A method and hardware circuit for separating point multiplication

Abstract

The present application relates to a kind of separate point multiplication method and hardware circuit, belong to cryptography field.The method of the present application includes: three parts;Wherein, the first part is NAF encoding operation, the continuous point multiplication calculation process of second part is point expansion calculation, the continuous point addition / subtraction calculation process of third part is point accumulation calculation.The method of the present application includes: fixed point preprocessing mode, random point point multiplication serial mode, random point point multiplication parallel mode, random point point multiplication pipelined mode, fixed point acceleration point multiplication mode, random point fixed point mixed pipelined mode.The present application combines the application characteristics of ECC elliptic curve cryptosystem, provides six application modes, with more extensive and more flexible application effect, can obtain better performance under the constraint of different hardware resources.

Description

Technical Field

[0001] This invention belongs to the field of cryptography technology, specifically relating to a separate dot product method and hardware circuit. Background Technology

[0002] The dot product operation on an elliptic curve is represented as: Q = P + P + ... + P + P = KP, where Q and P are points on the elliptic curve, and K is a positive integer. The dot product operation is the core of elliptic curve cryptography. Commonly used dot product design methods include binary expansion, NAF expansion, and Mentgomery expansion.

[0003] (1) Binary expansion method

[0004] The direct binary expansion method is the most intuitive way to perform dot product operations. The binary expansion of K is K = (k n-1 ,k n-2 ,…,k1,k0),k i ∈{0,1}. The principle of binary expansion is as follows:

[0005] Q = KP = (k n-1 2 n-1 +k n-2 2 n-2 +…+k12 1 +k02 0 )P

[0006] =(((k) n-1 P)2+k n-2 P)2+k n-3 P)2+…+k1P)2+k0P

[0007] The steps for implementing the direct binary expansion method are as follows:

[0008] Step 1: Let Q = ∞, that is, the point at infinity; at the same time, start scanning from the highest bit n-1 of K until a non-zero bit is encountered (defined as the (m-1)th bit), at which point i = m-1.

[0009] Step 2: As i decreases from m-1 to 0, repeat the process:

[0010] a) Q = 2Q

[0011] b) If k i =1, then Q = Q + P

[0012] Step 3: Return to Q.

[0013] Since the selection of K is random or pseudo-random, the expected number of 1s in the binary representation of K is n / 2. Evaluating with m=n, the expected runtime of this method is approximately n / 2 point sums plus n times the point multiplier.

[0014] (2) NAF expansion method

[0015] Based on the general binary expansion method, and considering that addition and subtraction at points on an elliptic curve have the same execution efficiency and that the execution circuit can be reused, a non-adjacent representation method is adopted to encode K. After encoding... k i ∈{0,±1}. The NAF expansion method reduces the number of non-zero bits (i.e., ±1), thereby reducing the number of times the dot product is performed when decomposing it into dot addition and dot multiplication.

[0016] The steps for implementing the NAF expansion method are as follows:

[0017] Step 1: Perform NAF encoding on K. According to the NAF encoding principle, the length of the encoded K may increase by 1 bit.

[0018] Step 2: Let Q = ∞, that is, the point at infinity;

[0019] Step 3: i decreases from l-1 to 0, and the process is repeated:

[0020] a) Q = 2Q

[0021] b) If k i =1, then Q = Q + P

[0022] c) If k i =-1, then Q=QP

[0023] Step 4: Return to Q.

[0024] according to The evaluation showed that when using the NAF expansion method to calculate the dot product, the expected number of non-zero bits ±1 in the binary representation of NAF(K) is n / 3. Compared with the direct binary expansion method, it adds a NAF encoding step, but the hardware cost and clock consumption of NAF encoding are very low and can be ignored. Overall, it reduces the time consumption of n / 6 dot addition operations.

[0025] (3) Montgomery expansion method

[0026] The Montgomery expansion method is also widely used to calculate dot products, and its steps are as follows:

[0027] Step 1: P1 = P, P2 = 2P; At the same time, start scanning from the highest bit of K until a non-zero bit is encountered (defined as the (m-1)th bit), at which point i = m-1.

[0028] Step 2: Let Q = ∞, that is, the point at infinity;

[0029] Step 3: As i decreases from m-1 to 0, repeat the process:

[0030] a) If k i =1, then P1 = P1 + P2, P2 = 2P2

[0031] b) If k i =1, then P2 = P1 + P2, P1 = 2P1

[0032] Step 4: Return Q = P1.

[0033] Assuming m=n, the Montgomery expansion method requires n point additions and n point multiplications. However, these point additions and multiplications can be performed in parallel, so its clock consumption is approximately the larger of the time values ​​for n point multiplications or n point additions (generally, in affine coordinates, the two are comparable), and overall, it is less than the first two methods. Furthermore, in a binary extended field, the point addition and multiplication calculations in the Montgomery expansion method and the LD (Lopez-Dahab) coordinate system can be simplified.

[0034] Traditional binary expansion is the most intuitive method, but it doesn't consider encoding the K value to reduce the number of dot additions, resulting in lower performance. NAF expansion, on the other hand, uses NAF encoding for the K value, effectively reducing the number of dot additions and offering an improvement over binary expansion. A common drawback of both binary and NAF expansion is that dot addition and doubling are performed sequentially and alternately, without the ability to improve performance by parallelizing them. In each loop, the number of dot additions and doublings depends on the K value. i Choosing whether to perform point addition is vulnerable to power consumption attacks in hardware implementation. In the Montgomery expansion method, point addition and doubling are performed in each iteration, and its computational speed is unaffected by the value of K. It can be executed in parallel, resists power consumption attacks, and can achieve higher performance by combining it with the LD coordinate system in binary extended fields. However, its performance in prime fields is still lower than the NAF method. Furthermore, none of these three methods incorporate the characteristics of real-world ECC applications to improve performance. Summary of the Invention

[0035] (a) Technical problems to be solved

[0036] The technical problem to be solved by this invention is how to provide a separate dot product method and hardware circuit to address the issue that none of the three methods incorporate the characteristics of actual ECC applications to improve performance.

[0037] (II) Technical Solution

[0038] To address the aforementioned technical problems, this invention proposes a separate dot multiplication method, which comprises three parts: the first part is NAF encoding operation, the second part is a dot expansion calculation for continuous dot multiplication, and the third part is a dot accumulation calculation for continuous dot addition / subtraction.

[0039] Explanation of relevant parameters:

[0040] a) n, m, l, r, i, di, ai are all positive integers;

[0041] b) P, DQ, and Q are points on the elliptic curve;

[0042] c) K is an integer with a bit width of n. The highest non-zero bit of K is in the (m-1)th bit. The i-th bit of K is denoted as K[i].

[0043] d) H is an integer with a bit width of n+2, and the i-th bit of H is denoted as H[i];

[0044] e) NAF(K) is the NAF code of K, where the i-th element is denoted as k. i ,Right now k i ∈{0,±1};

[0045] f) NAF_ok, DQ_ok, AQ_ok, and DQ_wen are single-bit signals;

[0046] g) mode is a 3-bit wide binary number used to select the working mode. mode = 3'b000 indicates fixed-point preprocessing mode, mode = 3'b001 indicates random-point multiplication serial mode, mode = 3'b010 indicates random-point multiplication parallel mode, mode = 3'b011 indicates random-point multiplication pipelined mode, mode = 3'b100 indicates fixed-point accelerated multiplication mode, and mode = 3'b101 indicates random-point and fixed-point hybrid pipelined mode.

[0047] h)Rj represents the number of tasks in the queue;

[0048] i) offset is the memory offset address;

[0049] Part 1: Input K, mode; Output NAF(K), NAF_ok, l;

[0050] S11, by default, l = n + 1, NAF_ok = 0, i = 0; n represents the bit width of K;

[0051] S12. If mode ≠ 3'b000; perform NAF encoding on K, and the encoded result is... k i∈ {0, ±1}:

[0052] S121. Let H = 3K, and its highest non - zero bit be the l - th bit, where l = m or l = m + 1; m represents the bit - width of the valid value part of K.

[0053] S122. For 1 ≤ i ≤ l, calculate all k i-1 , in a repetitive or parallel execution manner:

[0054] If 1 ≤ i ≤ m - 1, k i-1 = H[i] - K[i];

[0055] If m ≤ i ≤ l, k i-1 = H[i];

[0056] According to the NAF coding principle, the encoded length l = m or l = m + 1, that is, the effective length may increase by 1 bit.

[0057] S13. Return NAF(K), l, NAF_ok = 1, marking the completion of NAF encoding.

[0058] The second part: Input P, l; during the process, output DQ, DQ_wen; at the end, output offset; if mode == 3'b100, this part is not executed.

[0059] S21. Let di = 0, DQ = P, send the write enable DQ_wen, and write DQ into the memory.

[0060] S22. Let di = 1:

[0061] S23. If di < l, repeat the execution:

[0062] S231. DQ = 2DQ; and send the write enable DQ_wen, and write DQ into the memory.

[0063] S232. di = di + 1

[0064] When the loop ends, P, 2P,..., 2 l-2 P, 2 l-1 P have been stored in the memory, and the extended calculation of the points is completed.

[0065] S24. End, return offset ≡ di;

[0066] The third part: Input DQ, NAF(K), NAF_ok, l, di; output Q; if mode == 3'b100, this part is not executed.

[0067] S31. Let Q = O, ai = 0;

[0068] S32, based on the results of Part One k i For each ∈{0,±1}, scan the NAF(K) value from right to left, starting from the leftmost k0 bit, and repeat the process:

[0069] S321. Read DQ from memory, DQ = 2 ai P;

[0070] S322. If mode = 3'b010, that is, when the second and third parts are executed in parallel, wait when ai≥di or NAF_ok≠1, otherwise continue to the next step;

[0071] S323. If mode ≠ 3'b010, that is, when the second part is executed first and the third part is executed later, if NAF_ok ≠ 1, wait; otherwise, continue to the next step.

[0072] S324, if k ai =1, then Q = Q + DQ;

[0073] S325, if k ai =-1, then Q = Q - DQ;

[0074] S326, ai = ai + 1;

[0075] S327. If ai = 1, exit the loop scan;

[0076] S33, Return to Q.

[0077] The present invention also provides a discrete dot product hardware circuit, the hardware circuit comprising:

[0078] Finite field operation layer module: Provides finite field operation capabilities to upper-layer modules, including modular multiplication, modular addition and subtraction modules, modular inverse, and modular squaring operations, and provides corresponding finite field operation interfaces to the upper layer;

[0079] Point addition calculation control module: Connects downwards to the finite field operation layer module. According to the point addition rules, it controls the finite field calculation process such as modular multiplication, modular addition and subtraction, and modular squaring to complete the addition / subtraction calculation of two points in a specific coordinate system. Input the coordinates of two points P1 and P2 in this coordinate system, and output the point coordinates Q = P1 ± P2.

[0080] The doubling point calculation control module controls the modular multiplication, modular addition and subtraction, and modular square finite field calculation modules according to the doubling point rules to complete the 2-point calculation in the characteristic coordinate system; input a point coordinate P in this coordinate system, and output the point coordinate Q = 2P;

[0081] NAF encoding module: Completes the first part of the operation, encodes a positive integer K into NAF(K), where no two consecutive digits are non-zero, and the average number of non-zero digits will decrease; after completing the encoding, outputs NAF(K) and length information l, and outputs the encoding completion signal NAF_ok.

[0082] Point expansion operation control module: Completes the second part of the operation, continuously performs point multiplication operations, obtains the expanded result of integer powers of 2, and writes it into the storage module; in random point multiplication operations, this continuous point multiplication process is accumulated to l-1 times, and in the fixed point pre-calculation formula, this continuous point multiplication process is accumulated to n times, where n is a K-bit width;

[0083] Dot accumulation operation control module: completes the operation in the third part, continuously performs dot addition operations, and iterates until the dot multiplication result is obtained;

[0084] Storage module: Stores the calculation results of the point extension calculation control module, and is read by the point accumulation calculation control module;

[0085] Queue control module: Used to control the task queue entering the point accumulation operation control module. The queue information includes the location of the first extended data of each point in the memory. In the random point multiplication pipeline mode or the random point fixed point hybrid pipeline mode, when the point extension operation control module is completed, a new random point task is pushed into the queue. When the upper layer needs to perform fixed point multiplication operation, a new fixed point task is pushed into the queue.

[0086] Dot product control module: According to the specific operation mode, it controls the state and process of dot product to complete the operation of the corresponding mode; the specific modes include fixed point preprocessing mode, random point serial dot product mode, random point parallel dot product mode, random point pipeline mode, fixed point accelerated dot product mode, and random point and fixed point hybrid pipeline mode.

[0087] (III) Beneficial Effects

[0088] This invention proposes a separate dot product method and hardware circuit. It changes the alternating execution of doubling and addition in the NAF expansion method, allowing doubling and addition to be executed in separate stages, thus achieving independent control of dot expansion and dot accumulation. Based on this feature, multiple working modes are designed in conjunction with ECC elliptic curve cryptography. For fixed-point dot product calculations (such as signature and public-private key pair generation), the fixed-point dot expansion calculation is completed in the pre-computation stage. During actual business operation, only continuous addition can be run in either the fixed-point accelerated dot product mode or the random-point / fixed-point hybrid pipelined mode, saving all doubling execution time. For random-point dot product calculations, in parallel mode, dot expansion and dot accumulation of the same point are executed in parallel to achieve minimal computational latency. In pipelined mode, dot expansion and dot accumulation calculations are separated into two timelines and supplemented by a task queue mechanism to reduce module idle time and achieve maximum average efficiency.

[0089] Compared with existing technologies, the proposed high-performance dot product method is a separate approach that combines the application characteristics of ECC elliptic curve cryptography. It provides six application modes, has a wider range of applications and more flexible applicability, and can achieve better performance under different hardware resource constraints. Attached Figure Description

[0090] Figure 1 This is a schematic diagram of the three parts of the separate high-performance dot product method of the present invention;

[0091] Figure 2 A schematic diagram of a random dot product pattern;

[0092] Figure 3 This is the hardware circuit design diagram for a split dot product. Detailed Implementation

[0093] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0094] The purpose of this invention is to propose a high-performance dot product calculation method and its hardware circuit implementation, taking into account the characteristics of elliptic curve public key cryptography in practical applications. It has multiple application modes and can be flexibly adapted for use. It can significantly improve the application performance of the ECC algorithm in scenarios with limited or abundant hardware logic resources.

[0095] This invention proposes a separate high-performance dot product method. The correctness of this method is not limited by the type of finite field or the type of coordinate system used, that is, it can support binary extended field and prime field implementations. The underlying coordinate system can be arbitrarily chosen. The step flow is illustrated as follows: Figure 1 .

[0096] (I) Explanation of the separate high-performance dot product method

[0097] A separate high-performance dot multiplication method, compared to the traditional NAF extension method, increases memory resources but adds virtually no logic resources. This method consists of three parts, changing the alternating structure of doubling and addition, allowing doubling and addition to be executed separately. Depending on actual needs, the three parts can be executed serially, in parallel, or in a pipelined manner, further improving efficiency. The first part is the NAF encoding operation. The continuous doubling calculation process in the second part is named dot extension calculation (calculating integer powers of 2). The continuous addition / subtraction calculation process in the third part is named dot accumulation calculation. A detailed description of this separate high-performance dot multiplication method is as follows:

[0098] Explanation of relevant parameters:

[0099] a) n, m, l, r, i, di, ai are all positive integers;

[0100] b) P, DQ, and Q are points on the elliptic curve;

[0101] c) K is an integer with a bit width of n. The highest non-zero bit of K is in the (m-1)th bit. The i-th bit of K is denoted as K[i].

[0102] d) H is an integer with a bit width of n+2, and the i-th bit of H is denoted as H[i];

[0103] e) NAF(K) is the NAF code of K, where the i-th element is denoted as k. i ,Right now k i ∈{0,±1};

[0104] f) NAF_ok, DQ_ok, AQ_ok, and DQ_wrn are single-bit signals;

[0105] g) mode is a 3-bit wide binary number used to select the working mode. mode = 3'b000 indicates fixed-point preprocessing mode, mode = 3'b001 indicates random-point multiplication serial mode, mode = 3'b010 indicates random-point multiplication parallel mode, mode = 3'b011 indicates random-point multiplication pipelined mode, mode = 3'b100 indicates fixed-point accelerated multiplication mode, and mode = 3'b101 indicates random-point and fixed-point hybrid pipelined mode.

[0106] h)Rj represents the number of tasks in the queue.

[0107] i) offset is the memory offset address;

[0108] Note: In 3'b000, 3'b indicates that the data is in 3-bit wide binary format.

[0109]

[0110]

[0111]

[0112] Specifically, in the second / third part above, l takes the value of l output in the first part.

[0113] Specifically, the second part of the continuous doubling process accumulates to l-1 times, and the third part of the continuous doubling process accumulates to the number of non-zero bits in NAF(K), with an expected value of approximately n / 3.

[0114] Specifically, in the serial, parallel, pipelined, and mixed random-point / fixed-point pipelined modes of random-point multiplication, all three parts need to participate in the computation. In the hardware implementation of this method, the computation circuits of the first and second parts can be started simultaneously. In parallel mode, all three parts can be started simultaneously. Typically, in design scenarios, because the NAF encoding computation of the first part has low computational complexity and consumes very little time compared to doubling calculations, it can be completed in a time range far less than one doubling operation, without affecting the computation of the second part. It can even be completed within 1 to 2 cycles, thus preventing the waiting delay of the third part caused by the NAF_ok signal in parallel mode.

[0115] Specifically, random point multiplication supports serial, parallel, or pipelined operation modes. Parallel or pipelined operation does not require changes to the computational processes of individual parts, but the design of parallel or pipelined operations requires sufficient underlying finite field computational logic resources. For example, in serial mode, only one modular multiplication circuit can be designed in the finite field computation layer for point addition and doubling to be called in separate stages, but parallel or pipelined mode requires at least two finite field modular multiplication circuits to call modular multiplication simultaneously for point addition and doubling.

[0116] Specifically, in the third part, if it's a random dot-multiplication parallel mode, since the third and second parts will execute in parallel, and the dot expansion calculation must proceed from low to high bits, the third part must also adopt a low-to-high bit scanning method. However, in a non-random dot-multiplication parallel mode, the third part can adopt a high-to-low bit scanning method, and based on the characteristic that the highest non-zero bit of NAF(K) must be 1, Q = 2 can be directly assigned at the beginning of the loop. l- 1 P, reducing one dot addition operation. Therefore, the third part in the non-random dot multiplication parallel mode can be improved as follows:

[0117]

[0118] (II) Explanation of the Separate High-Performance Point-Based Operation Mode

[0119] A pre-expansion accelerated split-multiplication method is tightly integrated with practical ECC cryptosystems, providing flexible mode selection. The specific operation modes of the method are described below:

[0120] (1) Preprocessing mode:

[0121] Only the second part is used, where the input l is the default value l = n + 1; in this mode, the point expansion operation of the fixed point P is completed, and P, 2P, ..., 2 l-2 P,2 l-1 P is written to memory. The expected time for the preprocessing mode is n times the point value.

[0122] In particular, preprocessing is generally performed directly when the ECC elliptic curve cryptographic device is powered on, initialized, or when the base point parameters are updated. During business computation, the dot product only needs to be calculated in the fixed-point accelerated dot product mode, which greatly speeds up the algorithm operation process.

[0123] (2) Fixed-point accelerated product mode:

[0124] First, the first part is started to complete NAF encoding and obtain the l value; then the third part is started to perform a dot accumulation loop to obtain the dot product value. This mode can only operate correctly if: the fixed point P is a power of 2 (P, 2P, ..., 2P). l-2 P,2 l-1 P) already exists in memory. The expected time delay for fixed-point accelerated multiplication is n / 3 times the number of additions.

[0125] (3) Random dot product serial mode

[0126] like Figure 1 As shown in (a), the serial execution steps of random point multiplication are as follows:

[0127] S51. When starting a random dot multiplication operation, start the first part and the second part of the operation simultaneously.

[0128] S52. After the second part of the calculation is completed, start the third part of the calculation;

[0129] S53. After the third part of the operation is completed, the dot product result is obtained.

[0130] In the second and third parts of this process, they are executed serially. The underlying finite field operation logic can be time-division multiplexed for dot addition and double dot operations, thus simplifying the logic scale of the underlying finite field operation layer. The average operation efficiency of this mode is the same as that of the traditional NAF expansion method, and the expected operation time is (n - 1 dot multiplications + n / 3 dot additions).

[0131] (4) Random dot multiplication parallel mode:

[0132] As Figure 1 shown in (b), the steps of random dot multiplication parallel operation are as follows:

[0133] S61. When starting a random dot multiplication operation, first start the operations of the first and second parts simultaneously. In the first part, the NAF(K) encoding needs to be completed before or at the same time as the first double dot calculation in the second part. The second part keeps the dot expansion iteration until di = l.

[0134] S62. The third part is also started simultaneously, but initially (ai = di = 0, NAF_ok ≠ 1), the third part is actually in a suspended waiting state; until ai < di and NAF_ok = 1, it enters the next step;

[0135] S63. In the third part, every time ai < di, a loop is triggered (triggering the loop does not necessarily trigger dot addition / subtraction operations, but determines whether to perform dot addition / subtraction according to the corresponding k ai value), and when ai ≥ di, it keeps waiting.

[0136] In this mode, dot expansion and dot accumulation are parallel. However, considering that the third part must run after the corresponding loop beats of the second part, its operation delay is slightly greater than (l - 1 double dot operations + 1 dot addition), and also greater than (1 double dot operation + n / 3 dot additions), but less than (l - 1 double dot operations + n / 3 dot additions).

[0137] (5) Random dot multiplication pipelined mode:

[0138] During continuous multiple random dot multiplication operations, the operations of the first and second parts are completely separated from the operations of the third part and run on two timing lines. By adopting methods such as FIFO or circular shift marking, a task queue for pending dot accumulation calculation (the third part) is constructed. The queue information includes the position of the first extended data of each dot in the memory, as well as the corresponding NAF(K) and l for each dot.

[0139] As Figure 1 shown in (c), the steps of random dot multiplication pipelined mode operation are as follows:

[0140] a) On the timing line of dot expansion:

[0141] S71. Initiate the first and second parts of the previous dot product operation;

[0142] S72. After the "Step 1" of the previous dot product is completed, the "Step 1" of the next dot product is started directly. The results of the second part of the extended operation of each dot product are cached in memory.

[0143] S73. After the second part of each point is completed, a new task is pushed to the tail of the point accumulation calculation task queue.

[0144] b) On the point-accumulation timeline

[0145] S81. As long as there are tasks to be processed in the task queue, the third part will be started.

[0146] S82. After completing the dot summation operation in the third part, the dot product result of this task is obtained.

[0147] In pipelined random point multiplication mode, the latency of a single point operation is equal to that in serial mode, approximately (l-1 point multiplications + n / 3 point additions). However, in multiple consecutive random point multiplication operations, pipelined mode further improves time utilization efficiency compared to parallel mode, with the average time consumption being the longer of (l-1 point multiplications) and (n / 3 point additions).

[0148] Although the second part of the point expansion operation and the third part of the point accumulation operation can be performed in parallel in the parallel mode of random point multiplication, the following two factors should be considered:

[0149] The first factor is that in the second part, the dot multiplication is performed once in each loop, while in the third part, the dot addition under NAF(K) code control is only performed once on non-zero bits, and the dot addition in the third part must be performed one clock cycle after the dot multiplication in the second part. This may result in the dot addition in the third part being idle and waiting during the loop process.

[0150] The second factor is that doubling the point is essentially a simplification of a specific case of point addition (adding two identical points). Generally, regardless of the coordinate system used, doubling the point has lower complexity than point addition. In a typical binary extended field Jacobian weighted projective coordinate system, the complexity of point addition is (15 modular multiplications + 5 modular squares), while the complexity of doubling the point is (5 modular multiplications + 5 modular squares). This might result in a relatively long idle waiting period after the second part of the point expansion loop ends, before the third part concludes.

[0151] In the process of multiplying multiple random points in succession, the two factors mentioned above are completely avoided, so the theoretical efficiency is higher.

[0152] (6) Description of the mixed flow pattern of random and fixed points:

[0153] In practical applications of elliptic cryptography, fixed and random points are often distributed in an uncertain order during continuous dot product operations. Frequent switching between modes during processing will lead to performance degradation. Therefore, designing a pipelined operation mode that supports a mixture of fixed and random points can further improve the performance of the practical system. Specifically, based on the pipelined random dot product operation mode, when the application layer needs to perform a fixed dot product operation, a new task (containing the location of the first extended data of that fixed point in memory) can be immediately pushed into the task queue.

[0154] like Figure 1 As shown in (d), the operation steps of the random point fixed point hybrid flow mode are as follows:

[0155] a) On the timeline of point extension:

[0156] S91. For random point services, start the first and second parts of the first point multiplication operation simultaneously; for fixed point services, start the first part operation.

[0157] S92. After the previous S91 dot product is completed, the next S91 dot product is started directly. The result of the second part of the extended operation of each dot is cached in memory.

[0158] S93. When the second part of the random point ends, a new task is pushed to the end of the task queue; when the first part of the fixed point ends, a new task is pushed to the task queue.

[0159] b) On the point-accumulation timeline

[0160] S101. As long as there are tasks to be processed in the task queue, the third part will be started.

[0161] S102. After completing the dot summation operation in the third part, the dot product result of this task is obtained.

[0162] (III) Decoupled high-performance hardware circuit design

[0163] This invention implements a high-performance dot product circuit based on a proposed separate high-performance dot product method.

[0164] Figure 3 This is a schematic diagram of the main technical framework of the technical solution of this invention. For example... Figure 3 As shown, the high-performance dot product hardware circuit proposed in this invention mainly includes the following components:

[0165] (1): Finite field operation layer module: Provides finite field operation capabilities to the upper-layer modules, including modular multiplication, modular addition and subtraction modules, modular inverse, and modular squaring operations, and provides corresponding finite field operation interfaces to the upper layer. The method described in this invention supports both prime fields and binary extended fields (polynomial basis, normal basis), and the specific design of the finite field operation layer is considered a limitation of this invention.

[0166] (2): Point addition calculation control module: Connected downwards to the finite field operation layer module, it controls the finite field calculation process such as modular multiplication, modular addition and subtraction, and modular squaring according to the point addition rules, and completes the addition / subtraction calculation of two points in the characteristic coordinate system. Input the coordinates of two points P1 and P2 in this coordinate system, and output the point coordinates Q = P1 ± P2.

[0167] (3): Double-point calculation control module: According to the double-point rule, it controls the finite field calculation modules such as modular multiplication, modular addition and subtraction, and modular squaring to complete the double-point calculation in the characteristic coordinate system. Input the coordinates P of a point in this coordinate system, and output the coordinates Q = 2P.

[0168] (4): NAF encoding module: Completes the operation of the first part of the method described in this invention, encodes a positive integer K into NAF(K), where no two consecutive digits are non-zero, and the average number of non-zero digits decreases. After encoding, outputs NAF(K) and length information l, and outputs the encoding completion signal NAF_ok.

[0169] (5): Point expansion operation control module: Completes the operation of the second part of the method described in this invention, continuously performs point multiplication operations, obtains the expanded result of integer powers of 2, and writes it into the storage module. In random point multiplication operations, this continuous point multiplication process is accumulated to l-1 times (l-1 is the highest non-zero bit of NAF(K)), and in the fixed-point pre-calculation formula, this continuous point multiplication process is accumulated to n times (n is the width of K bits).

[0170] (6): Point accumulation operation control module: completes the operation of the third part of the present invention, continuously performs point addition operation, and obtains iteration until the point multiplication calculation result is obtained.

[0171] (7): Storage module: Stores the calculation results of the point extension calculation control module and is read by the point accumulation calculation control module.

[0172] (8): Queue Control Module: Used to control the task queue entering the point accumulation operation control module. The queue information includes the location of the first extended data of each point in the memory. In the random point multiplication pipeline mode or the random point fixed point hybrid pipeline mode, when the point extension operation control module completes, a new random point task is pushed into the queue; when the upper layer needs to perform fixed point multiplication operation, a new fixed point task is pushed into the queue.

[0173] (9): Dot product control module: According to the specific operation mode, it controls the state and process of dot product to complete the operation of the corresponding mode. The specific modes include fixed point preprocessing mode, random point serial dot product mode, random point parallel dot product mode, random point pipeline mode, fixed point accelerated dot product mode, and random point and fixed point hybrid pipeline mode;

[0174] In particular, the separate high-performance dot product method and hardware circuit described in this invention can be tailored to meet application requirements. For example, in practical applications where low latency is emphasized, the serial mode, pipelined mode, and mixed pipelined mode of random dot product can be removed, while the parallel mode of random dot product can be retained.

[0175] Key points of this invention:

[0176] This invention alters the alternating execution of doubling and addition in the NAF expansion method, allowing addition and doubling to be performed in separate stages. This enables independent control of doubling and accumulation without interference. Based on this feature, multiple operating modes are designed in conjunction with ECC elliptic curve cryptography. For fixed-point doubling calculations (such as signature and public-private key pair generation), the fixed-point doubling calculation is completed in the pre-computation stage. During actual business operation, only continuous addition can be run in either the fixed-point accelerated doubling mode or the random-point / fixed-point hybrid pipelined mode, saving all doubling time. For random-point doubling calculations, in parallel mode, doubling and accumulation of the same point are executed in parallel to achieve minimal computational latency. In pipelined mode, doubling and accumulation calculations are separated into two timelines and supplemented by a task queue mechanism to reduce module idle time and achieve maximum average efficiency.

[0177] Effects of the invention:

[0178] Compared with existing technologies, the proposed high-performance dot product method is a separate approach that combines the application characteristics of ECC elliptic curve cryptography. It provides six application modes, has a wider range of applications and more flexible applicability, and can achieve better performance under different hardware resource constraints.

[0179] An analysis of the dot product efficiency in the Jacobian weighted projective coordinate system under a binary extended field is conducted. Evaluating the efficiency based on the fact that the complexity of dot addition is three times that of dot product, the following findings are observed:

[0180] (1) When finite field arithmetic logic resources are limited and point addition and point multiplication can only be performed serially, the method proposed in this invention consumes (n / 3 point additions) of the point multiplication clock in the ECC signature process, which is far superior to the traditional NAF extension method (1-1 point multiplications + n / 3 point additions) and the Mentgomery extension method (n-1 point multiplications + n-1 point additions). The point multiplication clock consumption of the ECC signature verification process is (1-1 point multiplications + 2n / 3 point additions), which is far superior to the traditional NAF extension method (21-2 point multiplications + 2n / 3 point additions) and the serial Mentgomery extension method (2n-2 point multiplications + 2n-2 point additions).

[0181] (2) When the finite field operation logic resources allow for parallel execution of dot addition and dot multiplication, the method proposed in this invention consumes (n / 3 dot additions) of the dot multiplication clock in the ECC signature process, which is better than the parallel execution of the Mentgomery extension method (n-1 dot additions). The dot multiplication clock in the ECC verification process (adopting a random-fixed-point hybrid pipeline mode) is approximately (2n / 3 dot additions), which is better than the parallel execution of the Mentgomery extension method (2n-2 dot additions).

[0182] In addition, since the split high-performance dot multiplication method proposed in this invention is executed in completely separate stages, the change of K value between 0 and 1 cannot be observed through power consumption, thus it has a certain resistance to power consumption attacks and overcomes the power consumption attack defects in traditional binary extension method and NAF extension method.

[0183] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A separate dot product method, characterized in that, This method is applied to elliptic curve public-key cryptosystems and includes three parts: the first part is NAF encoding operation, the second part is the continuous doubling calculation process of dot expansion calculation, and the third part is the continuous dot addition / subtraction calculation process of dot accumulation calculation. Explanation of relevant parameters: a) All are positive integers; b) It is a point on the elliptic curve; c) The width is n integers, The highest non-zero bit is in the 1st position. Bit, K The i The position is denoted as ; d) The width is n+2 integers, The i The position is denoted as ; e) yes of NAF Encoding, its first i The elements are denoted as ,Right now ; f) It is a single-bit signal; g) mode It is a 3-bit binary number used for operating mode selection. Indicates fixed-point preprocessing mode. This indicates a serial dot product pattern. This indicates a parallel mode of random point multiplication. This indicates a random point-to-point multiplication flow pattern. This indicates a fixed-point accelerated dot product mode. This indicates a mixed flow pattern of random and fixed points; h) Indicates the number of tasks in the queue; i) This is the memory offset address; Part 1: Input , Output ; S11, Default setting , n represents the bit width of K; S12, if ;right conduct NAF Encoding, after encoding : S121, Order Its highest non-zero bit is Bit, or ; m represents the bit width of the effective value portion of K; S122, Regarding Calculate all The execution can be repeated or performed in parallel. like , ; like , ; According to the NAF encoding principle, the encoded length or This means the effective length may increase by 1 bit; S13, Return , ; Part Two: Input Output during the process Output at the end ;like This section will not be executed; S21, Order Send write enable DQ_wen ,Will Write to memory; S22, Order : S23, if Repeat the following steps: S231, ; and issue a write enable DQ_wen ,Will Write to memory; S232、 When the loop ends, the memory has been stored. The calculation of the extended points is complete; S24. End, Return ; Part Three: Input Output ;like This section will not be executed; S31, Order ; S32, based on the results of Part One ,right That is, from the leftmost Start scanning at the beginning of the bit, repeat the process: S321, Read from memory , ; S322, if That is, when the second and third parts are executed in parallel, when or If necessary, wait; otherwise, proceed to the next step. S323, if That is, when the second part is executed first, and then the third part is executed, If necessary, wait; otherwise, proceed to the next step. S324, if ,but ; S325, if ,but ; S326、 ； S327, if Exit the loop scan; S33, Return .

2. The split dot product method as described in claim 1, characterized in that, In the second and third parts, The value is the first part of the output. The cumulative number of consecutive doubling processes in the second part is: The cumulative number of consecutive point addition processes in Part 3 is: The number of non-zero bits, the expected value is .

3. The split dot product method as described in claim 1, characterized in that, The third improvement in the parallel mode of non-random dot product is as follows: Part Three: Improved Version The following improvements: S41, Order ; S42. Read from memory ,make ;make ;because The highest non-zero bit must be 1, so we can assign the value directly, reducing one dot addition operation: S43. Scan from left to right, if ,according to Repeat the value: S431、 S432, Read from memory S433, if ,but S434, if ,but S44, Return .

4. The split dot product method as described in any one of claims 1-3, characterized in that, In preprocessing mode, only the second part is used, including the input. default value This mode completes the fixed point The point expansion operation will Write to memory; expected time for preprocessing mode is Secondary doubling of points; preprocessing is performed directly when the ECC elliptic curve cryptography device is powered on, initialized, or when the base point parameters are updated.

5. The split dot product method as described in claim 4, characterized in that, In the fixed-point accelerated dot product mode, the first part is started first, NAF encoding is completed, and then... Value; then start the third part, perform point accumulation loop, and obtain the dot product value; the premise that this mode can calculate correctly is: fixed point points of integer powers of 2 It already exists in memory.

6. The split dot product method as described in claim 4, characterized in that, Random dot-multiplication serial patterns include: S51. When initiating a random dot product operation, first initiate the first part and the second part of the operation simultaneously; S52. After the second part of the calculation is completed, start the third part of the calculation; S53. After the third part of the operation is completed, the dot product result is obtained; The second and third parts of the process are executed sequentially, using point addition and doubling point time-division multiplexing of the underlying finite field operation logic.

7. The split dot product method as described in claim 4, characterized in that, Random dot-multiplication parallel modes include: S61. When initiating a random dot multiplication operation, the first part and the second part of the operation are started simultaneously. The first part needs to be completed before or simultaneously with the completion of the first doubling calculation of the second part. Encoding; the second part maintains point expansion iterations until... ; S62 and the third part also start simultaneously, but initially... The third part is actually in a paused waiting state; until Proceed to the next step; In S63, Part Three, whenever The loop is triggered once at a time, and Please wait.

8. The split dot product method as described in claim 4, characterized in that, The random point-to-point multiplication pipelined mode includes: during multiple consecutive random point-to-point multiplication operations, the first and second parts of the operation are completely separated from the third part and run on two separate timelines. A task queue for point-to-point accumulation is constructed using FIFO or circular shift marker methods. The queue information includes the location of the first extended data for each point in memory, and the corresponding... and ; On the point extension timeline: S71. Initiate the first and second parts of the previous dot product operation; S72. After the "Step 1" of the previous dot product is completed, the "Step 1" of the next dot product is started directly. The result of the second part of the extended operation of each dot is cached in memory. S73. After the second part of each point is completed, a new task is pushed to the tail of the point accumulation calculation task queue. On the point-accumulation timeline S81. As long as there are tasks to be processed in the task queue, the third part will be started. S82. After completing the dot summation operation in the third part, the dot product result of this task is obtained.

9. The split dot product method as described in claim 4, characterized in that, The random-point and fixed-point hybrid pipeline mode includes: On the point extension timeline: S91. For random point services, start the first and second parts of the first point multiplication operation simultaneously; for fixed point services, start the first part operation. S92. After the previous S91 dot product is completed, the next S91 dot product is started directly. The result of the second part of the expansion operation of each dot is cached in memory. S93. When the second part of the random point ends, a new task is pushed to the end of the task queue; when the first part of the fixed point ends, a new task is pushed to the task queue. On the point-accumulation timeline: S101. As long as there are tasks to be processed in the task queue, the third part will be started. S102. After completing the dot summation operation in the third part, the dot product result of this task is obtained.

10. A discrete dot product hardware circuit for implementing the method of any one of claims 1-9, characterized in that, The hardware circuit includes: Finite field operation layer module: Provides finite field operation capabilities to upper-layer modules, including modular multiplication, modular addition and subtraction modules, modular inverse, and modular squaring operations, and provides corresponding finite field operation interfaces to the upper layer; Point addition calculation control module: Connected downwards to the finite field operation layer module, it controls the modular multiplication, modular addition and subtraction, and modular squaring finite field calculation processes according to the point addition rules, completing the addition / subtraction calculation of two points in the coordinate system; input the coordinates of two points in this coordinate system. Output point coordinates ; The doubling-point calculation control module controls the modular multiplication, modular addition / subtraction, and modular square finite field calculation modules according to the doubling-point rules to complete the doubling-point calculation in the coordinate system; input the coordinates of a point in this coordinate system. Output point coordinates ; NAF encoding module: Completes the first part of the operation, converting a positive integer... Encoded as No two consecutive digits are non-zero, and the average number of non-zero digits decreases; after encoding, the output is... and length information and output the encoding completion signal. ; Point expansion operation control module: Completes the second part of the operation, continuously performs point doubling operations, obtains the expanded result of integer powers of 2, and writes it to the storage module; during random point multiplication operations, this continuous point doubling process is accumulated to [number missing]. In the pre-calculation formula at a fixed point, the cumulative number of times this continuous doubling process is... Second-rate, Value Bit width; Dot accumulation operation control module: completes the operation in the third part, continuously performs dot addition operations, and iterates until the dot multiplication result is obtained; Storage module: Stores the calculation results of the point extension calculation control module, and is read by the point accumulation calculation control module; Queue control module: Used to control the task queue entering the point accumulation operation control module. The queue information includes the location of the first extended data of each point in the memory. In the random point multiplication pipeline mode or the random point fixed point hybrid pipeline mode, when the point extension operation control module is completed, a new random point task is pushed into the queue. When the upper layer needs to perform fixed point multiplication operation, a new fixed point task is pushed into the queue. Dot product control module: According to the specific operation mode, it controls the state and process of dot product to complete the operation of the corresponding mode; the specific modes include fixed point preprocessing mode, random point serial dot product mode, random point parallel dot product mode, random point pipeline mode, fixed point accelerated dot product mode, and random point and fixed point hybrid pipeline mode.

Images