruction set that can simultaneously process multiple data elements of the same type in the same instruction cycle, the underlying 8×1-way finite field operation and the upper-level 8×1-way point addition operation of the elliptic curve are implemented. At the same time, since the underlying large number operation rules are determined based on the target number field, and the point addition formula varies with the change of the coordinate relationship of the point data participating in the point addition calculation, therefore, multiple types of point addition operation interfaces can be provided, and the AVX512IFMA instruction set is used to implement 8×1-way parallel acceleration of the elliptic curve point addition part, which can obtain substantial performance optimization and improvement.

[0042] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the parallel point addition method of the elliptic curve based on AVX512IFMA as described in the first aspect above is implemented.

[0043] In a fourth aspect, the present application provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the parallel point addition method of elliptic curve based on AVX512IFMA as described in the first aspect above.

[0044] In a fifth aspect, the present application provides a chip, comprising a processor and a communication interface, wherein the communication interface and the processor are coupled, and the processor is used to run programs or instructions to implement the parallel point addition method of elliptic curve based on AVX512IFMA as in the first aspect.

[0045] In a sixth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the parallel point addition method of elliptic curve based on AVX512IFMA as described in the first aspect above.

[0046] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0048] Figure 1 It is a flowchart of a parallel point addition method for elliptic curves based on AVX512IFMA provided in an embodiment of the present application;

[0049] Figure 2 It is a structural schematic diagram of a parallel point addition device of an elliptic curve based on AVX512IFMA provided in an embodiment of the present application;

[0050] Figure 3 It is a structural diagram of a parallel point addition calculation engine of an elliptic curve based on AVX512IFMA provided in an embodiment of the present application;

[0051] Figure 4 It is a hardware schematic diagram of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.

[0053] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0054] In combination with the accompanying drawings, the parallel point addition method of elliptic curve based on AVX512IFMA, the parallel point addition device of elliptic curve based on AVX512IFMA, the electronic device and the readable storage medium provided in the embodiments of the present application are described in detail through specific embodiments and their application scenarios.

[0055] Among them, the parallel point addition method of the elliptic curve based on AVX512IFMA can be applied to the terminal, and can be specifically executed by hardware or software in the terminal.

[0056] The embodiment of the present application provides a parallel point addition method for an elliptic curve based on AVX512IFMA. The execution subject of the parallel point addition method for an elliptic curve based on AVX512IFMA can be an electronic device or a functional module or functional entity in the electronic device that can implement the parallel point addition method for an elliptic curve based on AVX512IFMA. The electronic devices mentioned in the embodiment of the present application include but are not limited to mobile phones, tablet computers, computers, cameras, and wearable devices. The parallel point addition method for an elliptic curve based on AVX512IFMA provided in the embodiment of the present application is described below using an electronic device as an example of the execution subject.

[0057] First, the definitions and corresponding definitions required for this application are explained as follows:

[0058] Finite field of the BLS12-381 elliptic curve, where p is the modulus of the BLS12-381 elliptic curve.

[0059] BLS12-381 Finite Fields of Elliptic Curves Secondary expansion domain.

[0060] R: BLS12-381 elliptic curve.

[0061] P i : The coordinates of the elliptic curve point i, expressed as (X, Y, Z), P i∈E where 1≤i≤n, n is the order of the elliptic curve.

[0062] v i : A 512-bit vector.

[0063] V: vector set, consisting of 8 v i (0≤i<8), which can represent 8 large numbers.

[0064] A, R, C: three different vector sets.

[0065] Q: A vector set consisting of moduli.

[0066] The elliptic curve point group on .

[0067] The elliptic curve point group on .

[0068] PADD * : Elliptic curve point addition, when Z1=Z2=1, Z1 and Z2 are the Z coordinate values ​​of the two points participating in the point addition.

[0069] PADD: Elliptic curve point addition, when Z1≠Z2=1, Z1 and Z2 are the Z coordinates of two points respectively.

[0070] PADD + : Elliptic curve point addition, when Z1≠Z2, Z1 and Z2 are the Z coordinates of two points respectively.

[0071] like Figure 1 As shown, the parallel point addition method of the elliptic curve based on AVX512IFMA includes: step 110, step 120, step 130, step 140, step 150 and step 160.

[0072] Step 110: determine each coordinate of the multiple pairs of point data involved in parallel point addition, each pair of point data includes two types of point data: adding point data and added point data.

[0073] It should be noted that AVX512IFMA can perform parallel operations on multiple groups of data by using a set of instructions. The AVX512IFMA instruction set is essentially similar to a vector processor, which can perform the same operation on a set of data (also called "data vector") at the same time, thereby achieving spatial parallelism. Given that the AVX-512IFMA instruction set supports multiplication and addition operations on integers in each 64-bit channel of two registers, an 8×1 data arrangement can be achieved, that is, a maximum of 8 pairs of point data of the same type can be processed simultaneously in the same instruction cycle. Therefore, the number of pairs of point data on the elliptic curve participating in the parallel point addition each time cannot exceed 8. Since the AVX-512IFMA instruction set implements an 8×1 data arrangement, when the number of pairs of point data participating in the parallel point addition does not reach 8, for example, only 5 pairs of point data participate in the parallel point addition, the remaining 3 pairs of data can be set to 0, but usually in order to achieve efficient parallel point addition processing, 8 pairs of point data are arranged as much as possible in each instruction cycle to participate in the parallel point addition. For example, for the same type of point data P1, Q1, P2, Q2, P3, Q3, P4, Q4, P5, Q5, P6, Q6, P7, Q7, P8 and Q8 on the elliptic curve, if you want to implement the point addition of adding point data P1 and added point data Q1, the point addition of adding point data P2 and added point data Q2, the point addition of adding point data P3 and added point data Q3, the point addition of adding point data P4 and added point data Q4, the point addition of adding point data P5 and added point data Q5, the point addition of adding point data P6 and added point data Q6, the point addition of adding point data P7 and added point data Q7, the point addition of adding point data P8 and added point data Q8, then the above 8 point addition calculations can be processed simultaneously in the same instruction cycle, and for the two point data participating in the point addition calculation, they are divided into two point data types, one is the adding point data and the other is the added point data, which is used to distinguish the addend and the addend.

[0074] It should also be noted here that the elliptic curve targeted by the embodiment of the present application is a specific curve BLS12-381 curve. Therefore, it can be determined that the coordinate values ​​of the point data on the elliptic curve are standard binary large integers represented by 381 bits in most cases. If the point data on the determined elliptic curve comes from a special database, and the data in the special database is a data type expressed on the Montgomery field, then the point data on the elliptic curve participating in the point addition also needs to be converted to the Montgomery field, which will be explained in detail later.

[0075] Step 120: Determine a target number field corresponding to multiple pairs of point data, where the target number field is a finite field of an elliptic curve or a quadratic extension of a finite field.

[0076] It should be noted that the point addition calculation on the point data on the BLS12-381 curve can be divided into two types of point data in the target number field. One is the finite field of the elliptic curve BLS12-381. Elliptic curve point group on The other is the finite field of the elliptic curve BLS12-381. Secondary expansion of Elliptic curve point group on For different target number domains, the corresponding large number operation rules of the underlying number domain operation layer are also different, that is, for finite domains Large number operations on the AVX512IFMA, including modular addition, modular subtraction, modular doubling, modular multiplication, and modular squaring, all have a set of operation rules corresponding to AVX512IFMA; and for the quadratic expansion domain It also includes modular addition, modular subtraction, modular doubling, modular multiplication and modular square operations, and is based on finite fields. Another set of operation rules expanded on the basis of the rules for large number operations.

[0077] Step 130: Determine the large number operation rules corresponding to the target number domain.

[0078] It can be understood that since the target number field includes two types, namely the finite field of the elliptic curve BLS12-381 Finite fields of elliptic curves BLS12-381 Secondary expansion of There are corresponding large number operation rules for the two number fields.

[0079] Step 140 , based on the relationship between the Z coordinate value Z1 of the added point data and the Z coordinate value Z2 of the added point data in each pair of point data in the multiple pairs of point data, determine the target point adding formula for the multiple pairs of point data.

[0080] It should be noted that when performing point addition calculation on the BLS12-381 curve, the different relationship between the Z coordinate values ​​of the adding point data and the added point data will lead to different point addition calculation formulas. For example, the coordinates of the adding point data P are (X1, Y1, Z1), and the coordinates of the added point data Q are (X2, Y2, Z2). If Z1 = Z2 = 1, then the calculation formula for the coordinates (X3, Y3, Z3) of the result point data R obtained by the point addition calculation is as follows:

[0081] H=X2-X1

[0082] HH=H 2

[0083] I=4*HH

[0084] J=H*I

[0085] r=2*(Y2-Y1)

[0086] V=X1*I

[0087] X3=r 2 -J-2*V

[0088] Y3=r*(V-X3)-2*Y1*J

[0089] Z3=2*H

[0090] If Z1≠Z2=1, the calculation formula for the coordinates (X3, Y3, Z3) of the result point data R obtained by point addition calculation is as follows:

[0091] Z1Z1=Z1 2

[0092] U2=X2*Z1Z1

[0093] S2=Y2*Z1*Z1Z1

[0094] H=U2-X1

[0095] HH=H 2

[0096] I=4*HH

[0097] J=H*I

[0098] r=2*(S2-Y1)

[0099] V=X1*I

[0100] X3=r 2 -J-2*V

[0101] Y3=r*(V-X3)-2*Y1*J

[0102] Z3=(Z1+H) 2 -Z1Z1-HH

[0103] If Z1≠Z2, the calculation formula for the coordinates (X3, Y3, Z3) of the result point data R obtained by point addition calculation is as follows:

[0104] Z1Z1=Z1 2

[0105] Z2Z2=Z2 2

[0106] U1=X1*Z2Z2

[0107] U2=X2*Z1Z1

[0108] S1=Y1*Z2*Z2Z2

[0109] S2=Y2*Z1*Z1Z1

[0110] H=U2-U1

[0111] I=(2*H) 2

[0112] J=H*I

[0113] r=2*(S2-S1)

[0114] V=U1*I

[0115] X3=r 2 -J-2*V

[0116] Y3=r*(V-X3)-2*S1*J

[0117] Z3=((Z1+Z2) 2 -Z1Z1-Z2Z2)*H

[0118] Therefore, it is necessary to determine the relationship between the Z coordinate values ​​of the added point data and the added point data.

[0119] Step 150: Convert the coordinate values ​​of multiple pairs of point data into target data corresponding to the data structure of AVX512IFMA.

[0120] It should be noted here that the conversion of the data structure of the coordinate values ​​of multiple pairs of point data needs to be performed according to the characteristics of AVX512IFMA. Since the AVX-512IFMA instruction set supports multiplication and addition operations on 52-bit unsigned integers in each 64-bit channel of two registers, 2 52 As the calculation base, first convert each coordinate value in the coordinates of multiple pairs of point data to the calculation base of 2. 52 coordinate value vector; then, multiple coordinate value vectors corresponding to each coordinate value of each point data constitute a vector set to obtain the target data.

[0121] Step 160: Process the target data based on the target point addition formula and large number operation rules to obtain point addition results of multiple pairs of point data.

[0122] It can be understood that no matter which target point addition formula is, the target point addition formula needs to call the underlying large number operation rules to perform basic operations. Therefore, after determining the target point addition formula and determining a set of underlying large number operation rules determined by the target number domain to which the point data participating in the point addition calculation belongs, then the corresponding set of underlying large number operation rules is called based on the target point addition formula to process multiple pairs of point data.

[0123] According to the parallel point addition method of elliptic curve based on AVX512IFMA provided in the embodiment of the present application, by utilizing the characteristic of single instruction multiple data instruction set that can simultaneously process multiple data elements of the same type in the same instruction cycle, the underlying 8×1-way finite field operation and the upper-level 8×1-way point addition operation are implemented for the BLS121-381 curve. At the same time, since the underlying large number operation rules are determined based on the target number field, and the point addition formula varies with the change of the coordinate relationship of the point data involved in the point addition calculation, various types of point addition operation interfaces can be provided, and the AVX512IFMA instruction set is used to implement 8×1-way parallel acceleration of the elliptic curve point addition part, which can achieve substantial performance optimization and improvement.

[0124] In some embodiments, the relationship between the Z coordinate value Z1 of the added point data and the Z coordinate value Z2 of the added point data in each pair of point data in the plurality of pairs of point data includes three types, namely:

[0125] Z1=Z2=1, Z1≠Z2=1, and Z1≠Z2.

[0126] Specifically, the point data on the BLS121-381 curve is usually represented by an elliptic curve point in the Jacobi coordinate system. Therefore, the coordinates of the point data on the BLS121-381 curve include three coordinate values: X, Y, and Z. The relationship between the Z coordinate values ​​of the two point data participating in the point addition on the BLS121-381 curve determines the corresponding point addition formula. For example, the coordinates of the added point data P are (X1, Y1, Z1), and the coordinates of the added point data Q are (X2, Y2, Z2). If Z1=Z2=1, then the calculation formula for the coordinates (X3, Y3, Z3) of the result point data R obtained by the point addition calculation is as follows:

[0127] H=X2-X1

[0128] HH=H 2

[0129] I=4*HH

[0130] J=H*I

[0131] r=2*(Y2-Y1)

[0132] V=X1*I

[0133] X3=r 2 -J-2*V

[0134] Y3=r*(V-X3)-2*Y1*J

[0135] Z3=2*H

[0136] If Z1≠Z2=1, the calculation formula for the coordinates (X3, Y3, Z3) of the result point data R obtained by point addition calculation is as follows:

[0137] Z1Z1=Z1 2

[0138] U2=X2*Z1Z1

[0139] S2=Y2*Z1*Z1Z1

[0140] H=U2-X1

[0141] HH=H 2

[0142] I=4*HH

[0143] J=H*I

[0144] r=2*(S2-Y1)

[0145] V=X1*I

[0146] X3=r 2 -J-2*V

[0147] Y3=r*(V-X3)-2*Y1*J

[0148] Z3=(Z1+H) 2 -Z1Z1-HH

[0149] If Z1≠Z2, the calculation formula for the coordinates (X3, Y3, Z3) of the result point data R obtained by point addition calculation is as follows:

[0150] Z1Z1=Z1 2

[0151] Z2Z2=Z2 2

[0152] U1=X1*Z2Z2

[0153] U2=X2*Z1Z1

[0154] S1=Y1*Z2*Z2Z2

[0155] S2=Y2*Z1*Z1Z1

[0156] H=U2-U1

[0157] I=(2*H) 2

[0158] J=H*I

[0159] r=2*(S2-S1)

[0160] V=U1*I

[0161] X3=r 2 -J-2*V

[0162] Y3=r*(V-X3)2*S1*J

[0163] Z3=((Z1+Z2) 2 -Z1Z1-Z2Z2)*H

[0164] Therefore, it is necessary to determine the relationship between the Z coordinate values ​​of the added point data and the added point data.

[0165] It can be understood that there are two types of point data in the target number field, namely the finite field of the elliptic curve BLS12-381 Elliptic curve point group on Point data in, and the finite field of the elliptic curve BLS12-381 Secondary expansion of

[0166] Elliptic curve point group on The point data in the point addition, plus three different point addition formulas corresponding to the three different situations of the relationship between the Z coordinates of the two points involved in the point addition, can actually realize 2×3=6 different point addition operations, that is, the computing engine (i.e., device) corresponding to the parallel point addition method of the elliptic curve based on AVX512IFMA provided in the embodiment of the present invention can include the point addition of the three point addition formulas of the two groups of the elliptic curve BLS12-381, that is, 6 different point addition operation interfaces are provided.

[0167] In some embodiments, step 150 may include:

[0168] Each coordinate value in the coordinates of the plurality of pairs of point data is converted into a coordinate value vector corresponding to the target operation base of AVX512IFMA;

[0169] Multiple coordinate value vectors corresponding to each coordinate value of each point data form a vector set to obtain target data.

[0170] It should be noted that for each pair of point data, there are two types of point data, namely, the adding point data and the added point data. Each point data is represented by three coordinate values ​​X, Y and Z. Each coordinate value is a large number. Since the AVX-512IFMA instruction set supports multiplication and addition operations on 52-bit unsigned integers in each 64-bit channel of two registers, each coordinate value must first be converted to an operation base of 2. 52 The coordinate vector of .

[0171] Then, the multiple coordinate value vectors corresponding to each coordinate value of each point data are rearranged to construct a vector set. Since there are two types of point data, namely, adding point data and added point data, and each point data has three coordinate values ​​of X, Y and Z, there are a total of 6 vector sets. In order to facilitate the description of 8×1 data parallel processing, the multiple pairs of point data involved in parallel point addition are set to 8 pairs of point data here and in the following text. For example, the same type of point data P1, Q1, P2, Q2, P3, Q3, P4, Q4, P5, Q5, P6, Q6, P7, Q7, P8 and Q8 on the elliptic curve, if you want to implement the addition of point data P1(X P1 , Y P1 , Z P1 ) and the added data Q1(X Q1 , Y Q1 , Z Q1 ) point, add point data P2(X P2 , Y P2 , Z P2 ) and the added data Q2(X Q2 , Y Q2 , Z Q2 ) point addition, add point data P3(X P3 , Y P3 , Z P3 ) and the added data Q3(X Q3 , Y Q3 , Z Q3 ) point addition, add point data P4(X P4 , Y P4 , Z P4 ) and the added data Q4(X Q4 , Y Q4 , Z Q4 ) point addition, add point data P5(X P5 , Y P5 , Z P5 ) and the added data Q5(X Q5 , Y Q5 , Z Q5 ) point addition, add point data P6(X P6 , Y P6 , Z P6 ) and the added data Q6(XQ6 , Y Q6 , Z Q6 ) point addition, add point data P7(X P7 , Y P7 , Z P7 ) and the added data Q7(X Q7 , Y Q7 , Z Q7 ) point addition, add point data P8(X P8 , Y P8 , Z P8 ) and the added data Q8(X Q8 , Y Q8 , Z Q8 ) point, first add X P1 , Y P1 , Z P1 , X Q1 , Y Q1 , Z Q1 , X P2 , Y P2 , Z P2 , X Q2 , Y Q2 , Z Q2 , X P3 , Y P3 , Z P3 , X Q3 , Y Q3 , Z Q3 , X P4 , Y P4 , Z P4 , X Q4 , Y Q4 , Z Q4 , X P5 , Y P5 , Z P5 , X Q5 , Y Q5 , Z Q5 , X P6 , Y P6 , Z P6 , X Q6 , Y Q6 , Z Q6 , X P7 , Y P7 , Z P7 , X Q7 , Y Q7 , Z Q7 , X P8 , Y P8 , Z P8 , X Q8 , Y Q8 , Z Q8A total of 8×2×3=48 coordinate values ​​are converted to the calculation base of 2 52 The coordinate value vectors, for example, the converted coordinate value vectors are VX P1 , VY P1 , VZ P1 , VX Q1 , VY Q1 , VZ Q1 , VX P2 , VY P2 , VZ P2 , VX Q2 , VY Q2 , VZ Q2 , VX P3 , VY P3 , VZ P3 , VX Q3 , VY Q3 , VZ Q3 , VX P4 , VY P4 , VZ P4 , VX Q4 , VY Q4 , VZ Q4 , VX P5 , VY P5 , VZ P5 , VX Q5 , VY Q5 , VZ Q5 , VX P6 , VY P6 , VZ P6 , VX Q6 , VY Q6 , VZ Q6 , VX P7 , VY P7 , VZ P7 , VX Q7 , VY Q7 , VZ Q7 , VX P8 , VY P8 , VZ P8 , VX Q8 , VY Q8 , VZ Q8; Then rearrange the 8 coordinate value vectors corresponding to each coordinate value of each point data to construct a vector set, which is equivalent to constructing a vector set for the 8 coordinate value vectors of the X coordinate value in the added point data, constructing a vector set for the 8 coordinate value vectors of the Y coordinate value in the added point data, constructing a vector set for the 8 coordinate value vectors of the Z coordinate value in the added point data, constructing a vector set for the 8 coordinate value vectors of the X coordinate value in the added point data, constructing a vector set for the 8 coordinate value vectors of the Y coordinate value in the added point data, and constructing a vector set for the 8 coordinate value vectors of the Z coordinate value in the added point data. There are a total of 6 vector sets. Continuing with the above example, 6 vector sets V1, V2, V3, V4, V5 and V6 are constructed, where V1 = <VX P1 , VX P2 , VX P3 , VX P4 , VX P5 , VX P6 , VX P7 , VX P8 >,V2= <VY P1 , VY P2 , VY P3 , VY P4 , VY P5 , VY P6 , VY P7 , VY P8 >,V3= <VZ P1 , VZ P2 , VZ P3 , VZ P4 , VZ P5 , VZ P6 , VZ P7 , VZ P8 >,V4= <VX Q1 , VX Q2 , VX Q3 , VX Q4 , VX Q5 , VX Q6 , VX Q7 , VX Q8 >,V5= <VY Q1 , VY Q2 , VY Q3 , VY Q4 , VY Q5 , VY Q6 , VY Q7 , VY Q8 >,V6= <VZ Q1 , VZ Q2 , VZ Q3 , VZ Q4 , VZQ5 , VZ Q6 , VZ Q7 , VZ Q8 >.

[0172] In some embodiments, each coordinate value in the coordinates of the plurality of pairs of point data is converted into a coordinate value vector corresponding to a target operation base of AVX512IFMA, including:

[0173] Determine the data types corresponding to multiple pairs of point data;

[0174] If the data type is a standard element corresponding to the finite field where the elliptic curve is located, each coordinate value in the coordinates of the multiple pairs of point data is converted into a coordinate value vector corresponding to the target operation base of AVX512IFMA based on a preset rule;

[0175] If the data type is a preset data type expressed on a Montgomery domain, each coordinate value in the coordinates of the plurality of pairs of point data is converted into a coordinate value vector corresponding to the target operation base of AVX512IFMA based on the Montgomery domain conversion rule corresponding to the target number domain.

[0176] It should be noted that, since the point data required to participate in the point addition can come from databases with different data structures, it is necessary to first determine the data type of the point data participating in the point addition calculation, which usually corresponds to the elliptic curve BLS12-381. The data type of the point data participating in the point addition calculation is a 381-bit binary number. Then, each coordinate value of the 8 pairs of point data can be directly converted into an operation base of 2 based on the preset rules. 52 However, there are other cases where the point data involved in the point addition calculation comes from a database of a specific Montgomery domain. Therefore, for such other cases, each of the coordinate values ​​of the 8 pairs of point data is converted to an operation base of 2 based on the Montgomery domain conversion rule corresponding to the target number domain. 52 For example, in most cases, modern computer architectures are 64-bit and often use 2 for large number operations. 64 As the operation base, but in this application, the operation base of AVX512IFMA is 2 52 Therefore, when performing point addition operations, it is sometimes necessary to perform a Montgomery domain conversion. A domain conversion is essentially a Montgomery multiplication process. For example, a is a 381-bit binary number, R1 is the first Montgomery domain, and R2 is the second Montgomery domain. To convert aR1 to aR2, we only need to perform aR1 and R2 on the R2 domain. In finite fields Montgomery multiplication on aR2; to convert aR2 to aR1, we only need to perform a Montgomery multiplication on the R2 domain and aR2 and R1 on the finite field Montgomery multiplication on .

[0177] In some embodiments, if the data type is a standard element corresponding to the finite field where the elliptic curve is located, each coordinate value in the coordinates of the plurality of pairs of point data is converted into a coordinate value vector corresponding to the target operation base of AVX512IFMA based on a preset rule, including:

[0178] For any coordinate value f in the coordinate values ​​of the multiple pairs of point data, the data type of any coordinate value f is a standard element corresponding to the finite field where the elliptic curve is located, and the coordinate value vector F corresponding to the target operation base of AVX512IFMA corresponding to any coordinate value f is determined by the following formula:

[0179] f=f0+2 52 f1+2 104 f2+2 156 f3+2 208 f4+2 260 f5+2 312 f6+2 364 f7

[0180] F=[f0, f1, f2, f3, f4, f5, f6, f7]

[0181] Where 0≤f i <2 52 And 0≤i<8, i is an integer, and the target operation base is 2 52 .

[0182] Specifically, based on the AVX-512IFMA instruction set, the 8×1 data arrangement of the point data of the participating point addition is first performed using the operation base 2 52 Since the AVX-512IFMA instruction set supports multiplication and addition of 52-bit unsigned integers in each 64-bit lane of two registers, it is natural to use 2 52 As the base. For example, in the BLS12-381 curve, base 2 is used 52 The 381-bit integer f represented by can be expressed as follows, where 0≤f i <2 52 And 0≤i<8.

[0183] f=f0+2 52 f1+2 104 f2+2 156 f3+2 208 f4+2 260 f5+2 312 f6+2 364 f7.

[0184] In some embodiments, a plurality of coordinate value vectors corresponding to each coordinate value of each type of point data form a vector set, including:

[0185] The vector set V is determined by the following formula:

[0186]

[0187] Among them, the multiple coordinate value vectors corresponding to any coordinate of any point data are F a , F b , F c , F d , F e , F f , F g and F h , any column of the vector set V corresponds to a coordinate value vector, and the i-th row of the vector set V corresponds to a register vector v i =[f i a , f i b , f i c , f i d , f i e , f i f , f i g , f i h ], 0≤i<8, i is an integer.

[0188] Specifically, in the 8×1-way parallel computing of this application, the main data structure is the vector set V, which consists of 8 vectors v i (0≤i<8). Each v i From eight base 2 52 The elements of can be stored in a 512-bit register for calculation. Here, the logarithm of the multiple pairs of point data participating in the parallel point addition is set to be exactly equal to 8. Therefore, for eight integers The vector set V is defined as follows, where each vector v i =[f i a ,f i b ,f i c ,f i d ,f i e ,f i f ,fi g ,f i h ].

[0189]

[0190] Based on this data structure, the present application can use AVX-512IFMA to implement 8×1 basic finite field operations. If the number of pairs of point data involved in parallel point addition is less than 8, for example, 5 pairs of point data are parallelized for point addition calculation, then the F in the above vector set V a ,F b ,F c ,F d and F e They correspond to five coordinate value vectors in sequence. These five coordinate value vectors are determined based on any coordinate value of any one of the five pairs of point data, and the remaining vectors F in the vector set V f ,F g and F h Then set it to 0.

[0191] Here we continue to explain the large number operations of different target number fields. The following first explains the finite field Large number operations on the computer include modular addition, modular subtraction, modular doubling, modular multiplication, and modular squaring.

[0192] For modular addition, modular subtraction, and modular doubling operations: Modular addition can be expressed as C←A+B mod Q, which contains three steps: First, add A and B and store their sum in C; then, subtract Q from C, but some channels in C may have negative values, so a 512-bit mask vector is created, in which each 64-bit element corresponds to the 8 integers in C. If the integer in the channel is negative, the corresponding 64-bit element is set to all 1s; if it is non-negative, it is set to all 0s; the mask vector is bitwise ANDed with Q, and then Q is added to the negative integers in C, while non-negative integers plus 0 have no effect on the result. Based on the similar principles of the above steps, modular subtraction C←AB mod Q only contains two steps, first subtracting Y from X, and then using the mask to process the negative part. Modular doubling is the same as modular addition, except that the addition of X and Y in the first stage is replaced by left shift.

[0193] Modular multiplication and modular squaring: Modular multiplication here uses the Montgomery multiplication method, which is divided into two stages: integer multiplication and Montgomery reduction. Montgomery multiplication uses the modified coarse integrated hybrid scanning (CIHS) method. Modular squaring is the same as modular multiplication in terms of reduction, but the calculation part is replaced by squaring instead of multiplication. The above calculation is based on The finite field operation is calculated. The 8×1 modular multiplication on can be accelerated using the Karatsuba algorithm. The number of multiplications is reduced from four to three, and for modular squaring, The number of multiplications is reduced from three to two.

[0194] The parallel point addition method based on elliptic curve of AVX512IFMA provided in the embodiment of the present application can be executed by a parallel point addition device based on elliptic curve of AVX512IFMA. In the embodiment of the present application, the parallel point addition device based on elliptic curve of AVX512IFMA is taken as an example to execute the parallel point addition method based on elliptic curve of AVX512IFMA, so as to illustrate the parallel point addition device based on elliptic curve of AVX512IFMA provided in the embodiment of the present application.

[0195] The embodiment of the present application also provides a parallel point addition device for elliptic curves based on AVX512IFMA.

[0196] like Figure 2 As shown, the parallel point addition device based on elliptic curve of AVX512IFMA includes: a first determination module 210, a second determination module 220, a third determination module 230, a fourth determination module 240, a data arrangement module 250 and a data processing module 260, wherein,

[0197] A first determination module 210 is used to determine each coordinate of the coordinates of multiple pairs of point data participating in parallel point addition, each pair of point data includes two types of point data: adding point data and added point data;

[0198] The second determination module 220 is used to determine a target number field corresponding to the plurality of pairs of point data, where the target number field is a finite field of an elliptic curve or a quadratic extension field of a finite field;

[0199] The third determination module 230 is used to determine a large number operation rule corresponding to the target number domain;

[0200] A fourth determination module 240 is used to determine a target point addition formula for the plurality of pairs of point data based on a relationship between a Z coordinate value Z1 of the added point data and a Z coordinate value Z2 of the added point data in each pair of point data in the plurality of pairs of point data;

[0201] A data arrangement module 250, for converting the coordinate values ​​of multiple pairs of point data into target data corresponding to the data structure of AVX512IFMA;

[0202] The data processing module 260 is used to process the target data based on the target point addition formula and large number operation rules to obtain point addition results of multiple pairs of point data.

[0203] According to the parallel point addition device of elliptic curve based on AVX512IFMA provided in the embodiment of the present application, by utilizing the characteristic of single instruction multiple data instruction set that can simultaneously process multiple data elements of the same type in the same instruction cycle, the underlying 8×1-way finite field operation and the upper-level 8×1-way point addition operation are implemented for the BLS121-381 curve. At the same time, since the underlying large number operation rules are determined based on the target number field, and the point addition formula varies with the change of the coordinate relationship of the point data participating in the point addition calculation, various types of point addition operation interfaces can be provided, and the AVX512IFMA instruction set is used to implement 8×1-way parallel acceleration of the elliptic curve point addition part, which can achieve substantial performance optimization and improvement.

[0204] In some embodiments, the relationship between the Z coordinate value Z1 of the added point data and the Z coordinate value Z2 of the added point data in each pair of point data in the plurality of pairs of point data includes three types, namely:

[0205] Z1=Z2=1, Z1≠Z2=1, and Z1≠Z2.

[0206] Each coordinate value in the coordinates of the plurality of pairs of point data is converted into a coordinate value vector corresponding to the target operation base of AVX512IFMA;

[0207] Multiple coordinate value vectors corresponding to each coordinate value of each point data form a vector set to obtain target data.

[0208] In some embodiments, each coordinate value in the coordinates of the plurality of pairs of point data is converted into a coordinate value vector corresponding to a target operation base of AVX512IFMA, including:

[0209] Determine the data types corresponding to multiple pairs of point data;

[0210] If the data type is a standard element corresponding to the finite field where the elliptic curve is located, each coordinate value in the coordinates of the multiple pairs of point data is converted into a coordinate value vector corresponding to the target operation base of AVX512IFMA based on a preset rule;

[0211] If the data type is a preset data type expressed on a Montgomery domain, each coordinate value in the coordinates of the plurality of pairs of point data is converted into a coordinate value vector corresponding to the target operation base of AVX512IFMA based on the Montgomery domain conversion rule corresponding to the target number domain.

[0212] In some embodiments, if the data type is a standard element corresponding to the finite field where the elliptic curve is located, each coordinate value in the coordinates of the plurality of pairs of point data is converted into a coordinate value vector corresponding to the target operation base of AVX512IFMA based on a preset rule, including:

[0213] For any coordinate value f in the coordinate values ​​of the multiple pairs of point data, the data type of any coordinate value f is a standard element corresponding to the finite field where the elliptic curve is located, and the coordinate value vector F corresponding to the target operation base of AVX512IFMA corresponding to any coordinate value f is determined by the following formula:

[0214] f=f0+2 52 f1+2 104 f2+2 156 f3+2 208 f4+2 260 f5+2 312 f6+2 364 f7

[0215] F=[f0, f1, f2, f3, f4, f5, f6, f7]

[0216] Where 0≤f i <2 52 And 0≤i<8, i is an integer, and the target operation base is 2 52 .

[0217] In some embodiments, a plurality of coordinate value vectors corresponding to each coordinate value of each type of point data form a vector set, including:

[0218] The vector set V is determined by the following formula:

[0219]

[0220] Among them, the multiple coordinate value vectors corresponding to any coordinate of any point data are F a , F b , F c , F d , F e , F f , F g and F h , any column of the vector set V corresponds to a coordinate value vector, and the i-th row of the vector set V corresponds to a register vector v i =[f i a , f i b , f i e , f i d , f i e , f i f , f i g , f i h], 0≤i<8, i is an integer.

[0221] The parallel point addition device based on the elliptic curve of AVX5 12IFMA in the embodiment of the present application can be an electronic device, or a component in an electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal, or it can be other devices other than a terminal. Exemplarily, the electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, a car electronic device, a mobile Internet device (Mobile Internet Device, MID), an augmented reality (augmentedreality, AR) / virtual reality (virtual reality, VR) device, a robot, a wearable device, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook or a personal digital assistant (personaldigital assistant, PDA), etc., and can also be a server, a network attached storage (Network AttachedStorage, NAS), a personal computer (personal computer, PC), a television (television, TV), a teller machine or a self-service machine, etc., which is not specifically limited in the embodiment of the present application.

[0222] The parallel point addition device based on elliptic curve of AVX5 12IFMA in the embodiment of the present application can be a device with an operating system. The operating system can be a Microsoft (Windows) operating system, an Android (Android) operating system, an 1OS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0223] The parallel point addition device based on elliptic curve AVX512IFMA provided in the embodiment of the present application can realize Figure 1 To avoid repetition, the various processes implemented by the method embodiment are not described here.

[0224] Based on the above embodiments, the present application also provides a method and device for quickly implementing point addition of elliptic curves based on the AVX512IFMA instruction set, which accelerates the implementation of point addition of elliptic curves on the CPU platform and provides an engine computing interface that can be used in application scenarios such as digital signatures, privacy protection, and zero-knowledge proofs. In this embodiment, the BLS12-381 curve is Group and The point addition of the group is divided into three cases according to the Z coordinate, and a total of six calculation engines are implemented.

[0225] In this embodiment, if Figure 3As shown in the figure, the scheme can be divided into three parts: 8×1 data arrangement, finite field operation and point operation, which are described in detail as follows:

[0226] Part 1: 8×1 data arrangement.

[0227] Since the AVX-512IFMA instruction set supports multiplication and addition of 52-bit unsigned integers in each 64-bit lane of two registers, it is natural to use 2 52 As the base. For example, in the BLS12-381 curve, base 2 is used 52 The 381-bit integer f represented by can be expressed as follows, where 0≤f i <2 52 And 0≤i<8.

[0228] f=f0+2 52 f1+2 104 f2+2 156 f3+2 208 f4+2 260 f5+2 312 f6+2 364 f7

[0229] In our 8×1 parallel computation, the main data structure is the vector set V, which consists of 8 vectors v i (0≤i<8). Each v i From eight base 2 52 The elements of can be stored in a 512-bit register for calculation. The vector set V is defined as follows, where each vector v i =[f i a , f i b , f i c , f i d , f i e , f i f , f i g , f i h ].

[0230]

[0231] Based on this data structure, AVX-512IFMA can be used to implement basic finite field operations in 8×1 mode.

[0232] Part 2: Finite field operations.

[0233] This part can be achieved Domain and its secondary extension The large number operations on the computer mainly include: modular addition, modular subtraction, modular doubling, modular multiplication, modular squaring and Montgomery field conversion.

[0234] For modular addition, modular subtraction, and modular doubling operations: Modular addition can be expressed as C←A+B mod Q, which contains three steps: First, add A and B and store their sum in C; then, subtract Q from C, but some channels in C may have negative values, so a 512-bit mask vector is created, in which each 64-bit element corresponds to the 8 integers in C. If the integer in the channel is negative, the corresponding 64-bit element is set to all 1s; if it is non-negative, it is set to all 0s; the mask vector is bitwise ANDed with Q, and then Q is added to the negative integers in C, while non-negative integers plus 0 have no effect on the result. Based on the similar principles of the above steps, modular subtraction C←AB mod Q only contains two steps, first subtracting Y from x, and then using the mask to process the negative part. Modular doubling is the same as modular addition, except that the addition of X and Y in the first stage is replaced by left shift.

[0235] Modular multiplication and modular squaring: Modular multiplication here uses the Montgomery multiplication method, which is divided into two stages: integer multiplication and Montgomery reduction. Montgomery multiplication uses the modified coarse integrated hybrid scanning (CIHS) method. Modular squaring is the same as modular multiplication in terms of reduction, but the calculation part is replaced by squaring instead of multiplication. The above calculation is based on The finite field operation is calculated. The 8×1 modular multiplication on can be accelerated using the Karatsuba algorithm. The number of multiplications is reduced from four to three, and for modular squaring, The number of multiplications is reduced from three to two.

[0236] Montgomery Field Transformation: In most cases, modern computer architectures are 64-bit and often use 2 for large number operations. 64 As the operation base, but in this application, the operation base of AVX512IFMA is 2 52 Therefore, when performing point addition operations, it is sometimes necessary to perform a Montgomery domain conversion. A domain conversion is essentially a Montgomery multiplication process. For example, a is a 381-bit binary number, R1 is the first Montgomery domain, and R2 is the second Montgomery domain. To convert aR1 to aR2, we only need to perform aR1 and R2 on the R2 domain. In finite fields Montgomery multiplication on aR2; to convert aR2 to aR1, we only need to perform a Montgomery multiplication on the R2 domain and aR2 and R1 on the finite field Montgomery multiplication on .

[0237] Part 3: Point operations.

[0238] For the elliptic curve point in the Jacobi coordinate system, it can be expressed as (X, Y, Z). For point P1 and point P2, the point addition formula can be divided into PADD according to Z1=Z2=1, Z1≠Z2=1 and Z1≠Z2. * , PADD and PADD + For the 8×1-way point operation, the underlying 8×1-way finite field operation can be directly called to calculate the results according to the point addition formula.

[0239] In some embodiments, Figure 4 As shown, an embodiment of the present application also provides an electronic device 400, including a processor 401, a memory 402, and a computer program stored in the memory 402 and executable on the processor 401. When the program is executed by the processor 401, each process of the above-mentioned parallel point addition method embodiment of the elliptic curve based on AVX512IFMA is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0240] It should be noted that the electronic devices in the embodiments of the present application include the above-mentioned mobile electronic devices and non-mobile electronic devices.

[0241] An embodiment of the present application also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the above-mentioned parallel point addition method embodiment of the elliptic curve based on AVX512IFMA are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0242] The processor is the processor in the electronic device in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0243] An embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the above-mentioned parallel point addition method of elliptic curve based on AVX512IFMA.

[0244] The processor is the processor in the electronic device in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0245] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface and the processor are coupled, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned parallel point addition method embodiment of the elliptic curve based on AVX512IFMA, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0246] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0247] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0248] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the relevant technology, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods of each embodiment of the present application.

[0249] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

[0250] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0251] Although the embodiments of the present application have been shown and described, those skilled in the art will appreciate that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present application, and that the scope of the present application is defined by the claims and their equivalents.

Claims

1. A parallel point addition method for elliptic curves based on AVX512IFMA, characterized in that: include: Determine each coordinate of the plurality of pairs of point data participating in parallel point addition, each pair of point data includes two types of point data: adding point data and added point data; Determine a target number field corresponding to the plurality of pairs of point data, the target number field being a finite field of the elliptic curve or a quadratic extension field of the finite field; Determine a large number operation rule corresponding to the target number domain; Determine a target point adding formula for the plurality of pairs of point data based on a relationship between a Z coordinate value Z1 of the added point data and a Z coordinate value Z2 of the added point data in each pair of point data in the plurality of pairs of point data; Convert the coordinate values ​​of the plurality of pairs of point data into target data corresponding to the data structure of the AVX512IFMA; The target data is processed based on the target point addition formula and the large number operation rule to obtain the point addition results of the multiple pairs of point data.

2. The parallel point addition method of elliptic curve based on AVX512IFMA according to claim 1, characterized in that: There are three types of relationships between the Z coordinate value Z1 of the added point data and the Z coordinate value Z2 of the added point data in each pair of point data in the plurality of pairs of point data, which are: Z1=Z2=1, Z1≠Z2=1, and Z1≠Z2.

3. The parallel point addition method of elliptic curve based on AVX512IFMA according to claim 2, characterized in that: The step of converting the coordinate values ​​of the plurality of pairs of point data into target data corresponding to the data structure of the AVX512IFMA comprises: Convert each coordinate value in the coordinates of the plurality of pairs of point data into a coordinate value vector corresponding to the target operation base of the AVX512IFMA; Multiple coordinate value vectors corresponding to each coordinate value of each point data form a vector set to obtain target data.

4. The parallel point addition method of elliptic curve based on AVX512IFMA according to claim 3, characterized in that: The step of converting each coordinate value of the coordinates of the plurality of pairs of point data into a coordinate value vector corresponding to the target operation base of the AVX512IFMA comprises: Determine the data types corresponding to the multiple pairs of point data; If the data type is a standard element corresponding to the finite field where the elliptic curve is located, each coordinate value in the coordinates of the multiple pairs of point data is converted into a coordinate value vector corresponding to the target operation base of the AVX512IFMA based on a preset rule; If the data type is a preset data type expressed on a Montgomery domain, each coordinate value in the coordinates of the multiple pairs of point data is converted into a coordinate value vector corresponding to the target operation base of the AVX512IFMA based on the Montgomery domain conversion rule corresponding to the target number domain.

5. The parallel point addition method of elliptic curve based on AVX512IFMA according to claim 4, characterized in that: If the data type is a standard element corresponding to the finite field where the elliptic curve is located, each coordinate value in the coordinates of the multiple pairs of point data is converted into a coordinate value vector corresponding to the target operation base of the AVX512IFMA based on a preset rule, including: For any coordinate value f among the coordinate values ​​of the multiple pairs of point data, the data type of the any coordinate value f is a standard element corresponding to the finite field where the elliptic curve is located, and the coordinate value vector F corresponding to the target operation base of the AVX512IFMA corresponding to the any coordinate value f is determined by the following formula: <h2 style=";text-align:left;direction:ltr">f = f0+2<h2 style=";text-align:left;direction:ltr"> 52 <h2 style=";text-align:left;direction:ltr"> f1+2<h2 style=";text-align:left;direction:ltr"> 104 <h2 style=";text-align:left;direction:ltr"> f2+2<h2 style=";text-align:left;direction:ltr"> 156 <h2 style=";text-align:left;direction:ltr"> f3+2<h2 style=";text-align:left;direction:ltr"> 208 <h2 style=";text-align:left;direction:ltr"> f4+2<h2 style=";text-align:left;direction:ltr"> 260 <h2 style=";text-align:left;direction:ltr"> f5+2<h2 style=";text-align:left;direction:ltr"> 312 <h2 style=";text-align:left;direction:ltr"> f6+2<h2 style=";text-align:left;direction:ltr"> 364 <h2 style=";text-align:left;direction:ltr"> f7 F=[f0, f1, f2, f3, f4, f5, f6, f7] Where 0≤f i <2 52 And 0≤i<8, i is an integer, and the target operation base is 2 52 .

6. The parallel point addition method of elliptic curve based on AVX512IFMA according to claim 5, characterized in that: The multiple coordinate value vectors corresponding to each coordinate value of each point data form a vector set, including: The vector set V is determined by the following formula: Among them, the multiple coordinate value vectors corresponding to any coordinate of any point data are F a , F b , F c , F d , F e , F f , F g and F h , any column of the vector set V corresponds to a coordinate value vector, and the i-th row of the vector set V corresponds to a register vector v i =[f i a , f i b , f i c , f i d , f i e , f i f , f i g , f i h ], 0≤i<8, i is an integer.

7. A parallel point addition device for elliptic curves based on AVX512IFMA, characterized in that: include: A first determination module is used to determine each coordinate of the coordinates of the plurality of pairs of point data participating in the parallel point addition, each pair of point data includes two types of point data: adding point data and added point data; A second determination module is used to determine a target number field corresponding to the plurality of pairs of point data, wherein the target number field is a finite field of the elliptic curve or a quadratic extension field of the finite field; A third determination module is used to determine a large number operation rule corresponding to the target number domain; A fourth determination module, for determining a target point addition formula for the plurality of pairs of point data based on a relationship between a Z coordinate value Z1 of the added point data and a Z coordinate value Z2 of the added point data in each pair of point data in the plurality of pairs of point data; A data arrangement module, used for converting the coordinate values ​​of the plurality of pairs of point data into target data corresponding to the data structure of the AVX512IFMA; The data processing module is used to process the target data based on the target point addition formula and the large number operation rule to obtain the point addition results of the multiple pairs of point data.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the parallel point addition method of the elliptic curve based on AVX512IFMA as described in any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the parallel point addition method for elliptic curves based on AVX512IFMA as described in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the parallel point addition method of the elliptic curve based on AVX512IFMA as described in any one of claims 1 to 6 is implemented.

Images