Calculation method and device for elliptic curve encryption scalar multiplication

Abstract

The embodiment of the invention provides a calculation method and device for elliptic curve encryption scalar multiplication, electronic equipment and a computer readable storage medium, and relates to the technical field of information encryption. The method comprises the following steps: determining a base point G and each group of sub-scalar quantity k on an elliptic curve, wherein each group of sub-scalar quantity k is obtained by coding a scalar quantity K based on a window method; reading a first result Rd corresponding to the actual value of the sub-scalar k from an SRAM (Static Random Access Memory) for each group of sub-scalar; determining a Q point on the elliptic curve according to the first result Rd corresponding to each group of sub-scalar k; wherein the first result Rd corresponding to the actual value of the sub-scalar k is obtained from the preset SRAM, and the method further comprises the following steps of: aiming at each possible value of each group of sub-scalar k, performing scalar multiplication on the base point G and the possible value through a point addition and point doubling operator realized by hardware to obtain the first result Rd corresponding to the possible value, and writing the first result Rd into the SRAM. According to the embodiment of the invention, the scalar multiplication operation efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of information encryption technology. Specifically, the present application relates to a fast calculation method, device, electronic device, computer-readable storage medium and computer program product for elliptic curve encryption scalar multiplication. Background Art

[0002] Elliptic Curve Cryptography (ECC) is a type of public key cryptography based on cryptographic operations using elliptic curves over finite fields. ECC operations can be used to perform traditional cryptographic operations including key exchange and digital signature operations.

[0003] Specifically speaking, in the entire calculation process of the elliptic curve encryption algorithm, scalar multiplication is one of the most time-consuming parts. Summary of the invention

[0004] The embodiments of the present application provide a method, device, electronic device, computer-readable storage medium and computer program product for calculating elliptic curve encryption scalar multiplication, which can solve the above-mentioned problems of the prior art. The technical solution is as follows: According to one aspect of an embodiment of the present application, a method for calculating elliptic curve encryption scalar multiplication is provided, the method comprising: Determine a base point G on the elliptic curve and each group of sub-scalars k, wherein each group of sub-scalars k is obtained by encoding the scalar K based on a window method; For each group of sub-scalars, a first result Rd corresponding to the actual value of the sub-scalar k is read from a preset static random access memory SRAM; Determine the Q point on the elliptic curve according to the first result Rd corresponding to each group of sub-scalars k; The first result Rd corresponding to the actual value of the sub-scalar k is obtained from a preset SRAM, and the method also includes: For each possible value of each group of sub-scalars k, a scalar multiplication is performed on the base point G and the possible value through a point addition and point multiplication operator implemented in hardware to obtain a first result Rd corresponding to the possible value and write it into the SRAM.

[0005] According to another aspect of an embodiment of the present application, a computing device for elliptic curve encryption scalar multiplication is provided, the device comprising: An input module, used to determine a base point G on an elliptic curve and each group of sub-scalars k, wherein each group of sub-scalars k is obtained by encoding the scalar K based on a window method; A reading module, configured to read, for each group of sub-scalars, a first result Rd corresponding to an actual value of the sub-scalar k from a preset static random access memory SRAM; An output module, used to determine a Q point on the elliptic curve according to a first result Rd corresponding to each group of sub-scalars k; Among them, the computing device also includes a preprocessing module, which is used to perform scalar multiplication on the base point G and the possible value for each possible value of each group of sub-scalars k through a hardware-implemented point addition and point multiplication operator, obtain a first result Rd corresponding to the possible value, and write it into the SRAM.

[0006] According to another aspect of an embodiment of the present application, an electronic device is provided, which includes a memory, a processor, and a computer program stored in the memory, and the processor executes the computer program to implement the steps of the above-mentioned elliptic curve encryption scalar multiplication calculation method.

[0007] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the calculation method of the above-mentioned elliptic curve encryption scalar multiplication are implemented.

[0008] According to one aspect of an embodiment of the present application, a computer program product is provided, including a computer program, which implements the steps of the above-mentioned elliptic curve encryption scalar multiplication calculation method when executed by a processor.

[0009] The beneficial effects of the technical solution provided by the embodiment of the present application are: Based on the premise that the possible values ​​of each group of sub-scalars k are limited, point addition and point multiplication operators are pre-implemented in hardware for each possible value for real-time software call operations. Moreover, for a predetermined elliptic curve, the software can pre-scalar multiply the base point of the elliptic curve with the possible value based on the point addition and point multiplication operators to obtain the first result Rd corresponding to the possible value and write it into the SRAM. Thus, after obtaining each group of sub-scalars, the first result Rd corresponding to the actual value is obtained from the SRAM based on the actual value of the sub-scalar, and the capture of the first result Rd corresponding to the calculation sub-scalar is omitted in the actual operation stage. Finally, the Q point is obtained using the first result Rd corresponding to each group of sub-scalars k, which significantly improves the operational efficiency of the scalar multiplication. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in describing the embodiments of the present application are briefly introduced below.

[0011] Figure 1 A schematic diagram of a system architecture for implementing a calculation method for circular curve encrypted scalar multiplication provided in an embodiment of the present application; Figure 2 A schematic diagram of a storage format provided in an embodiment of the present application; Figure 3A schematic diagram of performing lightweight scrambling of addresses and data on SRAM provided in an embodiment of the present application; Figure 4 A schematic diagram of the structure of a computing device for elliptic curve encryption scalar multiplication provided in an embodiment of the present application; Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0012] The embodiments of the present application are described below in conjunction with the drawings in the present application. It should be understood that the implementation methods described below in conjunction with the drawings are exemplary descriptions for explaining the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions of the embodiments of the present application.

[0013] It will be understood by those skilled in the art that, unless specifically stated, the singular forms "one", "an" and "the" used herein may also include plural forms. It should be further understood that the terms "including" and "comprising" used in the embodiments of the present application refer to that the corresponding features can be implemented as the presented features, information, data, steps, operations, elements and / or components, but do not exclude the implementation as other features, information, data, steps, operations, elements, components and / or combinations thereof supported by the technical field. It should be understood that when we call an element "connected" or "coupled" to another element, the one element can be directly connected or coupled to the other element, or it can refer to that the one element and the other element establish a connection relationship through an intermediate element. In addition, the "connection" or "coupling" used here may include wireless connection or wireless coupling. The term "and / or" used here indicates at least one of the items defined by the term, for example, "A and / or B" can be implemented as "A", or as "B", or as "A and B".

[0014] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0015] First, several terms involved in this application are introduced and explained: Elliptic curve cryptography is a public key cryptography technology whose security is based on the mathematical structure of elliptic curves. In elliptic curve cryptography, the concept of scalar is crucial. Elliptic curves are not ellipses, but curves that satisfy certain equations (such as y²=x³+ax+b). These curves have special applications in cryptography because they can form a finite Abelian group, and the operation rules on this group define how points on the elliptic curve can be added and multiplied.

[0016] In elliptic curve cryptography, a scalar usually refers to an integer that is used to perform a scalar multiplication operation with a point on an elliptic curve. The result of the scalar multiplication operation is the result of multiple additions (or multiple self-additions) of the point on the elliptic curve group.

[0017] Key generation: In elliptic curve cryptography, the private key is usually a scalar (i.e., a large integer), and the public key is the result of a scalar multiplication of the private key and a predetermined point on the elliptic curve (called a generator point). Therefore, the scalar plays a vital role in the key generation process.

[0018] Encryption and decryption: In the encryption process, the sender uses the receiver's public key (i.e., the scalar multiplication result of the receiver's private key and the generator point) and a random scalar (as the key) to encrypt the message. When decrypting, the receiver uses its private key (i.e., the scalar) to perform the inverse operation of the scalar multiplication on the encrypted message to restore the original message. Therefore, the scalar is also indispensable in the encryption and decryption process.

[0019] Security: The security of elliptic curve cryptography is based on the difficulty of the elliptic curve discrete logarithm problem. That is, given a point on an elliptic curve and another point (the point is the scalar multiplication result of the first point and an unknown scalar), it is difficult to calculate the unknown scalar. Therefore, the choice of scalar is crucial to ensure the security of elliptic curve cryptography.

[0020] Scalar multiplication is one of the core operations in elliptic curve cryptography. It refers to multiplying a scalar (integer) with a point on an elliptic curve to obtain multiple addition results of the point on the elliptic curve group. The efficiency and security of scalar multiplication are crucial to the overall performance of the elliptic curve cryptography system.

[0021] The encoding process of scalar K is: The scalar K before encoding is an odd number, its length is N bits, and m is 2 w , w is the window parameter, taking the encryption scenario applied in the field of automotive electronics and industrial Internet of Things as an example, w When is 4, m is 16; The encoding process can be represented by the following pseudo code as the following 5 steps: 1.i←0 While (K>m) do: 2. ki←(K mod 2m)-m; 3. K←(K-ki) / m; 4.i←i+1; end 5. ki←K;

[0022] Set the number of loops i, and set the initial value to 0; Judgment criterion: whether the K assigned in this round is greater than m; If and only if the value of K assigned in this round is greater than m, execute the following while loop: 1) Let the modulus be 2m, perform a modulus operation on the scalar K, and then assign the result after subtracting m to the variable ki; 2) Subtract ki from scalar K to get the intermediate result, divide it by m, and assign the quotient back to scalar K; 3) i increases by 1; this loop ends, returns to check whether the criterion is met, and the loop is executed; If and only if K is less than m, the encoding process ends after the scalar K is assigned to Ki once.

[0023] The encoded scalar K is a number with a length of 4L bits, which can be divided into L groups of 4 bits each. Each group is called a subscalar, denoted by k. All possible values ​​of k are: {±1, ±3, ..., ±13, ±15}.

[0024] 8) Scalar multiplication operation process: It can be expressed in the following 9 steps through pseudo code:

[0025]

[0026]

[0027]

[0028]

[0029]

[0030]

[0031]

[0032]

[0033]

[0034]

[0035] The input of the embodiment of the present application is a base point G represented by a prime field on an elliptic curve, and an encoded scalar K. It can be understood that the encoded scalar K has L sub-scalars, and the length of each sub-scalar k is 4 bits; Operation process: 1) Set the base point G and traverse the subscalar k i For all possible values, perform scalar multiplication operation [k]G to obtain a series of first results Rd, where Rd is a series of values: {±1G, ±3G, …, ±13G, ±15G}; 2) Based on k L-1 The value of selects the corresponding first result Rd and assigns it to variable A; 3) Traverse i and decrease its value from l-2 to 0, and execute the following for loop body L-1 times in total: 3.1) Perform w times of doubling operation on A and assign the result back to variable A; 3.2) If the current value of k is not less than 0, perform a point addition operation: A+Rd; If the current value of k is less than 0, a point addition operation is performed: A-Rd; Reassign the dot addition operation to variable A; 3.3) This loop ends and returns; 4) Use variable A output from the last round as point Q.

[0036] That is, a first result Rd of scalar multiplication of the base point G and each group of sub-scalars k of the encoded scalar K, wherein the encoded scalar K includes L groups of sub-scalars, and the length of each group of sub-scalars is w bits; From k L-2 The subscalar starts to traverse to the k0 subscalar, and the Q point on the elliptic curve is determined according to the result after traversing the k0 subscalar: For the first round of traversal, k l-1 The first result Rd corresponding to the subscalar is taken as the result after the first round of traversal; For non-first round traversal, the result of the previous round of traversal is subjected to w consecutive dot-multiplication operations to obtain the first intermediate value. Depending on whether the sub-scalar of the current traversal is less than 0, a dot-addition operation is performed on the first intermediate value and the first result corresponding to the sub-scalar of the current traversal to obtain the result A after this round of traversal.

[0037] The fast calculation method, device, electronic device, computer-readable storage medium and computer program product of elliptic curve encryption scalar multiplication provided in this application are intended to solve the above technical problems in the prior art.

[0038] The following describes several exemplary embodiments to illustrate the technical solutions of the embodiments of the present application and the technical effects produced by the technical solutions of the present application. It should be noted that the following embodiments can refer to, draw on or combine with each other, and the same terms, similar features and similar implementation steps in different embodiments will not be described repeatedly.

[0039] The present application provides a method for calculating elliptic curve encryption scalar multiplication, such as Figure 1 As shown, the method includes: S101, determining a base point G and each group of sub-scalars k on an elliptic curve, wherein each group of sub-scalars k is obtained by encoding the scalar K based on a window method; S102, for each group of sub-scalars, reading a first result Rd corresponding to the actual value of the sub-scalar k from a preset static random access memory SRAM; S103 . Determine a Q point on the elliptic curve according to the first result Rd corresponding to each group of sub-scalars k.

[0040] In order to improve the operational efficiency of scalar multiplication, the embodiment of the present application is based on the premise that the possible values ​​of each group of sub-scalars k are limited. For each possible value, point addition and point multiplication operators are pre-implemented in hardware for real-time call operations by software. Moreover, for a predetermined elliptic curve, the software can pre-perform scalar multiplication on the base point of the elliptic curve and the possible value based on the point addition and point multiplication operators, obtain the first result Rd corresponding to the possible value, and write it into the SRAM. Therefore, after obtaining each group of sub-scalars, based on the actual value of the sub-scalar, the first result Rd corresponding to the actual value is obtained from the SRAM, and the capture of the first result Rd corresponding to the calculation sub-scalar is omitted in the actual operation stage. Finally, the first result Rd corresponding to each group of sub-scalars k is used to obtain the Q point, thereby significantly improving the operational efficiency of scalar multiplication.

[0041] It should be understood that after obtaining the first result Rd corresponding to each group of sub-scalars k, the embodiment of the present application can refer to the above-mentioned scalar multiplication operation process to obtain the final Q point, which is not elaborated in the embodiment of the present application.

[0042] Based on the above embodiments, as an optional embodiment, for each possible value of each group of sub-scalars k, the first result Rd corresponding to the possible value is written into the SRAM in the following manner: storing the coordinate components of the first result Rd of the first possible value of a pair of possible values ​​with the same absolute value on the three coordinate axes and the coordinate components of the first result Rd of the second possible value on the x and y coordinate axes in the SRAM; The first possible value is a possible value that is a positive value in the pair of possible values; The second possible value is a negative possible value of the pair of possible values.

[0043] Referring to the examples provided in the above embodiments, all values ​​of the sub-scalar are: {±1, ±3, ..., ±13, ±15}. It can be seen that the same numerical value has two possible values, one positive and one negative. Therefore, the present application regards two possible values ​​with the same absolute values ​​as a pair of possible values ​​- for example, 1 and -1 are a pair of possible values, and stores the coordinate components of the first result Rd of the first possible value (positive value) in a pair of possible values ​​on the three coordinate axes, and the coordinate components of the first result Rd of the second possible value (negative value) on the x and y coordinate axes in the SRAM.

[0044] See also Figure 2 , which exemplarily shows a schematic diagram of the storage format of an embodiment of the present application. In the figure, taking + / -3G point as an example, it can be seen that the positive value in + / -3G(x, y, z) can be stored in SRAM in the form of 3G_x, 3G_y, 3G_z, and the negative value is stored in SRAM in the form of Neg_3G_x / y. The advantages of such storage are: 1. Compatible with the representation of Jacobian coordinates and standard projective coordinates of possible values, representing two possible values ​​of + / -3G at the same time; 2. When the point addition and doubling operators of the hardware are selected for implementation and the first results Rd are calculated, the embodiment of the present application may omit the modular inverse operation of converting the operation results into affine coordinates; 3. Support pre-calculation of the first result Rd for equivalent point transformation: 3G(x, y, z) is transformed into 3G(r 2 *x, r 3 *y, r*z) or 3G(r*x, r*y, r*z), where r is a random number; 4. For the conditional branches of the scalar multiplication algorithm 3.2, the hardware implementation does not need to add additional regularization operations, which can avoid potential security leakage risks.

[0045] Based on the above embodiments, as an optional embodiment, all first results Rd in the embodiments of the present application, that is, the first results Rd of the scalar multiplication of the base point G and each possible value of each sub-scalar, are stored in the same SRAM. This operation can avoid the potential position leakage risk of storing Rd with different values ​​in multiple SRAMs.

[0046] On the basis of the above embodiments, in the process of hardware implementation of scalar multiplication, in order to avoid potential leakage of the SRAM address storing the pre-calculated point parameters, the embodiment of the present application performs lightweight scrambling of the address and data for the SRAM: Scrambling the data and the corresponding address before the SRAM write access error correction code (ECC) encoding logic; After the SRAM read accesses the ECC encoding logic, the data and the corresponding address are descrambled.

[0047] See also Figure 3 , which exemplarily shows a schematic diagram of lightweight scrambling of data and corresponding addresses in SRAM according to an embodiment of the present application, as shown in the figure, 1) The 128-bit write data is divided into 4 groups of 32 bits, and each group of data is scrambled based on a random number (RN); 2) The 128-bit read data is divided into 4 groups of 32 bits, and each group of data is scrambled based on the random number RN; 3) Scramble the 10-bit write address based on the random number RN; 4) Scramble the 10-bit read address based on the random number RN; The random numbers in the embodiment of the present application are stored through a random number diffusion function, and the SRAM storage uses a 128-bit data bit width.

[0048] In the embodiment of the present application, the scrambling operation of data and corresponding addresses is performed before the SRAM write accesses the ECC encoding logic, and the descrambling operation is performed after the SRAM read accesses the ECC decoding logic. The scrambling and descrambling operations are close to the SRAM logic interface, which is transparent and imperceptible to the software and hardware upper-layer logic accessing the SRAM.

[0049] On the basis of the above embodiments, taking the first result Rd to be stored in the SRAM as an example, scrambling the first result Rd includes: Grouping the first result Rd according to a preset bit length to obtain multiple groups of sub-results; For each group of sub-results, an XOR operation is performed on the address ADDR of the first result Rd, the sub-result, and the random number RN to obtain a scrambled sub-result; Scrambling the address of the first result Rd includes: For each group of sub-results, the address information AIN of the sub-result is determined from the address ADDR of the first result Rd, and an XOR operation is performed on the address information of the sub-result and a random number RN to obtain the scrambled address of the sub-result.

[0050] Taking the bit width of SRAM data storage as 128 bits as an example, when the first result is grouped by 32 bits, four 32-bit sub-results can be obtained, and the address information ADDR of each group of sub-results has the lower 9 bits, namely ADDR[8:0].

[0051] For data reliability, SRAM generally has an ECC error correction code mechanism, and the timing margin on the read and write data path is very small. The data scrambling and address scrambling operations of the embodiment of the present application are essentially simple XOR operations, which only add one level of logic delay and can ensure the efficient execution of scalar multiplication operations.

[0052] Based on the above embodiments, as an optional embodiment, the encoded scalar K includes L groups of sub-scalars k. It can be seen from the above method for encoding the scalar K that the L groups of sub-scalars are obtained in sequence during the encoding process, k0 is obtained for the first time, k1 is obtained for the second time, and k is obtained until k is obtained. L-1 .

[0053] The embodiment of the present application determines the Q point on the elliptic curve according to the first result Rd corresponding to each group of sub-scalars k, including: According to the L-2th subscalar (k L-2 ), traverse in reverse order to the first subscalar (k0) in the L group of subscalars, and obtain the Q point on the elliptic curve according to the result A after traversing the first subscalar, where: For the first round of traversal, the L-1th subscalar (k L-1 ) The first result Rd corresponding to it is taken as the result after the first round of traversal; For non-first round traversal, the result of the previous round of traversal is continuously doubled w times to obtain the first intermediate value (A'). i ) is less than 0, determine a method for performing a point addition operation on the first intermediate value (A') and the first result Rd corresponding to the currently traversed sub-scalar, and perform a point addition operation on the first intermediate value (A') and the first result Rd corresponding to the currently traversed sub-scalar according to the method to obtain a result A after this round of traversal.

[0054] Specifically, if the subscalar currently traversed (k i ) is not less than 0, then A=A'+Rd; If the subscalar currently being traversed (k i ) is less than 0, then A=A'-Rd.

[0055] Since the scalar K in the calculation of the embodiment of the present application must be an odd number, if the original scalar K' is an even number, a preset odd number (for example, 1) is added to the original scalar K' to obtain the scalar K; If the original scalar K' is an odd number, a preset even number (for example, 2) is added to the original scalar K' to obtain the scalar K.

[0056] Further, according to the result A after the first subscalar traversal, obtaining the Q point on the elliptic curve includes: If the original scalar K' is an even number, the difference between the result A after the first sub-scalar traversal and the base point G is taken as the G point; If the original scalar K' is an odd number, the difference between the result A after the first sub-scalar traversal and twice the base point G is taken as the G point.

[0057] In the related art of encoding the scalar K, the while loop judgment condition K>m is used to design large number operations. In order to achieve convenience, the embodiment of the present application transforms the while loop into a for loop, and i takes values ​​from 0 to , execute operations 2 to 4 in the above pseudo code; i takes the value , execute the above pseudo code step 5. It should be noted that: when the bit length of K is less than 5 bits, no encoding operation is performed; otherwise, enter the for loop and perform encoding operation.

[0058] In some embodiments, each group of sub-scalars k of the scalar K is obtained by: If the number of bits n of the scalar K is less than the window length w , then the scalar K is taken as the only set of sub-scalars k; If the number of bits of the scalar K is not less than the window length w , then based on the window method, we get the first group to the The sub-scalar k will be based on the The scalar to which the group subscalar is reassigned is the last group subscalar k; It can be understood that the window length is used to represent the length of each sub-scalar.

[0059] Based on the above embodiments, taking m=16 as an example, each sub-scalar ∈{±1,±3,…,±11,±15} requires 5 bits to represent. In order to further reduce the storage amount, the embodiment of the present application will remap the sub-scalars and splice them in sequence according to the bit sequence, and write them back to the memory in groups of 128 bits. SRAM Furthermore, the last 128-bit group in the embodiment of the present application is not written back, but directly stored in the hardware register for use in the scalar multiplication operation (steps 2 and 3 in the pseudo code). The last 128-bit group corresponds to the di value at the start of the for loop.

[0060] Taking m=16 as an example, for each sub-scalar ∈{±1,±3,…,±11,±15}, the remapping logic of the embodiment of the present application may be: -1→+2; +1→+1; -3→+4; +3→+3; -5→+6; +5→+5; -7→+8; +7→+7; -9 → +10; +9 → +9; -11→+12; +11→+11; -13 → +14; +13 → +13; -15→0; +15→+15; That is to say, in the embodiment of the present application, for a positive number p, it is remapped to itself, and for a negative number -p, it is remapped to p+1, where p is a positive integer.

[0061] The scalar K in the embodiment of the present application is grouped into a data set every 128 bits from low to high bits, and the part less than 128 bits is treated as a separate data set. The last concatenated data set is not written back to the SRAM, but is stored in a hardware register. This can further improve the efficiency of obtaining the Q point based on the base point G and each group of sub-tables.

[0062] The embodiment of the present application checks the LSB bit value while reading the lowest sub-scalar of the scalar K, thereby determining the parity of K; The embodiment of the present application controls the coordinate randomization of point A to be enabled (ie, RPC is enabled), and the required random numbers come from a random number diffusion function.

[0063] In terms of performance, the embodiment of the present application saves n / 4 point addition operations compared to the classic binary scalar multiplication (assuming that the scalar K is n bits); In terms of security: it ensures that there will be no security leaks at the bottom of the algorithm, and each execution step is completely regularized. Combined with the scalar K-blind protection implemented in cooperation with the software, it can resist common SPA and DPA side channel attacks.

[0064] The present application embodiment provides a computing device for elliptic curve encryption scalar multiplication, such as Figure 4 As shown, the computing device for elliptic curve encryption scalar multiplication may include: an input module 501, a reading module 502, an output module 503 and a preprocessing module 504, wherein: An input module 501 is used to determine a base point G on an elliptic curve and each group of sub-scalars k, wherein each group of sub-scalars k is obtained by encoding the scalar K based on a window method; A reading module 502 is configured to read, for each group of sub-scalars, a first result Rd corresponding to an actual value of the sub-scalar k from a preset static random access memory SRAM; An output module 503 is used to determine a Q point on the elliptic curve according to the first result Rd corresponding to each group of sub-scalars k; Among them, the computing device also includes a preprocessing module 504, which is used to perform scalar multiplication on the base point G and the possible value for each possible value of each group of sub-scalars k through a hardware-implemented point addition and point multiplication operator, obtain a first result Rd corresponding to the possible value, and write it into the SRAM.

[0065] The device of the embodiments of the present application can execute the method provided by the embodiments of the present application, and the implementation principles are similar. The actions performed by each module in the device of each embodiment of the present application correspond to the steps in the method of each embodiment of the present application. For the detailed functional description of each module of the device, please refer to the description in the corresponding method shown in the previous text, which will not be repeated here.

[0066] An electronic device is provided in an embodiment of the present application, including a memory, a processor and a computer program stored in the memory, and the processor executes the above-mentioned computer program to implement the steps of the calculation method of elliptic curve encryption scalar multiplication. Compared with the related art, it can be achieved that: in order to improve the operation efficiency of scalar multiplication, based on the premise that the possible values ​​of each group of sub-scalars k are limited, for each possible value, point addition and point doubling operators are pre-implemented in hardware for real-time call operation by software, and, for a predetermined elliptic curve, the software can perform scalar multiplication on the base point of the elliptic curve and the possible value in advance based on the point addition and point doubling operators, obtain the first result Rd corresponding to the possible value, and write it into SRAM, so that, after obtaining each group of sub-scalars, based on the actual value of the sub-scalar, the first result Rd corresponding to the actual value is obtained from the SRAM, and the capture of the first result Rd corresponding to the sub-scalar is omitted in the actual operation stage, and finally the Q point is obtained using the first result Rd corresponding to each group of sub-scalars k, which significantly improves the operation efficiency of scalar multiplication.

[0067] In an alternative embodiment, an electronic device is provided, such as Figure 5 As shown, Figure 5 The electronic device 4000 shown includes: a processor 4001 and a memory 4003. The processor 4001 and the memory 4003 are connected, such as through a bus 4002. Optionally, the electronic device 4000 may also include a transceiver 4004, which may be used for data interaction between the electronic device and other electronic devices, such as data transmission and / or data reception. It should be noted that in actual applications, the transceiver 4004 is not limited to one, and the structure of the electronic device 4000 does not constitute a limitation on the embodiments of the present application.

[0068] Processor 4001 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. Processor 4001 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0069] The bus 4002 may include a path for transmitting information between the above components. The bus 4002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. The bus 4002 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus 4002 is represented by only one thick line in the figure, but it does not mean that there is only one bus or one type of bus.

[0070] The memory 4003 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), magnetic disk storage media, other magnetic storage devices, or any other medium that can be used to carry or store computer programs and can be read by a computer, without limitation herein.

[0071] The memory 4003 is used to store the computer program for executing the embodiment of the present application, and the execution is controlled by the processor 4001. The processor 4001 is used to execute the computer program stored in the memory 4003 to implement the steps shown in the above method embodiment.

[0072] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps and corresponding contents of the aforementioned method embodiment can be implemented.

[0073] The embodiment of the present application also provides a computer program product, including a computer program, which can implement the steps and corresponding contents of the aforementioned method embodiment when executed by a processor.

[0074] The terms "first", "second", "third", "fourth", "1", "2", etc. (if any) in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than that shown or described in the drawings.

[0075] It should be understood that, although each operation step is indicated by arrows in the flowchart of the embodiment of the present application, the implementation order of these steps is not limited to the order indicated by the arrows. Unless clearly stated herein, in some implementation scenarios of the embodiment of the present application, the implementation steps in each flowchart can be performed in other orders according to demand. In addition, some or all of the steps in each flowchart may include multiple sub-steps or multiple stages based on actual implementation scenarios. Some or all of these sub-steps or stages may be executed at the same time, and each sub-step or stage in these sub-steps or stages may also be executed at different times respectively. In different scenarios of execution time, the execution order of these sub-steps or stages may be flexibly configured according to demand, and the embodiment of the present application does not limit this.

[0076] The above is only an optional implementation method for some implementation scenarios of the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the technical concept of the solution of the present application, other similar implementation methods based on the technical ideas of the present application are also within the protection scope of the embodiments of the present application.

Claims

1. A method for calculating elliptic curve encryption scalar multiplication, characterized in that: include; Determine a base point G on the elliptic curve and each group of sub-scalars k, wherein each group of sub-scalars k is obtained by encoding the scalar K based on a window method; For each group of sub-scalars, a first result Rd corresponding to the actual value of the sub-scalar k is read from a preset static random access memory SRAM; Determine the Q point on the elliptic curve according to the first result Rd corresponding to each group of sub-scalars k; The first result Rd corresponding to the actual value of the sub-scalar k is obtained from a preset SRAM, and the method also includes: For each possible value of each group of sub-scalars k, a scalar multiplication is performed on the base point G and the possible value through a point addition and point multiplication operator implemented in hardware to obtain a first result Rd corresponding to the possible value and write it into the SRAM.

2. The method according to claim 1, characterized in that For each possible value of each group of subscalars k, the first result Rd corresponding to the possible value is written into the SRAM in the following manner: storing the coordinate components of the first result Rd of the first possible value of a pair of possible values ​​with the same absolute value on the three coordinate axes and the coordinate components of the first result Rd of the second possible value on the x and y coordinate axes in the SRAM; The first possible value is a possible value that is a positive value in the pair of possible values; The second possible value is a negative possible value of the pair of possible values.

3. The method according to claim 1 or 2, characterized in that: Each first result Rd is written in a unique SRAM.

4. The method according to claim 3, characterized in that The SRAM has an error correction code (ECC) capability. For each data stored in the SRAM, the method further includes one of the following: Before the SRAM write accesses the ECC encoding logic, scrambling the data and the corresponding address; After the SRAM read accesses the ECC encoding logic, the data and the corresponding address are descrambled.

5. The method according to claim 4, characterized in that Scrambling the first result Rd includes: Grouping the first result Rd according to a preset bit length to obtain multiple groups of sub-results; For each group of sub-results, an XOR operation is performed on the address ADDR of the first result Rd, the sub-result, and the random number RN to obtain a scrambled sub-result; Scrambling the address of the first result Rd includes: For each group of sub-results, the address information of the sub-results is determined from the address ADDR of the first result Rd, and an XOR operation is performed on the address information of the sub-results and a random number RN to obtain the scrambled address of the sub-results.

6. The method according to claim 1, characterized in that The number of groups of the subscalar k is L groups; Determining a point Q on the elliptic curve according to a first result Rd corresponding to each group of sub-scalars k includes: Starting from the L-2th subscalar of the L group of subscalars, traversing in reverse order to the first subscalar in the L group of subscalars, according to the result A after traversing the first subscalar, the Q point on the elliptic curve is obtained, where: For the first round of traversal, the first result Rd corresponding to the L-1th sub-scalar is taken as the result after the first round of traversal; For non-first round of traversal, the result of the previous round of traversal is subjected to w consecutive dot-addition operations to obtain a first intermediate value. According to whether the currently traversed sub-scalar is less than 0, a method for performing dot-addition operations on the first intermediate value and the first result Rd corresponding to the currently traversed sub-scalar is determined. According to the method, a dot-addition operation is performed on the first intermediate value and the first result Rd corresponding to the currently traversed sub-scalar to obtain a result A after this round of traversal.

7. The method according to claim 1, characterized in that The scalar K is determined by: Get the original scalar K'; If the original scalar K' is an even number, adding a preset odd number to the original scalar K' to obtain the scalar K; If the original scalar K' is an odd number, then a preset even number is added to the original scalar K' to obtain the scalar K; The step of obtaining a point Q on the elliptic curve according to a result A after traversing the first subscalar comprises: If the original scalar K' is an even number, the difference between the result A after the first sub-scalar traversal and the base point G is taken as the G point; If the original scalar K' is an odd number, the difference between the result A after the first sub-scalar traversal and twice the base point G is taken as the G point.

8. The method according to any one of claims 1 to 7, characterized in that: Each group of sub-scalars k of the scalar K is obtained in the following way: If the number of bits n of the scalar K is less than the window length w , then the scalar K is taken as the only set of sub-scalars k; If the number of bits of the scalar K is not less than the window length w, then the first group to the first group are obtained based on the window method. The sub-scalar k will be based on the The scalar to which the group subscalar is reassigned is the last group subscalar k; The window length is used to represent the length of each sub-scalar.

9. The method according to claim 8, characterized in that Also includes: For each group of sub-scalars k obtained, the sub-scalars k are mapped to the bit number through a pre-established mapping relationship. w ; Each group of sub-scalars k after mapping is concatenated according to the bit sequence, and written back to the SRAM for storage as a data set with the bit width of the SRAM storage data; Among them, the last data set of splicing is not written back to SRAM, but stored in hardware registers.

10. A computing device for elliptic curve encryption scalar multiplication, characterized in that: include: An input module, used to determine a base point G on an elliptic curve and each group of sub-scalars k, wherein each group of sub-scalars k is obtained by encoding the scalar K based on a window method; A reading module, configured to read, for each group of sub-scalars, a first result Rd corresponding to an actual value of the sub-scalar k from a preset static random access memory SRAM; An output module, used to determine a Q point on the elliptic curve according to a first result Rd corresponding to each group of sub-scalars k; Among them, the computing device also includes a preprocessing module, which is used to perform scalar multiplication on the base point G and the possible value for each possible value of each group of sub-scalars k through a hardware-implemented point addition and point multiplication operator, obtain a first result Rd corresponding to the possible value, and write it into the SRAM.

11. An electronic device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the calculation method of elliptic curve encryption scalar multiplication according to any one of claims 1-9.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the calculation method of the elliptic curve encryption scalar multiplication described in any one of claims 1 to 9 is implemented.

13. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the calculation method of the elliptic curve encryption scalar multiplication described in any one of claims 1 to 9 is implemented.

Images