Separated dot multiplication method and hardware circuit

Abstract

The invention relates to a separated dot multiplication method and a hardware circuit, and belongs to the technical field of passwords. The method provided by the invention comprises three parts, wherein the first part is NAF coding operation, the continuous point doubling calculation process of the second part is point expansion calculation, and the continuous point addition / subtraction calculation process of the third part is point accumulation calculation. The method comprises a fixed point preprocessing mode, a random point-to-point multiplication serial mode, a random point-to-point multiplication parallel mode, a random point-to-point multiplication pipeline mode, a fixed point acceleration point multiplication mode and a random point and fixed point mixed pipeline mode. According to the method, six application modes are provided in combination with the application characteristics of the ECC elliptic curve cryptosystem, the method has a wider and more flexible application effect, and better performance can be achieved under different hardware resource constraints.

Description

Technical Field

[0001] The invention belongs to the technical field of cryptography, and in particular relates to a separated point multiplication method and a hardware circuit. Background Art

[0002] The point multiplication operation on the elliptic curve is expressed as: Q = P + P + ... + P + P = KP, where Q and P are points on the elliptic curve, and K is a positive integer. The point multiplication operation is the core of the elliptic curve cryptography system. The commonly used point multiplication design methods are mainly binary expansion method, NAF expansion method, and Mentgomery expansion method.

[0003] (1) Binary expansion method

[0004] The direct binary expansion method is the most intuitive point multiplication method. The binary expansion form of K is K = (k n-1 ,k n-2 ,…,k1,k0), k i ∈{0,1}. The principle of binary expansion is as follows:

[0005] Q=KP=(k n-1 2 n-1 +k n-2 2 n-2 +…+k12 1 +k02 0 )

[0006] =((((k n-1 P)2+k n-2 P)2+k n-3 P)2+…+k1P)2+k0P

[0007] When the direct binary expansion method is implemented, the steps are:

[0008] Step 1: Let Q = ∞, that is, the point at infinity; at the same time, start scanning from the highest bit n-1 of K until a non-zero bit is encountered (defined as the m-1th bit), at which time i = m-1.

[0009] Step 2: i decreases from m-1 to 0, and repeats:

[0010] a) Q = 2Q

[0011] b) If k i =1, then Q = Q + P

[0012] Step 3: Return to Q.

[0013] Since K is chosen randomly or pseudo-randomly, the expected number of 1s in the binary representation of K is n / 2. Evaluated as m=n, the expected running time of this method is approximately n / 2 point additions and n point doublings.

[0014] (2) NAF expansion method

[0015] Based on the universal binary expansion method, considering that the addition and subtraction of points on the elliptic curve have the same execution efficiency and the execution circuit can be reused, a non-adjacent representation method is adopted to encode K. After encoding k i ∈{0,±1}. The NAF expansion method reduces the number of non-zero bits (i.e., ±1), so that when the point multiplication is decomposed into point addition and doubling, the number of executions of the point addition operation is reduced.

[0016] When the NAF expansion method is implemented, the steps are:

[0017] Step 1: Perform NAF encoding on K. According to the NAF encoding principle, the encoded length may increase by 1 bit.

[0018] Step 2: Let Q = ∞, i.e. the point at infinity;

[0019] Step 3: i decreases from l-1 to 0, and repeats:

[0020] a) Q = 2Q

[0021] b) If k i =1, then Q = Q + P

[0022] c) If k i = -1, then Q = QP

[0023] Step 4: Return to Q.

[0024] according to Evaluation, when the NAF expansion method is used to calculate the point multiplication, the expected value of the number of non-zero bits ±1 in the binary representation of NAF(K) is n / 3. Compared with the direct binary expansion method, the NAF encoding step is added, but the hardware cost and clock consumption of NAF encoding are very low and relatively negligible, and the overall point addition operation time consumption is reduced by n / 6 times.

[0025] (3) Montgomery expansion method

[0026] The Montgomery expansion method is also widely used to calculate point multiplication. The steps are:

[0027] Step 1: P1=P, P2=2P; start scanning from the highest bit of K at the same time until a non-zero bit is encountered (defined as the m-1th bit), at which time i=m-1.

[0028] Step 2: Let Q = ∞, i.e. the point at infinity;

[0029] Step 3: i decreases from m-1 to 0, and repeats:

[0030] a) If k i =1, then P1 = P1 + P2, P2 = 2P2

[0031] b) If k i =1, then P2 = P1 + P2, P1 = 2P1

[0032] Step 4: Return to Q = P1.

[0033] According to m=n evaluation, the Montgomery expansion method needs to perform n point additions and n point doublings, but its point addition and point doubling calculations can be parallelized, so its clock consumption is approximately equal to the larger of n point doubling operations or n point addition operations (in general, in an affine coordinate system, the two times are equivalent), which is generally less than the first two methods. In addition, in the binary expansion domain, the point addition and point doubling calculations in the Montgomery expansion method and the LD (Lopez-Dahab) coordinate system can be simplified.

[0034] In the traditional binary expansion method, the operation is the most intuitive, but it does not consider taking certain encoding methods for the K value to reduce the number of point additions, and the performance is low. In the NAF expansion method, the K value is NAF-encoded, which can effectively reduce the number of point additions, which is better than the binary expansion method. The common disadvantages of the binary expansion method and the NAF expansion method are that point addition and point doubling are serially executed alternately, and it is not possible to take the method of parallel execution of point addition and point doubling to improve performance. In each cycle, according to k, i The choice of whether to perform point addition is easily exploited by power consumption attacks during hardware implementation. In the Montgomery expansion method, point addition and point doubling are performed in each cycle. Its operation speed is not affected by the K value, can be executed in parallel, and can resist power consumption attacks. In the binary expansion domain, it can be combined with the LD coordinate system to obtain higher performance, but the performance in the prime domain is still lower than that of the NAF method. At the same time, none of these three methods combines the characteristics of actual ECC applications to improve performance. Summary of the invention

[0035] 1. Technical issues to be resolved

[0036] The technical problem to be solved by the present invention is how to provide a separate point multiplication method and hardware circuit to solve the problem that none of the three methods combines the characteristics of actual ECC applications to improve performance.

[0037] (II) Technical solution

[0038] In order to solve the above technical problems, the present invention proposes a separable point multiplication method, which includes three parts: the first part is NAF coding operation, the second part of the continuous doubling point calculation process is point expansion calculation, and the third part of the continuous point addition / subtraction calculation process is point accumulation calculation;

[0039] Description of relevant parameters:

[0040] a) n, m, l, r, i, di, ai are all positive integers;

[0041] b) P, DQ, Q are points on the elliptic curve;

[0042] c) K is an integer with a bit width of n, the highest non-zero bit of K is at the m-1th bit, and the i-th bit of K is denoted as K[i];

[0043] d) H is an integer with a bit width of n+2, and the i-th bit of H is denoted as H[i];

[0044] e)NAF(K) is the NAF code of K, and its i-th element is denoted by k i ,Right now k i ∈{0,±1};

[0045] f)NAF_ok,DQ_ok,AQ_ok,DQ_wen are single-bit signals;

[0046] g) mode is a 3-bit wide binary number used for working mode selection, mode=3'b000 indicates fixed point preprocessing mode, mode=3'b001 indicates random point multiplication serial mode, mode=3'b010 indicates random point multiplication parallel mode, mode=3'b011 indicates random point multiplication pipeline mode, mode=3'b100 indicates fixed point accelerated multiplication mode, mode=3'b101 indicates random point fixed point mixed pipeline mode;

[0047] h) Rj represents the number of queue tasks;

[0048] i) offset is the memory offset address;

[0049] Part 1: Input K, mode; Output NAF(K), NAF_ok, l;

[0050] S11, by default, l=n+1, NAF_ok=0, i=0; n represents the bit width of K;

[0051] S12, if mode≠3'b000; perform NAF encoding on K. k i∈ {0, ±1}:

[0052] S121. Let H = 3K, and its highest non - zero bit be the l - th bit, where l = m or l = m + 1; m represents the bit - width of the valid - value part of K.

[0053] S122. For 1 ≤ i ≤ l, calculate all k i-1 , in a repetitive or parallel execution manner:

[0054] If 1 ≤ i ≤ m - 1, k i-1 = H[i] - K[i];

[0055] If m ≤ i ≤ l, k i-1 = H[i];

[0056] According to the NAF coding principle, the encoded length l = m or l = m + 1, that is, the effective length may increase by 1 bit.

[0057] S13. Return NAF(K), l, NAF_ok = 1, marking the completion of NAF encoding.

[0058] The second part: Input P, l; output DQ, DQ_wen during the process; output offset at the end; if mode == 3'b100, this part is not executed.

[0059] S21. Let di = 0, DQ = P, issue the write - enable DQ_wen, and write DQ into the memory.

[0060] S22. Let di = 1:

[0061] S23. If di < l, repeat the execution:

[0062] S231. DQ = 2DQ; and issue the write - enable DQ_wen, and write DQ into the memory.

[0063] S232. di = di + 1

[0064] When the loop ends, P, 2P, …, 2 l-2 P, 2 l-1 P have been stored in the memory, and the extended calculation of the points is completed.

[0065] S24. End, return offset ≡ di.

[0066] The third part: Input DQ, NAF(K), NAF_ok, l, di; output Q; if mode == 3'b100, this part is not executed.

[0067] S31. Let Q = O, ai = 0;

[0068] S32. Based on the results of the first part k i ∈{0,±1}, scan the NAF(K) value from right to left, that is, start scanning from the leftmost k0 bit, and repeat:

[0069] S321, read DQ from memory, DQ = 2 ai P;

[0070] S322, if mode=3'b010, that is, when the second part and the third part are executed in parallel, keep waiting when ai≥di or NAF_ok≠1, otherwise proceed to the next step;

[0071] S323, if mode≠3'b010, that is, the second part is executed first, and then the third part is executed. If NAF_ok≠1, keep waiting, otherwise proceed to the next step;

[0072] S324, if k ai =1, then Q = Q + DQ;

[0073] S325, if k ai = -1, then Q = Q - DQ;

[0074] S326, ai=ai+1;

[0075] S327, if ai=1, exit the loop scan;

[0076] S33. Return to Q.

[0077] The present invention also provides a separate point multiplication hardware circuit, which includes:

[0078] Finite field operation layer module: provides finite field operation capabilities for the upper layer modules, including modular multiplication, modular addition and subtraction, modular inverse, and modular square operations, and provides corresponding finite field operation interfaces to the upper layer;

[0079] Point addition calculation control module: connected to the finite field operation layer module downward, controls the finite field calculation processes such as modular multiplication, modular addition and subtraction, modular square, etc. according to the point addition rule, and completes the addition / subtraction calculation of two points in the characteristic coordinate system; inputs the coordinates of the two points P1 and P2 in the coordinate system, and outputs the point coordinates Q=P1±P2;

[0080] Double point calculation control module: according to the double point rule, control the modular multiplication, modular addition and subtraction, modular square finite field calculation modules to complete the double point calculation in the characteristic coordinate system; input a point coordinate P in the coordinate system, and output the point coordinate Q=2P;

[0081] NAF encoding module: completes the operation of the first part, encodes a positive integer K into NAF(K), no two consecutive digits are non-zero, and the average number of non-zero digits is reduced; after the encoding is completed, outputs NAF(K) and length information l, and outputs the encoding completion signal NAF_ok;

[0082] Point expansion operation control module: complete the second part of the operation, continuously perform doubling operations, obtain the expansion results of the integer power of 2, and write them into the storage module; in the case of random point multiplication operations, the cumulative number of this continuous doubling process is l-1 times, and in the fixed point pre-calculation formula, the cumulative number of this continuous doubling process is n times, and the value of n is K bits wide;

[0083] Point accumulation operation control module: completes the operation of the third part, continuously performs point addition operations, and obtains iterations until the point multiplication calculation result is obtained;

[0084] Storage module: stores the calculation results of the point expansion calculation control module and is read by the point accumulation calculation control module;

[0085] Queue control module: used to control the task queue of the entry point accumulation operation control module. The queue information contains the location of the first extended data of each point in the memory. In the random point multiplication pipeline mode or the random point fixed point mixed pipeline mode, when the point expansion operation control module is completed, a new random point task is pushed into the queue. When the upper layer needs to perform a fixed point multiplication operation, a new fixed point task is pushed into the queue.

[0086] Point multiplication control module: according to the specific operation mode, control the state and process of point multiplication to complete the operation of the corresponding mode; the specific modes include fixed point preprocessing mode, random point point multiplication serial mode, random point point multiplication parallel mode, random point point multiplication pipeline mode, fixed point accelerated point multiplication mode, random point fixed point mixed pipeline mode.

[0087] (III) Beneficial effects

[0088] The present invention proposes a separated point multiplication method and hardware circuit. The present invention changes the structure of point doubling and point addition in the NAF expansion method, so that point addition and point doubling are executed in separate stages, thereby realizing point expansion and point accumulation control without interfering with each other. Based on this feature, multiple working modes are designed in combination with the ECC elliptic curve cryptography system. Among them, for the point multiplication calculation of fixed points (such as signature, public-private key pair generation), the point expansion calculation of the fixed point is completed in the pre-calculation stage first. When the actual business is running, only continuous point addition can be run in the fixed point accelerated point multiplication mode or the random point fixed point mixed pipeline mode, saving all the point doubling running time; for the point multiplication calculation of random points, in the parallel mode, the point expansion and point accumulation of the same point are executed in parallel, so as to obtain the minimum calculation delay. In the pipeline mode, the point expansion calculation and point accumulation calculation are divided into two timing lines for operation, and supplemented by the task queue mechanism, so that the idle time of the module is reduced, and the maximum average efficiency can be obtained.

[0089] Compared with the prior art, the present invention proposes a separate high-performance point multiplication method, which combines the application characteristics of the ECC elliptic curve cryptography system and provides 6 application modes. It has a wider and more flexible applicability and can achieve better performance under different hardware resource constraints. BRIEF DESCRIPTION OF THE DRAWINGS

[0090] Figure 1 A schematic diagram of three parts of the separated high-performance dot product method of the present invention;

[0091] Figure 2 This is a schematic diagram of the random point multiplication pattern;

[0092] Figure 3 This is the hardware circuit design diagram for the separated dot multiplication. DETAILED DESCRIPTION

[0093] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0094] The purpose of the present invention is to combine the characteristics of the actual application of the elliptic curve public key cryptography system, and propose a high-performance point multiplication calculation method and its hardware circuit implementation, which has multiple application modes and can be flexibly tailored for use. In scenarios with limited hardware logic resources or abundant hardware logic resources, the application performance of the ECC algorithm can be greatly improved.

[0095] The present invention proposes a separate high-performance point multiplication method. The correctness of this method is not limited to the type of finite field or the type of coordinate system adopted, that is, it can support binary extended field and prime field implementation, and the underlying coordinate system can be arbitrarily selected. The steps are shown in the following figure. Figure 1 .

[0096] (I) Description of the Separate High-Performance Point Product Method

[0097] A separate high-performance point multiplication method increases memory resources but basically does not increase logic resources compared to the traditional NAF expansion method. The method is divided into three parts, which changes the structure of alternating execution of doubling and point addition, so that point addition and doubling are executed in separate stages. According to actual needs, the three parts can be executed serially, in parallel or in a pipelined manner to further improve efficiency. The first part is the NAF coding operation, the continuous doubling calculation process of the second part is named point expansion calculation (calculating the integer power doubling point), and the continuous point addition / subtraction calculation process of the third part is named point accumulation calculation. A separate high-performance point multiplication method is specifically described as follows:

[0098] Description of relevant parameters:

[0099] a) n, m, l, r, i, di, ai are all positive integers;

[0100] b) P, DQ, Q are points on the elliptic curve;

[0101] c) K is an integer with a bit width of n, the highest non-zero bit of K is at the m-1th bit, and the i-th bit of K is denoted as K[i];

[0102] d) H is an integer with a bit width of n+2, and the i-th bit of H is denoted as H[i];

[0103] e)NAF(K) is the NAF code of K, and its i-th element is denoted by k i ,Right now k i ∈{0,±1};

[0104] f)NAF_ok, DQ_ok, AQ_ok, DQ_wrn are single-bit signals;

[0105] g) mode is a 3-bit wide binary number used for working mode selection, mode=3'b000 indicates fixed point preprocessing mode, mode=3'b001 indicates random point multiplication serial mode, mode=3'b010 indicates random point multiplication parallel mode, mode=3'b011 indicates random point multiplication pipeline mode, mode=3'b100 indicates fixed point accelerated multiplication mode, mode=3'b101 indicates random point fixed point mixed pipeline mode;

[0106] h) Rj represents the number of queue tasks.

[0107] i) offset is the memory offset address;

[0108] Note: 3'b in 3'b000 indicates that the data is in 3-bit wide binary format.

[0109]

[0110]

[0111]

[0112] In particular, in the second / third part above, l is taken to be the value of l output by the first part.

[0113] In particular, the cumulative number of consecutive doubling processes in the second part is l-1 times, and the cumulative number of consecutive dot addition processes in the third part is the number of non-zero bits in NAF(K), and the expected value is about n / 3.

[0114] In particular, in the serial mode, parallel mode, pipeline mode and random point fixed point mixed pipeline mode of random point multiplication, all three parts need to participate in the operation. When the method is implemented in hardware, the operation circuits of the first and second parts can be started at the same time, and in the parallel mode, all three parts can be started at the same time. Under normal design conditions, since the NAF encoding operation complexity of the first part is low, the time consumption is very small compared to the dot multiplication calculation, and it can be completed in a time range far less than 1 dot multiplication, which will not affect the operation of the second part, and can even be completed within 1 to 2 cycles, so that in the parallel mode, there will be no waiting delay of the third part caused by the NAF_ok signal.

[0115] In particular, when performing random point multiplication, it supports serial, parallel or pipeline mode operation. When running in parallel or pipeline mode, there is no need to change the operation process of each part, but the parallel or pipeline design requires sufficient underlying finite field operation logic resources. For example, in serial mode, only one modular multiplication circuit can be designed in the finite field operation layer for point addition and point doubling to be called in separate stages, but in parallel or pipeline mode, at least two finite field modular multiplication circuits are required so that modular multiplication can be called simultaneously for point addition and point doubling.

[0116] In particular, in the third part, if it is a random point multiplication parallel mode, since the third part and the second part will be executed in parallel, and the point expansion calculation process must be from low to high, the third part must also adopt a scanning method from low to high. However, in a non-random point multiplication parallel mode, the third part can adopt a scanning method from high to low, and according to the characteristic that the highest non-0 bit of NAF(K) must be 1, directly assign Q=2 at the beginning of the loop l- 1 P, reducing one point addition operation. Therefore, the third part in the non-random point multiplication parallel mode can be improved as follows:

[0117]

[0118] (II) Description of the separated high-performance point multiplication operation mode

[0119] A separate point multiplication method that supports pre-expansion acceleration is closely integrated with the actual ECC cryptographic system to provide flexible mode selection. The operation mode of the method is specifically described as follows:

[0120] (1) Preprocessing mode:

[0121] Only the second part is used, where the input l is the default value l = n + 1; in this mode, the point expansion operation of the fixed point P is completed, and P, 2P, ..., 2 l-2 P,2 l-1 P is written to the memory. The time of the preprocessing mode is expected to be n times.

[0122] In particular, preprocessing is generally performed directly when the ECC elliptic curve cryptography device is powered on, initialized, or the base point parameters are updated. During business calculations, it is only necessary to calculate the point multiplication in the fixed-point accelerated point multiplication mode, which greatly accelerates the algorithm operation process.

[0123] (2) Fixed point acceleration multiplication mode:

[0124] First start the first part, complete the NAF encoding, and get the l value; then start the third part, perform the point accumulation loop, and get the point multiplication value. The premise for this mode to operate correctly is: the integer power multiple of 2 of the fixed point P (P, 2P, ..., 2 l-2 P,2 l-1 P) already exists in the memory. The expected time delay of the fixed-point accelerated dot multiplication is n / 3 dot additions.

[0125] (3) Random Point Multiplication Serial Mode

[0126] like Figure 1 As shown in (a), the random point multiplication serial operation steps are as follows:

[0127] S51, when starting a random point multiplication operation, first start the operation of the first part and the second part at the same time;

[0128] S52, after the second part of the operation is completed, start the third part of the operation;

[0129] S53, after the third part of the operation is completed, the dot product result is obtained.

[0130] In the second and third parts of this process, they are executed serially. The method of time-sharing multiplexing the underlying finite field operation logic for dot addition and double dot multiplication can be adopted, thereby simplifying the logic scale of the underlying finite field operation layer. The average operation efficiency of this mode is the same as that of the traditional NAF extension method, and the expected operation time is (n - 1 dot multiplications + n / 3 dot additions).

[0131] (4) Random dot multiplication parallel mode:

[0132] As Figure 1 shown in (b), the steps of random dot multiplication parallel operation are as follows:

[0133] S61. When starting a random dot multiplication operation, first start the operations of the first part and the second part simultaneously. Among them, the first part needs to complete the NAF(K) encoding before or at the same time as the first double dot calculation of the second part. The second part keeps the dot expansion iteration until di = l.

[0134] S62. The third part is also started simultaneously, but initially (ai = di = 0, NAF_ok ≠ 1), the third part is actually in a suspended waiting state; until ai < di and NAF_ok = 1, enter the next step;

[0135] S63. In the third part, every time ai < di, a loop is triggered (triggering the loop does not necessarily trigger the dot addition / subtraction operation, but determines whether to perform the dot addition / subtraction according to the corresponding k ai value), and when ai ≥ di, it keeps waiting.

[0136] In this mode, dot expansion and dot accumulation are parallel. However, considering that the third part must run after the corresponding loop beat of the second part, its operation delay is slightly greater than (l - 1 double dot multiplications + 1 dot addition), and also greater than (1 double dot multiplication + n / 3 dot additions), but less than (l - 1 double dot multiplications + n / 3 dot additions).

[0137] (5) Random dot multiplication pipelined mode:

[0138] During continuous multiple random dot multiplication operations, the operations of the first and second parts are completely separated from the operation of the third part and run on two timing lines. The method of FIFO or circular shift marking is adopted to construct a task queue for dot accumulation calculation (the third part). The queue information includes the position of the first extended data of each dot in the memory, as well as the corresponding NAF(K) and l for each dot.

[0139] As Figure 1 shown in (c), the steps of random dot multiplication pipelined mode operation are as follows:

[0140] a) On the timing line of dot expansion:

[0141] S71, start the first and second part operations of the previous dot multiplication;

[0142] S72. After the "step one" of the previous dot multiplication is completed, the "step one" of the next dot multiplication is directly started, and the calculation results of the second part expansion of each point are cached in the memory.

[0143] S73, after the second part of each point is completed, a new task is pushed into the tail of the point accumulation calculation task queue;

[0144] b) On the point accumulation time series line,

[0145] S81, as long as there are tasks to be calculated in the task queue, the third part is started;

[0146] S82. After completing the third part of the point accumulation operation, the point multiplication result of the task is obtained.

[0147] In the random point multiplication pipeline mode, the latency of a single point operation is equal to that in the serial mode, which is approximately (l-1 doublings + n / 3 additions). However, in multiple consecutive random point multiplication operations, the pipeline mode further improves the time utilization efficiency compared to the parallel mode, and the average time consumption is the longer value between (l-1 doublings) and (n / 3 additions).

[0148] In the random point multiplication parallel mode, although the second part of the point expansion operation and the third part of the point accumulation operation can be parallelized, the following two factors should be taken into consideration:

[0149] The first factor is that in the second part, i.e., in each cycle, the dot multiplication is calculated once, while in each cycle of the third part, the dot addition under the control of the NAF(K) code is only calculated once on a non-zero bit, and the dot addition in the third part must be run one beat after the dot multiplication in the second part. This may cause the dot addition in the third part to be idle and waiting during the cycle.

[0150] The second factor: doubling a point is essentially a special case simplification of point addition (adding two identical points). Generally, no matter what coordinate system is used, doubling a point is less complex than point addition. In a typical binary expansion domain Jacobian weighted projective coordinate system, the complexity of point addition is (15 modular multiplications + 5 modular squares), while the complexity of doubling a point is (5 modular multiplications + 5 modular squares). This may result in a long idle wait after the second part of the point expansion loop ends before the third part ends.

[0151] In the process of multiple consecutive random point multiplication operations, the above two factors are completely avoided, so the theoretical efficiency is higher.

[0152] (6) Random point fixed point mixed flow mode description:

[0153] Considering that in actual elliptic cryptographic system applications, in the process of continuous point multiplication tasks, fixed points and random points are often issued in an uncertain order. If the mode is frequently switched during the processing, performance loss will occur. Therefore, designing an operation mode that supports a mixed pipeline of fixed points and random points can further improve the performance of the actual system. The specific method is that on the basis of the random point multiplication pipeline operation mode, when the application layer needs to perform a fixed point multiplication operation, a new task (including the location of the first extended data of the fixed point in the memory) can be immediately pushed into the task queue.

[0154] like Figure 1 As shown in (d), the operation steps of the random point fixed point mixed pipeline mode are as follows:

[0155] a) On the point-expanded timing line:

[0156] S91. For random point services, start the first and second part operations of the first point multiplication at the same time; for fixed point services, start the first part operation.

[0157] S92. After the previous dot multiplication S91 is completed, the next dot multiplication S91 is directly started, and the calculation results of the second part expansion of each point are cached in the memory.

[0158] S93, when the second part of the random points ends, a new task is pushed into the tail of the task queue, and when the first part of the fixed points ends, a new task is pushed into the task queue;

[0159] b) On the point accumulation time series line,

[0160] S101, as long as there are tasks to be calculated in the task queue, the third part is started;

[0161] S102, after completing the third part of the point accumulation operation, the point multiplication result of the task is obtained.

[0162] (III) Separate high-performance hardware circuit design

[0163] The present invention realizes a high-performance dot multiplication circuit based on a proposed separated high-performance dot multiplication method.

[0164] Figure 3 It is a schematic diagram of the main technical framework of the technical solution of the present invention. Figure 3 As shown, a high-performance dot multiplication hardware circuit proposed by the present invention mainly includes the following components:

[0165] (1): Finite field operation layer module: provides finite field operation capabilities for the upper layer module, including modular multiplication, modular addition and subtraction, modular inverse, and modular square operations, and provides the corresponding finite field operation interface to the upper layer. The method described in the present invention supports both prime fields and binary extension fields (polynomial basis, normal basis), and the specific design of the finite field operation layer is regarded as a limitation of the present invention.

[0166] (2): Point addition calculation control module: It is connected to the finite field operation layer module downwards, and controls the finite field calculation processes such as modular multiplication, modular addition and subtraction, and modular square according to the point addition rule to complete the addition / subtraction calculation of two points in the characteristic coordinate system. Input the coordinates of two points P1 and P2 in the coordinate system, and output the point coordinates Q = P1 ± P2.

[0167] (3): Double point calculation control module: According to the double point rule, control the finite field calculation modules such as modular multiplication, modular addition and subtraction, and modular square to complete the double point calculation in the characteristic coordinate system. Input a point coordinate P in the coordinate system, and output the point coordinate Q = 2P.

[0168] (4): NAF encoding module: completes the operation of the first part of the method of the present invention, encodes a positive integer K into NAF(K), no two consecutive digits are non-zero, and the average number of non-zero digits is reduced. After the encoding is completed, NAF(K) and length information l are output, and the encoding completion signal NAF_ok is output.

[0169] (5): Point expansion operation control module: completes the operation of the second part of the method of the present invention, continuously performs doubling operations, obtains the expansion results of the doubling of integer powers of 2, and writes them into the storage module. In the case of random point multiplication operations, the cumulative number of this continuous doubling process is l-1 times (l-1 is the highest non-zero bit of NAF(K)), and in the fixed point pre-calculation formula, the cumulative number of this continuous doubling process is n times (n is K bit width).

[0170] (6): Point accumulation operation control module: completes the operation of the third part of the present invention, continuously performs point addition operations, and obtains iterations until the point multiplication calculation result is obtained.

[0171] (7): Storage module: stores the calculation results of the point expansion calculation control module and is read by the point accumulation calculation control module.

[0172] (8): Queue control module: used to control the task queue entering the point accumulation operation control module. The queue information contains the location of the first extended data of each point in the memory. In the random point multiplication pipeline mode or the random point fixed point mixed pipeline mode, when the point expansion operation control module is completed, a new random point task is pushed into the queue; when the upper layer needs to perform a fixed point multiplication operation, a new fixed point task is pushed into the queue.

[0173] (9): Point multiplication control module: according to the specific operation mode, control the state and process of point multiplication and complete the operation of the corresponding mode. The specific modes include fixed point preprocessing mode, random point point multiplication serial mode, random point point multiplication parallel mode, random point point multiplication pipeline mode, fixed point accelerated point multiplication mode, random point fixed point mixed pipeline mode;

[0174] In particular, the separated high-performance dot multiplication method and hardware circuit described in the present invention support tailored design according to application requirements. For example, in actual applications, if the application scenario emphasizes low latency, you can consider deleting the random point multiplication serial mode, random point multiplication pipeline mode and random point fixed point mixed pipeline mode, and retain the random point multiplication parallel mode.

[0175] The key points of the present invention are:

[0176] The present invention changes the structure of point doubling and point addition in the NAF expansion method, so that point addition and point doubling are executed in separate stages, thereby realizing point expansion and point accumulation control without interfering with each other. Based on this feature, multiple working modes are designed in combination with the ECC elliptic curve cryptography system. Among them, for the point multiplication calculation of fixed points (such as signature, public-private key pair generation), the point expansion calculation of the fixed point is completed in the pre-calculation stage first. When the actual business is running, only continuous point addition can be run in the fixed point accelerated point multiplication mode or the random point fixed point mixed pipeline mode, saving all the point doubling running time; for the point multiplication calculation of random points, in the parallel mode, the point expansion and point accumulation of the same point are executed in parallel, which can obtain the minimum calculation delay. In the pipeline mode, the point expansion calculation and point accumulation calculation are divided into two timing lines for operation, and supplemented by the task queue mechanism, the idle time of the module is reduced, and the maximum average efficiency can be obtained.

[0177] Effects of the present invention:

[0178] Compared with the prior art, the present invention proposes a separate high-performance point multiplication method, which combines the application characteristics of the ECC elliptic curve cryptography system and provides 6 application modes. It has a wider and more flexible applicability and can achieve better performance under different hardware resource constraints.

[0179] The efficiency of point multiplication in Jacobian weighted projective coordinate system under binary expansion domain is analyzed. According to the evaluation that the point addition complexity is three times the point complexity, it can be found that:

[0180] (1) In the case where the finite field operation logic resources are limited and point addition and point doubling can only be performed serially, the method proposed by the present invention has a point multiplication clock consumption of (n / 3 times point addition) in the ECC signature process, which is much better than the traditional NAF extension method (l-1 times point doubling + n / 3 times point addition) and the Mentgomery extension method (n-1 times point doubling + n-1 times point addition). The point multiplication clock consumption of the ECC signature verification process is (l-1 times point doubling + 2n / 3 times point addition), which is much better than the traditional NAF extension method (2l-2 times point doubling + 2n / 3 times point addition) and the serial Mentgomery extension method (2n-2 times point doubling + 2n-2 times point addition).

[0181] (2) When the finite field operation logic resources allow point addition and point doubling to be performed in parallel, the method proposed by the present invention has a point multiplication clock consumption of (n / 3 point additions) in the ECC signature process, which is better than the Mentgomery extension method (n-1 point additions) performed in parallel. The point multiplication clock consumption of the ECC signature verification process (using a random point and fixed point mixed pipeline mode) is about (2n / 3 point additions), which is better than the Mentgomery extension method (2n-2 point additions) performed in parallel.

[0182] In addition, since in the separated high-performance point multiplication method proposed by the present invention, doubling and addition are executed in completely separate stages, the change of K value from 0 to 1 cannot be observed through power consumption, and the method has a certain ability to resist power consumption attacks, thus overcoming the power consumption attack defects in the traditional binary expansion method and the NAF expansion method.

[0183] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A separable point multiplication method, characterized in that: The method includes three parts. Among them, the first part is the NAF encoding operation, the continuous double-point calculation process of the second part is the point expansion calculation, and the continuous point addition / subtraction calculation process of the third part is the point accumulation calculation. Explanation of related parameters: a) n, m, l, r, i, di, ai are all positive integers; b) P, DQ, Q are points on the elliptic curve; c) K is an integer with a bit width of n. The highest non-zero bit of K is at the (m - 1)-th bit, and the i-th bit of K is denoted as K[i]; d) H is an integer with a bit width of n + 2. The i-th bit of H is denoted as H[i]; e)NAF(K) is the NAF code of K, and its i-th element is denoted by k i ,Right now k i ∈{0,±1}; f) NAF_ok, DQ_ok, AQ_ok, DQ_wen are single-bit signals; g) mode is a 3-bit binary number used for selecting the working mode. mode = 3'b000 represents the fixed-point preprocessing mode, mode = 3'b001 represents the random point multiplication serial mode, mode = 3'b010 represents the random point multiplication parallel mode, mode = 3'b011 represents the random point multiplication pipeline mode, mode = 3'b100 represents the fixed-point accelerated multiplication mode, mode = 3'b101 represents the random point fixed-point hybrid pipeline mode; h) Rj represents the number of queue tasks; i) offset is the memory offset address; The first part: Input K, mode; Output NAF(K), NAF_ok, l; S11. By default, let l = n + 1, NAF_ok = 0, i = 0; n represents the bit width of K; S12, if mode≠3'b000; perform NAF encoding on K. k i ∈{0,±1}: S121. Let H = 3K, and its highest non-zero bit is the l-th bit, l = m or l = m + 1; m represents the bit width of the valid value part of K; S122. For 1≤i≤l, calculate all k i-1 , using repeated or parallel execution: If 1 ≤ i ≤ m - 1, k i-1 = H[i] - K[i]; If m≤i≤l, k i-1 =H[i]; According to the NAF encoding principle, the encoded length l = m or l = m + 1, that is, the effective length may increase by 1 bit; S13. Return NAF(K), l, NAF_ok = 1, marking the completion of NAF encoding; The second part: Input P, l; During the process, output DQ, DQ_wen; At the end, output offset; If mode == 3'b100, this part is not executed; S21. Let di = 0, DQ = P, issue the write enable DQ_wen, and write DQ into the memory; S22. Let di = 1: S23. If di < l, repeat the execution: S231. DQ = 2DQ; And issue the write enable DQ_wen, and write DQ into the memory; S232. di = di + 1 At the end of the loop, P,2P,…,2 l-2 P,2 l-1 P, the expansion calculation of the point is completed; S24. End, return offset ≡ di; The third part: Input DQ, NAF(K), NAF_ok, l, di; Output Q; If mode == 3'b100, this part is not executed; S31. Let Q = O, ai = 0; S32. Based on the results of the first part k i ∈{0,±1}, scan the NAF(K) value from right to left, that is, start scanning from the leftmost j0 bit, and repeat: S321, read DQ from memory, DQ = 2 ai P; S322. If mode = 3'b010, that is, when the second part and the third part are executed in parallel, wait when ai ≥ di or NAF_ok ≠ 1, otherwise continue to the next step; S323. If mode ≠ 3'b010, that is, when the second part is executed first and then the third part, wait when NAF_ok ≠ 1, otherwise continue to the next step; S324, if k ai =1, then Q = Q + DQ; S325, if k ai = -1, then Q = Q - DQ; S326. ai = ai + 1; S327. If ai = l, exit the loop scanning; S33. Return Q.

2. The separable point product method according to claim 1, characterized in that: In the second and third parts, the value of l is the value of l output by the first part; the cumulative number of consecutive double - point processes in the second part is l - 1 times, and the cumulative number of consecutive point - addition processes in the third part is the number of non - zero bits in NAF(K), with an expected value of n / 3.

3. The separable point product method according to claim 1, characterized in that: The improvement in the third part in the non - random point multiplication parallel mode is as follows: Improved type of the third part, improvement when mode ≠ 3’b010: S41. Let Q = O and ai = 0; S42, read 2 from memory l-1 P, let Q = 2 l-1 P; let ai = l-1; since the highest non-zero bit of NAF(K) must be 1, assign the value directly, reducing one point addition operation: S43. Scan from left to right. If ai > 0, repeat according to the value of NAF(K): S431. ai = ai - 1 S432, read 2 from memory ai P S433, if k ai =1, then Q = Q + 2 ai P S434, if k ai = -1, then Q = Q-2 ai P S44. Return Q.

4. The separable point product method according to any one of claims 1 to 3, characterized in that: In preprocessing mode, only the second part is used, where the input l is the default value l = n + 1; in this mode, the point expansion operation of the fixed point P is completed, and P, 2P, ..., 2 l-2 P,2 l-1 P is written into the memory; the time expectation of the preprocessing mode is n times; the preprocessing is directly executed when the ECC elliptic curve cryptography device is powered on, initialized, or the base point parameters are updated.

5. The separable point product method according to claim 4, characterized in that: In the fixed point accelerated dot multiplication mode, the first part is started first, the NAF encoding is completed, and the l value is obtained; then the third part is started, the point accumulation loop is performed, and the dot multiplication value is obtained; the premise for the correct operation of this mode is: the integer power multiple of the fixed point P is P, 2P, ..., 2 l-2 P,2 l-1 P already exists in memory.

6. The separable point product method according to claim 4, characterized in that: The random point multiplication serial mode includes: S51. When starting a random point multiplication operation, first start the operations of the first and second parts simultaneously; S52. After the operation of the second part is completed, start the operation of the third part; S53. After the operation of the third part is completed, the point multiplication result is obtained; In this process, the second and third parts are executed serially, and the underlying finite - field operation logic of point addition and double - point is multiplexed in a time - sharing manner.

7. The separable point product method according to claim 4, characterized in that: The random point multiplication parallel mode includes: S61. When starting a random point multiplication operation, first start the operations of the first and second parts simultaneously, where the first part needs to complete the NAF(K) encoding before or at the same time as the first double - point calculation of the second part; the second part maintains point expansion iteration until di = l; S62. The third part is also started simultaneously, but initially ai = di = 0 and NAF_ok ≠ 1, and the third part is actually in a suspended waiting state; until ai < di and NAF_ok = 1, enter the next step; S63. In the third part, a loop is triggered every time ai < di, and waiting is maintained when ai ≥ di.

8. The separable dot product method according to claim 4, characterized in that: The random point multiplication pipelined mode includes: During continuous multiple random point multiplication operations, the operations of the first and second parts are completely separated from the operation of the third part onto two timing lines. By using the method of FIFO or circular shift marking, a task queue for point accumulation calculation is constructed. The queue information includes the position of the first extended data of each point in the memory, as well as the corresponding NAF(K) and l for each point; On the timing line of point expansion: S71. Start the operations of the first and second parts of the previous point multiplication; S72. Directly start the "step one" of the next point multiplication after the "step one" of the previous point multiplication ends. The operation results of the second - part expansion of each point are cached in the memory; S73. After the second part of each point ends, a new task is pushed into the tail of the point accumulation calculation task queue; On the point accumulation timing line, S81. As long as there are tasks to be operated in the task queue, start the third part; S82. After completing the point accumulation operation of the third part, the point multiplication result of this task is obtained.

9. The separable dot product method according to claim 4, characterized in that: The random - point fixed - point hybrid pipelined mode includes: On the timing line of point expansion: S91. For random - point services, start the operations of the first and second parts of the first point multiplication simultaneously; for fixed - point services, start the operation of the first part; S92, directly starting S91 of the next dot multiplication after the previous dot multiplication S91 is completed, and the calculation result of the second part expansion of each dot is cached in the memory; S93, when the second part of the random points ends, a new task is pushed into the tail of the task queue, and when the first part of the fixed points ends, a new task is pushed into the task queue; On the point accumulation time series line: S101, as long as there are tasks to be calculated in the task queue, the third part is started; S102, after completing the third part of the point accumulation operation, the point multiplication result of the task is obtained.

10. A separate dot product hardware circuit for implementing the method according to any one of claims 1 to 9, characterized in that: The hardware circuit includes: Finite field operation layer module: provides finite field operation capabilities for the upper layer modules, including modular multiplication, modular addition and subtraction, modular inverse, and modular square operations, and provides corresponding finite field operation interfaces to the upper layer; Point addition calculation control module: connected to the finite field operation layer module downward, controls the finite field calculation processes such as modular multiplication, modular addition and subtraction, modular square, etc. according to the point addition rule, and completes the addition / subtraction calculation of two points in the characteristic coordinate system; inputs the coordinates of the two points P1 and P2 in the coordinate system, and outputs the point coordinates Q=P1±P2; Double point calculation control module: according to the double point rule, control the modular multiplication, modular addition and subtraction, modular square finite field calculation modules to complete the double point calculation in the characteristic coordinate system; input a point coordinate P in the coordinate system, and output the point coordinate Q=2P; NAF encoding module: completes the operation of the first part, encodes a positive integer K into NAF(K), no two consecutive digits are non-zero, and the average number of non-zero digits is reduced; after the encoding is completed, outputs NAF(K) and length information l, and outputs the encoding completion signal NAF_ok; Point expansion operation control module: complete the second part of the operation, continuously perform doubling operations, obtain the expansion results of the integer power of 2, and write them into the storage module; in the case of random point multiplication operations, the cumulative number of this continuous doubling process is l-1 times, and in the fixed point pre-calculation formula, the cumulative number of this continuous doubling process is n times, and the value of n is K bits wide; Point accumulation operation control module: completes the operation of the third part, continuously performs point addition operations, and obtains iterations until the point multiplication calculation result is obtained; Storage module: stores the calculation results of the point expansion calculation control module and is read by the point accumulation calculation control module; Queue control module: used to control the task queue of the entry point accumulation operation control module. The queue information contains the location of the first extended data of each point in the memory. In the random point multiplication pipeline mode or the random point fixed point mixed pipeline mode, when the point expansion operation control module is completed, a new random point task is pushed into the queue. When the upper layer needs to perform a fixed point multiplication operation, a new fixed point task is pushed into the queue. Point multiplication control module: according to the specific operation mode, control the state and process of point multiplication to complete the operation of the corresponding mode; the specific modes include fixed point preprocessing mode, random point point multiplication serial mode, random point point multiplication parallel mode, random point point multiplication pipeline mode, fixed point accelerated point multiplication mode, random point fixed point mixed pipeline mode.

Images