Elliptic curve point operation acceleration method and device, electronic equipment and storage medium

Abstract

Aiming at the problems of long operation flow and low operation efficiency of the existing elliptic curve point operation, the invention provides an elliptic curve point operation acceleration method and device, electronic equipment and a storage medium, the value of R is 2n, n is greater than or equal to m + 7, and meanwhile, the value of R is greater than or equal to m + 7. Elliptic curve point operation is carried out through a unified point addition formula or a unified mixed addition formula of a distorted Edwardsist curve expansion coordinate, so that modulus operation and corresponding judgment and selection operation in original modular addition, modular subtraction and modular multiplication are omitted, modulus operation only needs to be carried out once at the end of point operation, the operation process is shortened, and the calculation efficiency is improved. And the operation efficiency is improved.

Description

Technical Field

[0001] The present invention belongs to the field of encryption technology, and in particular relates to an acceleration method, device, electronic device and storage medium for elliptic curve point operations. Background Art

[0002] With the rapid development of computer technology, Internet technology, and social economy, the demand for the protection of personal privacy and corporate data is increasing, and this protection is mainly achieved by encryption algorithms. Common encryption algorithms include symmetric encryption algorithms, asymmetric encryption algorithms, and information digest algorithms. Among asymmetric encryption algorithms, the algorithm with the highest security strength for a given key length is elliptic curve cryptography (ECC). Therefore, elliptic curve cryptography is widely used in scenarios such as digital signatures and zero-knowledge proofs.

[0003] In elliptic curve cryptography, the most commonly used operations are single scalar multiplication and multi-scalar multiplication. Both single scalar multiplication and multi-scalar multiplication are essentially a large number of point addition operations and point doubling operations on elliptic curves. These two operations are collectively referred to as elliptic curve point operations. In order to speed up point operations, curve transformation and coordinate transformation are often performed on the curves used. When the conversion conditions are met, converting the standard form of Weierstrass curve affine coordinates to the twisted Edward curve extended coordinates can achieve the fastest point operation speed.

[0004] Each point operation is composed of underlying finite field operations. The main finite field operations are modular addition, modular subtraction, and modular multiplication, which correspond to modulo after addition, modulo after subtraction, and modulo after multiplication. Modular multiplication is generally accelerated by Montgomery modular multiplication, and a modulo operation is also performed after Montgomery modular multiplication. It can be seen that a large number of modulo operations will be performed during the point operation process. Although the modulo operation is relatively simple, the number is large, and judgment is required each time, resulting in a long operation process and low operation efficiency. Summary of the invention

[0005] Based on this, in order to solve the above technical problems, a method, device, electronic device and storage medium for accelerating elliptic curve point operations are provided.

[0006] The technical solution adopted by the present invention is as follows:

[0007] As a first aspect of the present invention, a method for accelerating elliptic curve point operations is provided, characterized in that it includes:

[0008] Before point operation, each original point of the elliptic curve is preprocessed: first, the Weierstrass curve affine coordinates of the original point are entered into the Montgomery domain, and transformed into the twisted Edwards curve to obtain the twisted Edwards curve extended coordinates of the original point, wherein the Weierstrass curve formula of the elliptic curve is: y2=x3+ax+b(mod p), x and y are the Weierstrass curve affine coordinates of the original point, a and b are curve constants, and the modulus p is an m-bit binary number;

[0009] In point operation, the coordinates of the input point are obtained. If the input point is an original point, the coordinates of the input point are preprocessed coordinates. The unified point addition formula or the unified mixed addition formula is used to perform point operation on the input point of the point operation to obtain the coordinates of the output point. The addition, subtraction and multiplication operations in the formula are respectively obtained by the following formulas to obtain the operation result C:

[0010] Addition operation: C = A + B

[0011] Subtraction operation: C = 4p + AB

[0012] Multiplication operation: C = C1 + C3 (mod R)

[0013] Wherein, C1=A*B, C2=I*C1(mod R), C3=C2*p, I=-1 / p(mod R), R=2n, n is greater than or equal to m+7, and A and B are the objects to be operated in the corresponding addition, subtraction or multiplication operation;

[0014] The inverse operation of the preprocessing is performed on the coordinates of the output point, and the coordinates after the inverse operation are modulo-operated, and the modulus of the modulo-operation is p.

[0015] As a second aspect of the present invention, there is provided an acceleration device for elliptic curve point operations, characterized in that it comprises:

[0016] A preprocessing module is used to preprocess each original point of the elliptic curve before point operation: first, the Weierstrass curve affine coordinates of the original point are made to enter the Montgomery domain, and are transformed into the twisted Edwards curve to obtain the twisted Edwards curve extended coordinates of the original point, wherein the Weierstrass curve formula of the elliptic curve is: y2=x3+ax+b(mod p), x and y are the Weierstrass curve affine coordinates of the original point, a and b are curve constants, and the modulus p is an m-bit binary number;

[0017] The point operation module is used to obtain the coordinates of the input point during the point operation. If the input point is an original point, the coordinates of the input point are the preprocessed coordinates. The unified point addition formula or the unified mixed addition formula is used to perform point operation on the input point of the point operation to obtain the coordinates of the output point. The addition, subtraction and multiplication operations in the formula are respectively obtained by the following formulas to obtain the operation result C:

[0018] Addition operation: C = A + B

[0019] Subtraction operation: C = 4p + AB

[0020] Multiplication operation: C = C1 + C3 (mod R)

[0021] Wherein, C1=A*B, C2=I*C1(mod R), C3=C2*p, I=-1 / p(mod R), R=2n, n is greater than or equal to m+7, and A and B are the objects to be operated in the corresponding addition, subtraction or multiplication operation;

[0022] The result modulo module is used to perform the inverse operation of the preprocessing on the coordinates of the output point, and perform modulo on the coordinates after the inverse operation, and the modulus of the modulo is p.

[0023] As a third aspect of the present invention, there is provided an electronic device, characterized in that it comprises a storage module, wherein the storage module comprises instructions loaded and executed by a processor, wherein when the instructions are executed, the processor executes an acceleration method for elliptic curve point operations according to the first aspect.

[0024] As a fourth aspect of the present invention, a computer-readable storage medium is provided, which stores one or more programs, and is characterized in that when the one or more programs are executed by a processor, an acceleration method for elliptic curve point operations of the above-mentioned first aspect is implemented.

[0025] The present invention takes R as 2 n , n is greater than or equal to m+7. At the same time, the elliptic curve point operation is performed by twisting the unified point addition formula or the unified mixed addition formula of the Edwards curve extended coordinates, thereby omitting the modulo operation and the corresponding judgment and selection operations in the original modular addition, modular subtraction and modular multiplication, and only one modulo operation is required at the end of the point operation, which shortens the operation process and improves the operation efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments:

[0027] Figure 1 A flowchart of an acceleration method for elliptic curve point operations provided by an embodiment of the present invention;

[0028] Figure 2 A schematic diagram of an elliptic curve point operation acceleration device provided by an embodiment of the present invention;

[0029] Figure 3 A schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0030] The following will illustrate the implementation methods of the present invention in conjunction with the drawings in the specification. It should be noted that the implementation methods involved in this specification are not exhaustive and do not represent the only implementation methods of the present invention. The following corresponding embodiments are only for the purpose of clearly illustrating the invention content of the patent of the present invention, and are not intended to limit its implementation methods. For ordinary technicians in this field, different forms of changes and modifications can be made on the basis of the description of this embodiment. All obvious changes or modifications that belong to the technical concept and invention content of the present invention are also within the scope of protection of the present invention.

[0031] First, the principle of the embodiment of the present application is described by taking the BLS12-377 elliptic curve as an example. The Weierstrass curve formula of the BLS12-377 elliptic curve is: 2 =x 3 +ax+b(mod p), a and b are curve constants, 0 and 1 respectively, and p is the modulus.

[0032] The default modulo operation is to take the modulo of the entire formula, the same below.

[0033] p=0x01 ae3a4617c510eac63b05c06ca1493b1 a22d9f300f5138f1 ef3622fb a094800170b5d44300000008508c00000000001, which is a 377-bit binary number.

[0034] When performing Montgomery modular multiplication, the actual result of the modular multiplication operation is C = A*B / R (mod p), where the Montgomery constant R is a power of 2 slightly larger than the modulus p expressed in a finite field. R is 2 384 , A and B are the objects of the modular multiplication operation. The process of calculating C is generally divided into the following five steps:

[0035] 1. Calculate C1 = A*B;

[0036] 2. Calculate C2 = I*C1 (mod R), where I = -1 / p (mod R), which is a constant.

[0037] 3. Calculate C3 = C2*p;

[0038] 4. Calculate C4 = C1 + C3 (mod R);

[0039] 5. Calculate C = C4 (mod p).

[0040] In the above calculations, taking the modulus (mod R) with respect to R can be achieved by shifting 384 bits to the right. Therefore, in modular multiplication, there are only addition, multiplication, and shift operations, and the speed is significantly improved compared to standard modular multiplication. Summarizing the first 4 steps of the above process, the following formula can be obtained:

[0041] C4 = (C1 + m * p) / R, where C1 = A * B and m = I * C1 (mod R).

[0042] At this time, C4 is already congruent to A * B / R (mod p), and for the modulus taking in the 5th step, at most one subtraction is required. Since C1 < p 2 , m < R, p < R, so C4 < (p 2 + R * p) / R < (R * p + R * p) / R = 2p.

[0043] Note that the precondition for the above formula to hold is that both A and B are numbers within the finite field, that is, A < p and B < p. From this, we can conclude that for modular addition, modular subtraction, and modular multiplication in the finite field, the result needs to be taken modulo, and when the input is a number within the finite field, the modulo here only requires at most one addition or subtraction to the result. Therefore, the formulas for modular addition, modular subtraction, and modular multiplication in the prior art are as follows:

[0044] Modular addition:

[0045] Modular subtraction:

[0046] Modular multiplication:

[0047] Since in elliptic curve cryptography, these three operations are called sequentially, omitting this modulo step means that the input and output ranges of each operation will exceed the finite field. However, since modular multiplication can limit the output back to [0, 2p) within a certain input range, in order to omit the modulo, the following two considerations are required:

[0048] 1. For Montgomery modular multiplication, when the input reaches the maximum value, can the output still be limited back to [0, 2p)?

[0049] We take R = 2 384 , and p is only 377 bits, so 2 6 p = 64p < R. Therefore, the input limit can be relaxed to [0, 8p), and at this time C1 = A * B < 64p, that is, the product C1 of the input A and B is within [0, 26 p), C4<(C1+R*p) / R<(64p*p+R*p) / R<(R*p+R*p) / R=2p.

[0050] It can be seen that R takes 2 n , when n is greater than or equal to 377+7, the requirement is met.

[0051] 2. In point operations, can the calculation process be arranged so that the input range of each modular multiplication is within [0,8p)?

[0052] We transform the BLS12-377 curve to the twisted Edwards curve and use the extended coordinates (X, Y, Z, T). When performing point operations, use the unified point addition formula or the unified mixed addition formula. The unified point addition formula is as follows:

[0053] C5 = (Y1-X1)*(Y2-X2);

[0054] C6 = (Y1 + X1) * (Y2 + X2);

[0055] C7=k*T1*T2, k is a constant obtained when the curve is transformed;

[0056] C8 = 2Z1*Z2;

[0057] C9 = C6-C5;

[0058] C10 = C8 - C8;

[0059] C11=C8+C8;

[0060] C12=C6+C5;

[0061] X3=C9*C10;

[0062] Y3=C11*C12;

[0063] T3 = C9 * C12;

[0064] Z3=C10*C11;

[0065] Among them, (X1, Y1, Z1, T1) and (X2, Y2, Z2, T2) are the expanded coordinates of the two input points respectively, and (X3, Y3, Z3, T3) is the expanded coordinates of the output point.

[0066] The addition, subtraction, and multiplication operations in the above unified point addition formula correspond to modular addition, modular subtraction, and modular multiplication, respectively.

[0067] It should be pointed out that the input point of a point operation is either the starting point (with coordinates in [0, p)) or the output point of the previous point operation. In the unified point addition formula, the last step in calculating the extended coordinates of the output point is modular multiplication, which can limit the calculation result back to [0, 2p). Therefore, it can be guaranteed that the input point coordinates of each point operation are in [0, 2p).

[0068] At the same time, it can be seen from the above unified point addition formula that the result calculated from a modular multiplication has at most two additions or subtractions or multiplications by 2 before entering the next modular multiplication. Therefore, modular multiplication of two [0,2p) inputs is equivalent to modular multiplication inputs in [0,8p), which meets the requirement of omitting the modulo.

[0069] So far, we have proved that for any elliptic curve (the modulus p of the curve is an m-bit binary number), if R is 2 n , n is greater than or equal to m+7, when the elliptic curve point operation is performed by the unified point addition formula of the twisted Edwards curve extended coordinates, the modulo operation in the modular addition, modular subtraction and modular multiplication in the underlying finite field operation can be omitted, and the omitted form is as follows:

[0070] Modular addition: C = A + B

[0071] Modulus reduction: C = 4p + AB

[0072] Modular multiplication: C = C1 + C3 (mod R)

[0073] Among them, C1=A*B, C2=I*C1(mod R), C3=C2*p, I=-1 / p(mod R), A and B are the operated objects in the addition, subtraction or multiplication operation in the unified point addition formula or the unified mixed addition formula.

[0074] The unified mixed addition formula is a variation of the point addition formula (not detailed here), so the above conclusions also apply.

[0075] It can be seen that compared with the existing modular addition, modular subtraction and modular multiplication formulas, the omitted form does not require judgment, which further reduces the amount of calculation.

[0076] Therefore, if Figure 1 As shown, the embodiment of the present application provides an acceleration method for elliptic curve point operations, and the specific process is as follows:

[0077] S101. Before point operation, preprocess the original points of the elliptic curve: first, make the Weierstrass curve affine coordinates of the original points enter the Montgomery domain, and transform them into the twisted Edwards curve to obtain the twisted Edwards curve extended coordinates of the original points.

[0078] Among them, entering the Montgomery domain is a prerequisite for performing Montgomery modular multiplication.

[0079] The Weierstrass curve formula for the elliptic curve is: 2 =x 3 +ax+b(mod p), where x and y are the Weierstrass curve affine coordinates of the original point, a and b are curve constants, and the modulus p is an m-bit binary number.

[0080] It should be pointed out that in elliptic curve operations, sometimes the input point coordinates are variable. In this case, each large operation needs to be preprocessed before subsequent operations can be performed. Sometimes the input point coordinates are fixed (this is the majority of cases, and the only input that changes is the coefficient of the point). In this case, the entire preprocessing step can be completed when the hardware device is manufactured or started, and it is no longer required for each subsequent operation.

[0081] S102. During point operation, the coordinates of the input point are obtained. If the input point is an original point, the coordinates of the input point are preprocessed coordinates. A unified point addition formula or a unified mixed addition formula is used to perform point operation on the input point of the point operation to obtain the coordinates of the output point.

[0082] The addition, subtraction, and multiplication operations in the formula are respectively obtained by the following formulas to obtain the operation result C:

[0083] The addition operation in the formula is calculated by C=A+B;

[0084] The subtraction operation in the formula is calculated by C = 4p + AB;

[0085] The multiplication operation in the formula is calculated by C=C1+C3(mod R);

[0086] Where C1 = A*B, C2 = I*C1 (mod R), C3 = C2*p, I = -1 / p (mod R), R = 2 n , n is greater than or equal to m+7, A and B are the objects of the corresponding addition, subtraction or multiplication operations. It can be seen that the multiplication operation here is equivalent to the first four steps of the Montgomery modular multiplication in the previous text.

[0087] Taking the BLS12-377 elliptic curve as an example, n needs to be greater than or equal to 384. In order to reduce hardware resource consumption, n can be m+7=377+7=384.

[0088] Assuming that the formula requires an addition operation on 2 and 2, then A and B are both 2, and the result of the addition operation C=2+2=4 can be obtained.

[0089] When the Z coordinates of both input points are not 1, the unified point addition formula is used; when the Z coordinate of at least one of the two input points is 1, the unified mixed addition formula is used. It should be noted that the input point of the point operation may be the original point or the output point of the previous point operation. The Z coordinate of the original point after preprocessing is 1. When the output point of the previous point operation is used as the input point of this point operation, the Z coordinate of the point is not 1.

[0090] S103, performing the inverse operation of the above preprocessing on the coordinates of the output point, and taking the modulus of the coordinates after the inverse operation, where the modulus is p.

[0091] The inverse operation of the preprocessing is to first convert the coordinates of the output points (twisted Edwards curve extended coordinates) into Weierstrass curve affine coordinates, and then exit the coordinates from the Montgomery domain.

[0092] The following is an example of a single scalar multiplication with a small coefficient to illustrate the process of the method of the embodiment of the present application:

[0093] The original point is a point P on the BLS12-377 curve, and its coordinates are (x1:0x01252b781171f507db36291 b433a1 f911 a46543890a20ca9712e11 f66a5d216e63d817bd8d96cef715abc604dcf6ec2e,

[0094] y1:0x014a00fa77c727e8987cc438b51 bbe012c823a19955ae692c54ce572a61f0ea1 fe5cd981533df419fd1330d1 f6e6d802), the calculated coefficient S is 2, and the single scalar multiplication is actually to find Q=SP=2P=P+P.

[0095] Step 1: Preprocessing

[0096] 1.1 Enter the original point coordinates into the Montgomery domain

[0097] The coordinates after entering Montgomery Domain are:

[0098] x1_m:0x013c40b2d039f3c588fd1 ad57c985a4a9271 e53326543fd4d3f4a943e02caecbd28f01 bd4dda15a77bb6c6f7b35a7f03

[0099] y1_m:0x00d6e765699b5d91 caca05606c9ad9a68af079bbbc81 a62c55be07bb14eb97bdbe7dabb2d611 b49b5c5410ea67536f03

[0100] 1.2 Transform the coordinates after entering the Montgomery domain to the extended coordinates of the distorted Edwards curve

[0101] The transformed coordinates are:

[0102] x1_e:0x01404e87ae4fccf460918b3cc4f9d676a52fd58e54ee33d234f5a0ef01f580983c5ef3d40dbc4a68b04b1 ff87dfdf7f3

[0103] y1_e:0x0114388d5c525fe57036704c5d900eb11 ed48c9334181a78847572da48c71847f8d8c60aa340b48b151 c03a941484dbf

[0104] z1_e:0x008d6661 e2fdf49a4cf495bf803c84e87b4e97b76e7c63059f7db3a98a7d3ff251409f837ffffffb102cdffffffffff68

[0105] t1_e:0x00c8efaca2dfbef630a7c31 dafc5726d14628ccc7e4cca695cb5ba a8e7d3b905039406ad4fc0277ece0c75f021033ad0

[0106] The above two steps are preprocessing. If the initial point is fixed in multiple operations, the result can be stored in advance.

[0107] Step 2: Perform point addition

[0108] Since the coefficient is 2, the mixing point addition formula only needs to be called once.

[0109] Among them, the addition operation in the formula is calculated by C=A+B, the subtraction operation is calculated by C=4p+AB, and the multiplication operation is calculated by C=C1+C3(mod R). For example, when calculating x1_e+y1_e, it is calculated by C=A+B, where A=x1_e and B=y1_e.

[0110] If we use the original formula Judgment and choice are still required.

[0111] Finally, the coordinates of the output points are:

[0112] X3:0x00e55ca830b660bfcced0f10192459a2ebcb256331196dc9ed6582bc d5d14f4763f2c288be70d7a1853e8831 cfe93e49

[0113] Y3:0x01 b255eb316eaa1545d0b4bfc47e9594ba8f0a3dbca7bdd789a6501 ea9f080e9125ef4d9bcc2a3ea69f93a05f0180200

[0114] Z3:0x0116cd83705fd55755852d0c12cf916e58ce2d62fbfa5efbc4ef0de19e3ac6a58e87dd303401fba5fc292f5d3d5bccf5

[0115] T3:0x015d868fe0fb1516127272a94b19bc0c0536099bf8ac26b4d839562503ed43a7c1 ac8887e3e8aea7d16ee1 ffdd206af2

[0116] Step 3: Convert the distorted Edward curve extended coordinates of the output points into the affine coordinates of the Weierstrass curve, and then exit the coordinates from the Montgomery domain.

[0117] The coordinates of the transformed curve are:

[0118] x3_w:0x01 b4945df66c8c27e78f3ac267384cc2e4e2fc36c733fe7fd9aa3e5bc320472bda476fa238dfd6ea27ed7b1 b49ee4fec

[0119] y3_w:0x014aeb03d4890068a5b99886fb0b5a39c8658d12992d6f66cf446d36b61 cc8d5175079b3e994edf6517c43abb5a8cad7

[0120] The coordinates after exiting the Montgomery domain are:

[0121] x30:0x010c65c0fb9e6c6ef4cbb27fdc55a07e474df11 c564bd91 e3fa162c32b7fc3dabba5fc508cfdd8938fb4a30f7de5ad9c

[0122] y30:0x0149a58ced619866b242313876fe2df3188f33b77566a9ddc966ff4d4d5c42d515be862c348f51 cc91 f1 c45a74110ba6

[0123] Step 4: Take the modulus of the coordinates after exiting the Montgomery domain.

[0124] The coordinates after modulo are:

[0125] x3:0x010c65c0fb9e6c6ef4cbb27fdc55a07e474df11 c564bd91 e3fa162c32b7fc3dabba5fc508cfdd8938fb4a30f7de5ad9c

[0126] y3:0x0149a58ced619866b242313876fe2df3188f33b77566a9ddc966ff4d4d5c42d515be862c348f51 cc91 f1 c45a74110ba6

[0127] As can be seen from the above, the acceleration method of elliptic curve point operation provided by the embodiment of the present application sets the value of R to 2 n , n is greater than or equal to m+7. At the same time, the elliptic curve point operation is performed by twisting the unified point addition formula or the unified mixed addition formula of the Edwards curve extended coordinates, thereby omitting the modulo operation and the corresponding judgment and selection operations in the original modular addition, modular subtraction and modular multiplication, and only one modulo operation is required at the end of the point operation, which shortens the operation process and improves the operation efficiency.

[0128] The following will describe in detail the acceleration device for elliptic curve point operations of one or more embodiments of the present invention. Those skilled in the art will appreciate that these acceleration devices can be configured using commercially available hardware components through the steps taught in this solution. Figure 2 An elliptic curve point operation acceleration device provided by an embodiment of the present invention is shown. Figure 2As shown, the acceleration device includes a preprocessing module 11, a point operation module 12 and a result modulo module 13.

[0129] The preprocessing module 11 is used to preprocess the original points of the elliptic curve before point operation: first, the Weierstrass curve affine coordinates of the original points are entered into the Montgomery domain, and then transformed into the twisted Edwards curve to obtain the twisted Edwards curve extended coordinates of the original points.

[0130] Among them, entering the Montgomery domain is a prerequisite for performing Montgomery modular multiplication.

[0131] The Weierstrass curve formula of the elliptic curve is: y2=x3+ax+b(mod p), x and y are the Weierstrass curve affine coordinates of the original point, a and b are curve constants, and the modulus p is an m-bit binary number.

[0132] It should be pointed out that in elliptic curve operations, sometimes the input point coordinates are variable. In this case, each large operation needs to be preprocessed before subsequent operations can be performed. Sometimes the input point coordinates are fixed (this is the majority of cases, and the only input that changes is the coefficient of the point). In this case, the entire preprocessing step can be completed when the hardware device is manufactured or started, and it is no longer required for each subsequent operation.

[0133] The point operation module 12 is used to obtain the coordinates of the input point during point operation. If the input point is an original point, the coordinates of the input point are preprocessed coordinates. A unified point addition formula or a unified mixed addition formula is used to perform point operation on the input point of the point operation to obtain the coordinates of the output point.

[0134] The addition, subtraction, and multiplication operations in the formula are respectively obtained by the following formulas to obtain the operation result C:

[0135] The addition operation in the formula is calculated by C = A + B;

[0136] The subtraction operation in the formula is calculated by C=4p+AB;

[0137] The multiplication operation in the formula is calculated by C=C1+C3(mod R);

[0138] Where C1 = A*B, C2 = I*C1 (mod R), C3 = C2*p, I = -1 / p (mod R), R = 2 n , n is greater than or equal to m+7, A and B are the objects of the corresponding addition, subtraction or multiplication operations. It can be seen that the multiplication operation here is equivalent to the first four steps of the Montgomery modular multiplication in the previous text.

[0139] Taking the BLS12-377 elliptic curve as an example, n needs to be greater than or equal to 384, and in order to reduce hardware resource consumption, n can be 384.

[0140] Assuming that the formula requires an addition operation on 2 and 2, then A and B are both 2, and the result of the addition operation C=2+2=4 can be obtained.

[0141] When the Z coordinates of both input points are not 1, the unified point addition formula is used; when the Z coordinate of at least one of the two input points is 1, the unified mixed addition formula is used. It should be noted that the input point of the point operation may be the original point or the output point of the previous point operation. The Z coordinate of the original point after preprocessing is 1. When the output point of the previous point operation is used as the input point of this point operation, the Z coordinate of the point is not 1.

[0142] The result modulo module 13 is used to perform the inverse operation of the above preprocessing on the coordinates of the output point, and perform modulo on the coordinates after the inverse operation, and the modulus of the modulo is p.

[0143] The inverse operation of the preprocessing is to first convert the coordinates of the output points (twisted Edwards curve extended coordinates) into Weierstrass curve affine coordinates, and then exit the coordinates from the Montgomery domain.

[0144] In summary, the acceleration device for elliptic curve point operations provided in the above embodiments can execute the acceleration method for elliptic curve point operations provided in the above embodiments.

[0145] The same as above concept, Figure 2 The structure of the acceleration device for elliptic curve point operation shown can be realized as an electronic device. Figure 3 A schematic block diagram of the structure of an electronic device provided by an embodiment of the present invention is shown.

[0146] Exemplarily, the electronic device includes a storage module 21 and a processor 22, the storage module 21 includes instructions loaded and executed by the processor 22, and when the instructions are executed, the processor 22 executes the steps of various exemplary embodiments of the present invention described in the above-mentioned acceleration method section of an elliptic curve point operation in this specification.

[0147] It should be understood that the processor 22 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors, or a plurality of other processors.

[0148] (Digital Signal Processor, DSP), Application Specific Integrated Circuit

[0149] (Application Specific Integrated Circuit, ASIC), Field-Programmable Gate Array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0150] A computer-readable storage medium is also provided in an embodiment of the present invention, which stores one or more programs. When the one or more programs are executed by a processor, the steps of various exemplary embodiments of the present invention described in the above-mentioned acceleration method for elliptic curve point operations are implemented.

[0151] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In a hardware implementation, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable storage medium, which may include a computer-readable storage medium (or a non-transitory medium) and a communication medium (or a temporary medium).

[0152] As is known to those of ordinary skill in the art, the term computer-readable storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer-readable storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. In addition, it is known to those of ordinary skill in the art that communication media typically contain computer-readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and may include any information delivery medium.

[0153] Exemplarily, the computer-readable storage medium may be an internal storage unit of the electronic device of the aforementioned embodiment, such as a hard disk or memory of the electronic device. The computer-readable storage medium may also be an external storage device of the electronic device, such as a plug-in hard disk, a smart memory card (SmartMed i aCard, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), etc. equipped on the electronic device.

[0154] The electronic device and computer-readable storage medium provided in the above embodiments set R to 2. n , n is greater than or equal to m+7. At the same time, the elliptic curve point operation is performed by twisting the unified point addition formula or the unified mixed addition formula of the Edwards curve extended coordinates, thereby omitting the modulo operation and the corresponding judgment and selection operations in the original modular addition, modular subtraction and modular multiplication, and only one modulo operation is required at the end of the point operation, which shortens the operation process and improves the operation efficiency.

[0155] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for accelerating elliptic curve point operations, characterized in that: include: Before point operation, each original point of the elliptic curve is preprocessed: first, the Weierstrass curve affine coordinates of the original point are entered into the Montgomery domain and transformed into the twisted Edwards curve to obtain the twisted Edwards curve extended coordinates of the original point, wherein the Weierstrass curve formula of the elliptic curve is: 2 =x 3 +ax+b(mod p), x and y are the Weierstrass curve affine coordinates of the original point, a and b are curve constants, and the modulus p is an m-bit binary number; In point operation, the coordinates of the input point are obtained. If the input point is an original point, the coordinates of the input point are preprocessed coordinates. The unified point addition formula or the unified mixed addition formula is used to perform point operation on the input point of the point operation to obtain the coordinates of the output point. The addition, subtraction and multiplication operations in the formula are respectively obtained by the following formulas to obtain the operation result C: Addition operation: C = A + B Subtraction operation: C = 4p + AB Multiplication operation: C = C1 + C3 (mod R) Where C1 = A*B, C2 = I*C1 (mod R), C3 = C2*p, I = -1 / p (mod R), R = 2 n , n is greater than or equal to m+7, A and B are the objects to be operated in the corresponding addition, subtraction or multiplication operation; The inverse operation of the preprocessing is performed on the coordinates of the output point, and the coordinates after the inverse operation are modulo-operated, and the modulus of the modulo-operation is p.

2. The acceleration method for elliptic curve point operations according to claim 1, characterized in that: The n is m+7.

3. The acceleration method for elliptic curve point operations according to claim 1, characterized in that: The step of performing point operations on input points of the point operations using a unified point addition formula or a unified mixed addition formula to obtain coordinates of output points further includes: When the Z coordinates of both input points are not 1, the unified point addition formula is used; When the Z coordinate of at least one of the two input points is 1, the unified mixed addition formula is used.

4. An accelerator for elliptic curve point operations, characterized in that: include: The preprocessing module is used to preprocess the original points of the elliptic curve before point operation: first, the Weierstrass curve affine coordinates of the original points are entered into the Montgomery domain, and transformed into the twisted Edwards curve to obtain the twisted Edwards curve extended coordinates of the original points, wherein the Weierstrass curve formula of the elliptic curve is: 2 =x 3 +ax+b(mod p), x and y are the Weierstrass curve affine coordinates of the original point, a and b are curve constants, and the modulus p is an m-bit binary number; The point operation module is used to obtain the coordinates of the input point during the point operation. If the input point is an original point, the coordinates of the input point are the preprocessed coordinates. The unified point addition formula or the unified mixed addition formula is used to perform point operation on the input point of the point operation to obtain the coordinates of the output point. The addition, subtraction and multiplication operations in the formula are respectively obtained by the following formulas to obtain the operation result C: Addition operation: C = A + B Subtraction operation: C = 4p + AB Multiplication operation: C = C1 + C3 (mod R) Where C1 = A*B, C2 = I*C1 (mod R), C3 = C2*p, I = -1 / p (mod R), R = 2 n , n is greater than or equal to m+7, A and B are the objects to be operated in the corresponding addition, subtraction or multiplication operation; The result modulo module is used to perform the inverse operation of the preprocessing on the coordinates of the output point, and perform modulo on the coordinates after the inverse operation, and the modulus of the modulo is p.

5. The elliptic curve point operation acceleration device according to claim 4, characterized in that: The n is m+7.

6. The elliptic curve point operation acceleration device according to claim 4, characterized in that: The step of performing point operations on input points of the point operations using a unified point addition formula or a unified mixed addition formula to obtain coordinates of output points further includes: When the Z coordinates of both input points are not 1, the unified point addition formula is used; When the Z coordinate of at least one of the two input points is 1, the unified mixed addition formula is used.

7. An electronic device, characterized in that: It comprises a storage module, wherein the storage module comprises instructions loaded and executed by a processor, and when the instructions are executed, the processor executes an acceleration method for elliptic curve point operations according to any one of claims 1-3.

8. A computer-readable storage medium storing one or more programs, characterized in that: When the one or more programs are executed by a processor, an acceleration method for elliptic curve point operations as described in any one of claims 1 to 3 is implemented.

Images