Data processing method and device, processor, computer equipment, medium and program

Abstract

Embodiments of the invention provide a data processing method and apparatus, a processor, a computer device, a medium and a program. The method comprises the steps of obtaining to-be-processed data; determining input data of modular product operation of the elliptic curve cryptographic algorithm, wherein the input data comprises a plurality of input multipliers; determining a plurality of product term accumulations corresponding to the multiplication of the binary representations of the plurality of input multipliers; the correction factor of the intermediate domain and the prime number of the prime number domain are utilized to correct the accumulation result of each step of accumulation in the step-by-step accumulation process of the multiple product terms so as to obtain multiple correction results, and the last correction result corresponds to the result of the modular product operation of the intermediate domain; wherein the correction factor is used for mapping the operation to the intermediate domain to eliminate the division operation; and mapping the last correction result back to the prime number field to obtain an operation result of modular product operation in the prime number field, and determining a data processing result according to the operation result. According to the embodiment of the invention, the data processing performance of an elliptic curve cryptographic algorithm can be improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data processing technology, and specifically to a data processing method, apparatus, processor, computer equipment, medium and program. Background Art

[0002] Elliptic curve cryptography is a public key cryptographic algorithm based on the elliptic curve discrete logarithm problem. It is widely used in data processing scenarios such as data encryption and decryption, digital signatures, etc. Typical elliptic curve cryptographic algorithms include SM2 (Commercial Cryptography 2) algorithm and ECDSA (Elliptic Curve Digital Signature) algorithm. The elliptic curves of elliptic curve cryptographic algorithms such as SM2 algorithm are defined in the prime field. Therefore, elliptic curve cryptographic algorithms such as SM2 algorithm involve operations of taking the product modulo prime numbers in the prime field, that is, modular operations of the product (referred to as modular product operations). Typical modular product operations include modular multiplication operations and modular square operations.

[0003] As the basic operation in the elliptic curve cryptography algorithm, the performance of modular product operation has a significant impact on the algorithm performance of the elliptic curve cryptography algorithm. Therefore, in the data processing scenario where the elliptic curve cryptography algorithm is applied, how to improve the performance of modular product operation, thereby improving the algorithm performance of the elliptic curve cryptography algorithm, and then improving the data processing performance of the elliptic curve cryptography algorithm, has become a technical problem that technicians in this field need to solve urgently. Summary of the invention

[0004] In view of this, the embodiments of the present application provide a data processing method, apparatus, processor, computer equipment, medium and program, which, in a data processing scenario where an elliptic curve cryptographic algorithm is applied, improves the computational performance of modular product operations, thereby improving the algorithm performance of the elliptic curve cryptographic algorithm, and further improving the data processing performance of the elliptic curve cryptographic algorithm.

[0005] To achieve the above objectives, the embodiments of the present application provide the following technical solutions.

[0006] In a first aspect, an embodiment of the present application provides a data processing method, including:

[0007] Acquire data to be processed, wherein the data to be processed is processed using an elliptic curve cryptographic algorithm, wherein an elliptic curve of the elliptic curve cryptographic algorithm is defined in a prime number domain;

[0008] Determine input data for a modular product operation of an elliptic curve cryptographic algorithm, wherein the modular product operation takes a product modulo a prime number in a prime number field, wherein the input data includes a plurality of input multipliers for obtaining the product, and the input multipliers are in binary representation;

[0009] Determine a plurality of accumulations of product terms corresponding to multiplications of binary representations of the plurality of input multipliers;

[0010] Using the correction factor of the intermediate domain and the prime number of the prime number domain, in the step-by-step accumulation process of accumulating multiple product terms, the accumulated result of each step of accumulation is corrected to obtain multiple corrected results, the last corrected result of the multiple corrected results corresponds to the result of the modular product operation of the intermediate domain; wherein the correction factor of the intermediate domain is used to map the operation to the intermediate domain to eliminate the division operation;

[0011] Map the last corrected result back to the prime number domain to obtain the result of the modular product operation in the prime number domain;

[0012] According to the result of the modular product operation in the prime number field, the data processing result of the data to be processed is determined.

[0013] In a second aspect, an embodiment of the present application provides a data processing device, including:

[0014] A module for acquiring data to be processed, used for acquiring data to be processed, wherein the data to be processed is processed using an elliptic curve cryptographic algorithm, wherein an elliptic curve of the elliptic curve cryptographic algorithm is defined in a prime number domain;

[0015] An operation input determination module, used for determining input data of a modular product operation of an elliptic curve cryptographic algorithm, wherein the modular product operation takes a product modulo a prime number in a prime number field, wherein the input data includes a plurality of input multipliers for obtaining the product, and the input multipliers are represented in binary;

[0016] A product term accumulation determination module, configured to determine a plurality of product term accumulations corresponding to the multiplication of the binary representations of the plurality of input multipliers;

[0017] An accumulation correction module, used for correcting the accumulation result of each step of accumulation in the step-by-step accumulation process of accumulating multiple product terms by using the correction factor of the intermediate domain and the prime number of the prime number domain, so as to obtain multiple correction results, wherein the last correction result of the multiple correction results corresponds to the result of the modular product operation of the intermediate domain; wherein the correction factor of the intermediate domain is used to map the operation to the intermediate domain to eliminate the division operation;

[0018] A mapping recovery module, used for mapping the last correction result back to the prime number domain to obtain the result of the modular product operation in the prime number domain;

[0019] The data processing result determination module is used to determine the data processing result of the data to be processed according to the operation result of the modular product operation in the prime number field.

[0020] In a third aspect, an embodiment of the present application provides a processor, which is designed based on an instruction set, and the instruction set has algorithm instructions of an elliptic curve cryptography algorithm, and the algorithm instructions are used by the processor to implement the data processing method described in the first aspect above.

[0021] In a fourth aspect, an embodiment of the present application provides a computer device, comprising the processor as described in the third aspect above.

[0022] In a fifth aspect, an embodiment of the present application provides a computer device, comprising a processor and a memory, wherein the memory stores computer program instructions, and the processor calls the computer program instructions stored in the memory to execute the data processing method as described in the first aspect above.

[0023] In a sixth aspect, an embodiment of the present application provides a storage medium, wherein the storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the data processing method as described in the first aspect above is implemented.

[0024] In a seventh aspect, an embodiment of the present application provides a computer program product, wherein the computer program product includes computer program instructions, and when the computer program instructions are executed by a processor, the data processing method as described in the first aspect above is implemented.

[0025] The data processing method provided in the embodiment of the present application can determine the data processing result of the data to be processed based on the result of the modular product operation of the elliptic curve cryptographic algorithm when using the elliptic curve cryptographic algorithm to process the data to be processed, thereby realizing data processing in the data processing scenario of applying the elliptic curve cryptographic algorithm and obtaining the data processing result of the data processing scenario. Specifically, the elliptic curve of the elliptic curve cryptography algorithm is defined in the prime number domain, and the modular product operation of the elliptic curve cryptography algorithm takes the product modulo the prime numbers in the prime number domain. Then, during the operation process of the modular product operation, the embodiment of the present application can determine multiple input multipliers of the modular product operation, where the input multipliers are represented in binary, thereby determining the accumulation of multiple product terms corresponding to the multiplication of the binary representations of the multiple input multipliers; further, in the step-by-step accumulation process of the product term accumulation, the accumulation result of each step of the accumulation is corrected using the correction factor of the intermediate domain and the prime numbers of the prime number domain to obtain multiple corrected results, and the last corrected result of the multiple corrected results corresponds to the result of the modular multiplication operation in the intermediate domain; then the last corrected result is mapped back to the prime number domain to obtain the operation result of the modular product operation in the prime number domain, so as to determine the data processing result of the data to be processed based on the operation result of the modular product operation in the prime number domain. Since the correction factor of the intermediate domain can map the operation to the intermediate domain to eliminate the division operation during the gradual accumulation of the product terms, the embodiment of the present application can simplify the complexity of the modular product operation, and the embodiment of the present application uses prime numbers to make the gradually obtained correction results converge in the direction of prime numbers, so that the last correction result can be mapped back to the prime number domain to ensure the accuracy of the operation result.

[0026] Therefore, the embodiment of the present application can utilize the correction factor of the intermediate domain and the prime number of the prime number domain to convert the modular product operation to the intermediate domain during the gradual accumulation of the product terms, so as to eliminate the complex division operation, reduce the computational overhead, improve the computational efficiency of the modular product operation, and ensure the accuracy of the computational result. Therefore, the embodiment of the present application can improve the computational performance of the modular product operation, thereby improving the algorithm performance of the elliptic curve cryptographic algorithm, and further improve the data processing performance of the elliptic curve cryptographic algorithm, and realize efficient and accurate data processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0028] Figure 1 This is an example diagram of the processing process of the SM2 algorithm.

[0029] Figure 2 A flowchart of a data processing method provided in an embodiment of the present application.

[0030] Figure 3 A flowchart of a modular multiplication operation provided in an embodiment of the present application.

[0031] Figure 4 A flowchart of a modular square operation provided in an embodiment of the present application.

[0032] Figure 5 A block diagram of a data processing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0033] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0034] Elliptic curve cryptographic algorithms such as the SM2 algorithm and the ECDSA algorithm mainly use points on the elliptic curve for data encryption and decryption, digital signatures and other data processing, so as to realize the application of elliptic curve cryptographic algorithms in data encryption and decryption, digital signatures and other data processing scenarios.

[0035] For ease of understanding, take the SM2 algorithm as an example. In the data encryption scenario where the SM2 algorithm is applied, Figure 1 The processing example diagram of the SM2 algorithm is shown as an example. Figure 1 As shown in the data encryption scenario, the input of the SM2 algorithm is plaintext M and public key P B , the output is ciphertext C; the operation process of SM2 algorithm is as follows:

[0036] Generate a random number k, k∈[1,n-1], where n is the order of the base point G of the elliptic curve. The random number k is used to generate a random point on the elliptic curve during the encryption process to ensure that each encryption is random. That is, even if the same plaintext and public key are used for different encryptions, the encryption results will be different each time.

[0037] Calculate the point C1 of the elliptic curve, and C1 = k·G = (x1, y1). The calculation of C1 can use the point multiplication operation on the elliptic curve (i.e. k·G), thereby obtaining the point (x1, y1) on the elliptic curve; C1 will be included in the ciphertext C, thereby providing the random information generated during the encryption process for the decryption party to use, so that C1 can be regarded as the random information part of the ciphertext;

[0038] Calculate the point k·P of the elliptic curve B, and k·P B =(x2,y2), that is, the random number k and the public key P B Perform a point multiplication operation to obtain the point (x2, y2) on the elliptic curve. (x2, y2) is used to generate the symmetric key later.

[0039] Calculate the symmetric key t, and t = KDF (x2||y2, klen), that is, (x2, y2) generates the symmetric key t through the key derivation function (KDF), and the length of the symmetric key t is the length of the plaintext M (i.e. klen); during the calculation of the symmetric key t, if t is a bit string of all 0s, it is necessary to return to the step of regenerating the random number k to re-perform the process operation;

[0040] Calculate C2, and C2 = M ⊕ t, that is, perform bit-by-bit XOR operation on the plaintext M and the symmetric key t to obtain C2, which can be regarded as the ciphertext part of the ciphertext;

[0041] Calculate C3, and C3 = Hash (x2 | M | y2), that is, calculate the hash value using the point (x2, y2) on the elliptic curve and the plaintext M, so as to verify the integrity of the ciphertext. C3 can be regarded as the hash part of the ciphertext.

[0042] A ciphertext C is formed, and C=C1||C3||C2, that is, the random information part C1, the partial ciphertext C2, and the hash part C3 form the output ciphertext C.

[0043] It should be noted that elliptic curve cryptographic algorithms such as SM2 can be applied to encryption, decryption, digital signature, signature verification and other scenarios. The above only uses the encryption scenario of SM2 as an example.

[0044] It can be seen that elliptic curve cryptographic algorithms such as SM2 involve using point multiplication operations to calculate the coordinates of points on the elliptic curve for use in data processing scenarios such as data encryption and decryption, digital signatures, etc. For example, the encryption process of SM2 in the above example involves using k·G, k·P B Point multiplication is performed to obtain points on the elliptic curve, which are then used for data encryption. Since point multiplication takes up most of the time of elliptic curve cryptographic algorithms such as SM2, the performance of point multiplication has a crucial impact on the performance of elliptic curve cryptographic algorithms such as SM2.

[0045] Furthermore, the point multiplication operation can be decomposed into point addition and point doubling operation, which can be further decomposed into modular multiplication operation, modular square operation, modular addition operation and modular subtraction operation, etc. That is, since the elliptic curve is defined on the prime field, modular multiplication operation, modular square operation, modular addition operation and modular subtraction operation all involve taking the modulus with the prime numbers in the prime field. Among them, modular multiplication operation and modular square operation involve taking the modulus of the product with the prime numbers in the prime field, that is, modular product operation. For example, modular multiplication operation involves taking the modulus of the product of the multiplication operation with the prime numbers in the prime field, and modular square operation involves taking the modulus of the product of the square operation with the prime numbers in the prime field. Therefore, the point multiplication operation of elliptic curve cryptographic algorithms such as SM2 depends on modular product operation (such as modular multiplication operation and modular square operation).

[0046] It can be seen that in elliptic curve cryptographic algorithms such as the SM2 algorithm and the ECDSA algorithm, modular product operations (such as modular multiplication operations and modular square operations) are the basis of the point multiplication operations of the elliptic curve cryptographic algorithms. Therefore, the computational performance of modular product operations has a significant impact on the algorithmic performance of the elliptic curve cryptographic algorithms. In particular, in the point multiplication operations based on points on the elliptic curve, the computational performance of modular product operations (such as modular multiplication operations and modular square operations) on which the point multiplication operations depend is crucial to the algorithmic performance of the elliptic curve cryptographic algorithms.

[0047] Based on this, the embodiments of the present application consider optimizing the modular product operation and provide a data processing solution for the elliptic curve cryptographic algorithm using the optimized modular product operation. Thus, in the data processing scenario where the elliptic curve cryptographic algorithm is applied, the algorithm performance of the elliptic curve cryptographic algorithm is improved by improving the computing performance improved by the optimized modular product operation, thereby improving the data processing performance of the elliptic curve cryptographic algorithm (for example, the performance of data encryption and decryption, the performance of digital signature, etc.).

[0048] As an optional implementation, Figure 2 An optional flow chart of the data processing method provided in the embodiment of the present application is shown as an example. The method flow can be implemented by a computer device. For example, the computer device can use elliptic curve cryptographic algorithms such as the SM2 algorithm and the ECDSA algorithm to perform data encryption and decryption, digital signature and other data processing; the computer device includes but is not limited to any electronic device with data processing functions such as terminal devices and server devices. In an optional specific implementation, the processor in the computer device can execute the data processing method provided in the embodiment of the present application.

[0049] Reference Figure 2 The method flow may include the following steps.

[0050] In step S210, the data to be processed is obtained, and the data to be processed is processed using an elliptic curve cryptographic algorithm.

[0051] As an optional implementation, based on different data processing scenarios in which the elliptic curve cryptography algorithm is applied, the data to be processed using the elliptic curve cryptography algorithm can have different forms. For example, if the elliptic curve cryptography algorithm is applied to a data encryption scenario, the data to be processed can be plaintext to be encrypted; for example, if the elliptic curve cryptography algorithm is applied to a data decryption scenario, the data to be processed can be ciphertext to be decrypted; for example, if the elliptic curve cryptography algorithm is applied to a digital signature scenario, the data to be processed can be a data summary (such as a hash value) of the data to be signed.

[0052] In step S220, input data of a modular product operation of an elliptic curve cryptographic algorithm is determined, where the input data of the modular product operation includes a plurality of input multipliers for obtaining a product.

[0053] In an embodiment of the present application, the modular product operation involves taking the product modulo a prime number in a prime number field, so that the input data of the modular product operation may include multiple input multipliers for obtaining the product.

[0054] For example, taking modular product operation as modular multiplication operation as an example, the multiple input data of modular multiplication operation may include two input multipliers, referred to as the first input multiplier and the second input multiplier, wherein one input multiplier may be a scalar (such as a private key or a random number), and the other input multiplier may correspond to an input point on an elliptic curve (such as a base point on an elliptic curve, etc.); for example, the first input multiplier may be a scalar, and the second input multiplier may be an input point on an elliptic curve. For another example, taking modular product operation as modular square operation as an example, the multiple input data of modular square operation may be the same multiple input data, that is, the same input data is squared.

[0055] As an optional implementation, the input data of the modular product operation can be determined based on the data to be processed, or based on a scalar (private key or random number) and / or an input point on the elliptic curve (such as a base point), depending on the specific data processing scenario of the elliptic curve cryptography algorithm and the specific stage of the modular product operation.

[0056] For example, in a data encryption scenario, the elliptic curve cryptography algorithm is used to encrypt plaintext, and in the data encryption process, the modular product operation (such as modular multiplication operation, modular square operation) of the elliptic curve cryptography algorithm is used as part of the encryption operation, which can be used in the stages of generating public keys, generating random information parts, generating symmetric keys, etc.

[0057] For example, in the public key generation stage, the private key (a form of scalar) performs a modular product operation (e.g., modular multiplication operation) with the base point on the elliptic curve to generate the public key; for example, in the random information part generation stage, the random number (a form of scalar) performs a modular product operation (e.g., modular multiplication operation) with the base point on the elliptic curve to generate the random information part; for example, in the symmetric key generation stage, the random number (a form of scalar) performs a modular product operation (e.g., modular multiplication operation) with the public key, and then the result is derived into a symmetric key through a key derivation function. Then, the symmetric key performs a further operation (e.g., XOR operation) with the plaintext to obtain the ciphertext part, so that the random information part and the ciphertext part form an encrypted ciphertext.

[0058] It can be seen that for the data encryption scenario, in the public key generation stage, the random information part generation stage and the symmetric key generation stage, the input data of the modular product operation (such as modular multiplication operation) can be the private key and the base point on the elliptic curve, the random number and the base point on the elliptic curve, the random number and the public key, respectively. Therefore, the input data of the modular product operation (such as modular multiplication operation) may not involve plaintext (the plaintext is encrypted by the symmetric key generated in the symmetric key generation stage).

[0059] For example, in a data decryption scenario, the elliptic curve cryptographic algorithm is used to decrypt the ciphertext, and in the data decryption process, the modular product operation (such as modular multiplication operation) of the elliptic curve cryptographic algorithm can be used in the symmetric key generation stage as part of the decryption operation. For example, in the symmetric key generation stage, the private key (a form of scalar) is modularly multiplied with the random information part in the ciphertext, and then the result of the modular multiplication operation is used to derive the symmetric key through the key derivation function; then, the symmetric key is further operated with the ciphertext part in the ciphertext to restore the plaintext.

[0060] It can be seen that for the data decryption scenario, in the symmetric key generation stage, the input data of the modular product operation (such as modular multiplication operation) is the private key and the random information part in the ciphertext, so the input data of the modular product operation (such as modular multiplication operation) involves the ciphertext. At this time, it can be regarded as a situation where the input data of the modular product operation (such as modular multiplication operation) is determined based on the data to be processed, that is, the random information part in the ciphertext needs to be used as the input multiplier of the modular product operation (such as modular multiplication operation).

[0061] For example, in a digital signature scenario, the elliptic curve cryptography algorithm is used to sign the data summary (such as a hash value) of the data to be signed to obtain the signature data. In the digital signature process, the modular product operation (such as modular multiplication operation) of the elliptic curve cryptography algorithm as part of the digital signature operation can generate intermediate data in the signature process. For example, a random number (a form of scalar) is subjected to a modular product operation (such as modular multiplication operation) with the base point of the elliptic curve to generate intermediate data; then, the intermediate data (specifically, the horizontal coordinate of the intermediate data) participates in the generation process of the signature pair of the signature data to generate a signature pair corresponding to the signature data and obtain the signature data.

[0062] It can be seen that for the digital signature scenario, in the stage of generating intermediate data in the signing process, the input data of the modular product operation (such as modular multiplication operation) is a random number and the base point of the elliptic curve, so that the input data of the modular product operation (such as modular multiplication operation) may not involve the data summary of the data to be signed.

[0063] In step S230, a binary representation of an input multiplier is determined.

[0064] In an optional implementation, the input multiplier can be an integer and have a corresponding binary representation in the computer; the binary representation of the input multiplier can be a linear combination of multiple components of the input multiplier and multiple position coefficients, where the size of a component corresponds to the bit width of the processor, and one component corresponds to a position coefficient, indicating the shift of the component.

[0065] As an optional implementation, for any input multiplier, the embodiment of the present application can decompose the input multiplier into multiple components, and set the position coefficient of each component, so as to obtain multiple position coefficients corresponding to the multiple components, wherein one component corresponds to one position coefficient, indicating the displacement of the component. For example, in the binary system of the processor, the position coefficient corresponding to the component of the input multiplier represents the displacement of the component in the binary number of the input multiplier to ensure that the component is in the correct position. Thus, for any input multiplier, a linear combination of multiple components of the input multiplier and multiple position coefficients can form a binary representation of the input multiplier, for example, a weighted combination of each component of the input multiplier and the corresponding position coefficient can form a binary representation of the input multiplier.

[0066] In an optional implementation, the embodiment of the present application can determine the number of multiple components of the input multiplier decomposition according to the size of the input multiplier and the bit width of the processor, and the component size of each component corresponds to the bit width of the processor; wherein the bit width of the processor is the word length of the processor, which refers to the number of bits of binary data that the processor can process at one time, such as 64 bits, etc., and a bit is also called a bit. Taking the processor bit width of 64 bits as an example, a component can be a 64-bit component, so that an input multiplier can be decomposed into multiple 64-bit components, each 64-bit component has a corresponding position in the input multiplier (represented by a position coefficient), and then the linear combination of multiple 64-bit components with different position coefficients forms a binary representation of the input multiplier.

[0067] For example, assume that the bit width of the processor is w, one of the multiple input multipliers of the modular product operation is represented by A (for example, the first input multiplier in the modular multiplication operation is represented by A), and the input multiplier A is decomposed into n components, then n is the size of the input multiplier divided by the bit width w of the processor, and the component size of each component corresponds to the bit width w of the processor; wherein, since the elliptic curve is defined in the prime number field GF(p), each input multiplier belongs to an element of the prime number field GF(p), that is, the size of the input multiplier corresponds to the size of the prime number p in the prime number field GF(p), so that the embodiment of the present application can adapt the expression of the binary representation of the input multiplier based on the element size of the prime number field GF(p) (corresponding to the prime number size) and the bit width of the processor.

[0068] As a further example, let the i-th component of the input multiplier A be represented by a i , if i starts at 0, then i is an integer from 0 to n-1, so that in the binary mechanism of the processor, the i-th component a i The corresponding position coefficient is 2 w·i , that is, a i In the binary number of A, it occupies the position of the i-th w-bit, and the binary representation of A as an integer can be:

[0069]

[0070] In step S240, a plurality of product terms corresponding to the multiplication of the binary representations of the plurality of input multipliers are determined and accumulated.

[0071] As an optional implementation, the binary representations of multiple input multipliers are multiplied to obtain a product result; the product result is expanded to obtain multiple product terms; the multiple product terms are classified according to the position coefficients to obtain multiple product term accumulations corresponding to different position coefficients, and one product term accumulation corresponds to one position coefficient, indicating the shift of the product term accumulation.

[0072] That is to say, multiplying the binary representations of multiple input multipliers is to cross-multiply each item in the binary representations of the multiple input multipliers, that is, each item in the binary representation of one input multiplier is multiplied with each item in the binary representation of another input multiplier, and one item in the binary representation represents a component multiplied by the corresponding position coefficient. Therefore, the embodiment of the present application can expand the product result obtained by multiplying the binary representations of multiple input multipliers to obtain multiple product terms (the product result can be the addition of the multiple product terms), and then based on the corresponding position coefficient of each product term, the multiple product terms of the product result are classified according to the position coefficient, and different product terms corresponding to different position coefficients are accumulated, thereby deriving multiple product term accumulations. Correspondingly, the accumulation of multiple product terms is shifted and accumulated with the corresponding position coefficients, and the product result can be restored.

[0073] In step S250, the correction factor of the intermediate domain and the prime number of the prime number domain are used to correct the accumulated result of each step in the step-by-step accumulation process of the product terms to obtain multiple corrected results, and the last corrected result of the multiple corrected results corresponds to the result of the modular product operation of the intermediate domain; wherein the correction factor of the intermediate domain is used to map the operation to the intermediate domain to eliminate the division operation.

[0074] It should be explained that modular multiplication operation is to multiply multiple input multipliers modulo a prime number p. For example, taking modular multiplication operation as an example, assuming that the first input multiplier of modular multiplication operation is A and the second input multiplier is B, then the modular multiplication operation is expressed as A·B modp. For example, taking modular square operation as an example, assuming that the input multipliers of modular square operation are all A, then the modular square operation is expressed as A 2 modp. If division is used during the modulo operation, the complexity of the modular product operation (such as modular multiplication and modular square operation) will increase. This is because the processor is more complex to perform division operations than addition, subtraction and multiplication operations. For example, when the number of digits of the multiple input multipliers is large, the number of digits of the product of the multiple input multipliers will also increase accordingly. At this time, if the modulo operation is implemented using division, the complexity of the division operation itself and the product of the larger number of digits will cause the operation speed of the modulo operation to be very slow, affecting the efficiency of the modular multiplication operation.

[0075] Therefore, it is possible to consider converting the modular product operation (e.g., modular multiplication operation, modular square operation) in the prime field GF(p) to the intermediate field, thereby eliminating the division operation by using non-division operations such as shift operations performed in the intermediate field; then, the result obtained in the intermediate field is converted back to the prime field GF(p), and the result of the modular product operation (e.g., modular multiplication operation, modular square operation) under the prime field GF(p) can be obtained. For example, the intermediate field can be, for example, the Montgomery field, and the Montgomery field can be regarded as the intermediate calculation space used by the Montgomery modular product algorithm (e.g., Montgomery modular multiplication algorithm, Montgomery modular square algorithm). In an optional implementation, the modular product operation in the intermediate field (e.g., the Montgomery field) can be converted from the modular product operation (e.g., modular multiplication operation, modular square operation) originally in the prime field GF(p) to the intermediate field (e.g., the Montgomery field) by introducing a constant R. For example, taking the modular multiplication operation in the intermediate field as an example, the modular multiplication operation in the intermediate field can be expressed as A·B·R -1 mod p, taking the modular square operation of the intermediate domain as an example, the modular square operation of the intermediate domain can be expressed as A 2 ·R -1 mod p.

[0076] Based on this, in the embodiment of the present application, during the gradual accumulation of product terms, a correction factor of the intermediate domain (e.g., Montgomery domain) and a prime number of the prime domain are introduced, and starting from the first product term accumulation of multiple product terms, the correction factor of the intermediate domain and the prime number of the prime domain are used to correct the accumulated result of each step of the accumulation, until the accumulated result of the last step of the accumulation is corrected to obtain the last corrected result, so that the last corrected result corresponds to the result of the modular product operation (e.g., modular multiplication operation, modular square operation) of the intermediate domain; and then, the last corrected result corresponding to the result of the modular product operation (e.g., modular multiplication operation, modular square operation) of the intermediate domain is subsequently mapped back to the prime number domain GF(p), and the operation result of the modular product operation (e.g., modular multiplication operation, modular square operation) under the prime number domain GF(p) can be obtained, thereby completing the modular product operation (e.g., modular multiplication operation, modular square operation) of the prime number domain GF(p).

[0077] Specifically, the embodiment of the present application introduces a correction factor of the intermediate domain (such as the Montgomery domain) to convert the operation to the intermediate domain (such as the Montgomery domain) to eliminate the division operation, that is, the correction factor is used to convert the operation to the intermediate domain (such as the Montgomery domain); thus, in the step-by-step accumulation process of the product term accumulation, each step of the accumulation can be converted to the intermediate domain (such as the Montgomery domain) using the correction factor of the intermediate domain (such as the Montgomery domain), so that the accumulation result of each step of the accumulation is corrected to the intermediate domain (such as the Montgomery domain) for calculation, so as to eliminate the division operation used in the modular product operation (such as modular multiplication operation, modular square operation), such as using non-division operations such as shift operations performed in the intermediate domain to eliminate the division operation.

[0078] At the same time, the embodiment of the present application introduces a prime number p of the prime number field GF(p) so that the operation result approaches the prime number field; that is, in the step-by-step accumulation process of the product term accumulation, the embodiment of the present application introduces a prime number p to prevent the accumulation result of each step from being far away from the range of the prime number p. For example, the prime number p can be used to ensure that the accumulation result of each step of accumulation can be close to the prime number field after being corrected (at this time, it has not been mapped back to the prime number field).

[0079] That is to say, in the gradual accumulation process of product terms, the embodiment of the present application introduces a correction factor and a prime number p at each step of accumulation to correct the accumulation result; wherein the correction factor corresponds to the intermediate domain, and is at least used to convert the operation to the intermediate domain (such as the Montgomery domain) so that the accumulation result of each step of accumulation is corrected to the intermediate domain (such as the Montgomery domain) for calculation; at the same time, the prime number p is used to control the accumulation result of each step of accumulation to be corrected to a range close to the prime number p.

[0080] As an optional implementation, the gradual accumulation of product term accumulations may be considered as gradually accumulating multiple product term accumulations in order from low to high, such as gradually accumulating product term accumulations in order from small to large position coefficients. For example, first accumulate the first product term accumulation among multiple product term accumulations (for example, the product term accumulation of the lowest position, such as the product term accumulation with the smallest position coefficient), and use the correction factor and the prime number p to correct the accumulation result to obtain the first corrected result; then, on the basis of the first corrected result, accumulate the next product term accumulation of the first product term accumulation in order from low position to high position, and use the correction factor and the prime number p to correct the accumulation result to obtain the next corrected result after the first corrected result; then, on the basis of the corrected result obtained, accumulate the next product term accumulation in order from low position to high position, and use the correction factor and the prime number p to correct the accumulation result, and so on, until the accumulation result of the last step of accumulation is corrected, then the last corrected result can be obtained, and the last corrected result is used as the result of the modular product operation (for example, modular multiplication operation, modular square operation) of the intermediate domain.

[0081] That is to say, in the gradual accumulation process of product term accumulation, the next accumulation step is to accumulate the next product term accumulation on the basis of the correction result corresponding to the previous accumulation step, for example, on the basis of the first correction result, the next product term accumulation of the first product term accumulation is accumulated in order from low to high. Therefore, the embodiment of the present application can gradually accumulate multiple product term accumulations in order from low to high, and use correction factors and prime numbers to correct the accumulation result of each step of accumulation, so that the next accumulation step is to accumulate the next product term accumulation on the basis of the correction result corresponding to the previous accumulation step, until the accumulation result of the last accumulation step is corrected, thereby obtaining multiple corrected results.

[0082] After obtaining the last correction result among multiple correction results, the last correction result corresponds to the result of the modular product operation (such as modular multiplication operation, modular square operation) of the intermediate domain, that is, in the gradual accumulation process of the above-mentioned product terms, the accumulated result of each step of accumulation is corrected using correction factors and prime numbers until the last correction result is obtained, which is considered to be completed. The modular product operation of the intermediate domain is then completed (that is, the modular product operation of the prime number domain is converted to the intermediate domain and the modular product operation of the intermediate domain is completed), so that the last correction result corresponds to the result of the modular product operation of the intermediate domain. This is because the accumulated product terms accumulate and correspond to the product of multiple input multipliers. Therefore, in the process of gradual accumulation, the accumulated result of each step of accumulation is corrected by the correction factor and the prime number p, and then the final corrected result is obtained after multiple steps of accumulation, which actually means that the accumulated product terms are accumulated and mapped to the intermediate domain and the prime number p operation (modulo) is performed; therefore, in the process of gradual accumulation, the accumulated result of each step of accumulation is corrected by the correction factor and the prime number p until the final corrected result is obtained, which is equivalent to correcting the product of multiple input multipliers and the prime number p operation (modulo) by the correction factor and the prime number p, that is, it is equivalent to mapping to the intermediate domain for modular product operation to eliminate the division operation, so that the final corrected result is equivalent to the result of the modular product operation of the intermediate domain.

[0083] As an optional implementation, taking the accumulation in step i as an example, the correction of the accumulation result in step i can be expressed as:

[0084] 2 64 ·C i =(C i-1 +d i )+(μ·(C i-1 +d i )mod 2 64 )·p;

[0085] Among them, C i is the i-th correction result corresponding to the i-th step accumulation, C i-1 The i-1th correction result corresponding to the i-1th step is accumulated, d i is the accumulation of the i-th product term, C i-1 +d i is the cumulative result of the i-th step, μ is the correction factor; 2 64 ·C i 2 of 2 64 Indicates shift, which is used to adjust the number of bits to ensure that the correction result is in the correct position.

[0086] It can be seen that in the accumulation of the i-th step, the correction factor μ and the prime number p are introduced to correct the i-1th correction result C i-1 Cumulative product d with the i-th product termi The cumulative result C i-1 +d i , so that the i-th correction result C i Map it to the intermediate domain corresponding to the correction factor μ and keep it in the intermediate domain to eliminate the division operation; at the same time, make the i-th correction result C i within a reasonable range close to the prime number p.

[0087] In a further optional implementation, the correction factor μ may be a multiplicative inverse element associated with the prime number p, so that the correction factor μ may utilize the multiplicative inverse element associated with the prime number p to eliminate the division operation through a shift operation. For example, the correction factor μ is expressed as μ=-p -1 mod R, R is a constant introduced in the intermediate field (such as the Montgomery field) for converting operations in the prime field GF(p) to the intermediate field (such as the Montgomery field), so that μ·p is equivalent to -1 mod R.

[0088] In an alternative implementation, R can take the value 2 k , and the value of k can be related to the number of accumulated steps of multiple product terms and the bit width of the processor. For example, if the bit width of the processor is 64 bits, the value of k is: the number of accumulated steps of multiple product terms multiplied by 64 bits. For example, if the number of accumulated steps of product terms is 4, then k is 256 (ie 4×64). For example, when the modular multiplication operation involves 4 steps of accumulated product terms, then μ=-p -1 mod 2 256 , that is, the correction factor μ is the prime number p modulo 2 256 The multiplicative inverse element under 256 For example, if the number of accumulation steps of the product term accumulation is 7, then k is 448 (ie, 7×64). For example, when the modular product operation is a modular square operation involving 7 accumulation steps of the product term accumulation, then μ=-p -1 mod 2 448 , that is, the correction factor μ is the prime number p modulo 2 448 The multiplicative inverse element under 448 .

[0089] Based on setting the correction factor μ as the multiplicative inverse element associated with the prime number p, for example, the correction factor μ is expressed as μ=-p -1 modR, and μ·p is equivalent to -1mod R, then in the gradual accumulation of product terms, the correction factor μ can map the operation to the intermediate domain, and through the shift operation (i.e. 2 k corresponding shift operations) to eliminate the division operation in the modular product operation (for example, eliminating the division by 2 k operations), thereby reducing the complexity of modular multiplication operations (such as modular multiplication operations and modular multiplication operations).256 The corresponding shift operation eliminates the division operation, and the modular square operation is performed by 2 448 The corresponding shift operation is used to eliminate the division operation.

[0090] Furthermore, the embodiment of the present application also provides a further calculation simplification scheme, that is, based on the specific form of the prime number p, the i-th correction result C i As an optional implementation, for a prime number p of 256 bits, the prime number p is represented by p=2 256 -2 224 -2 96 +2 64 -1, then the i-th correction result C i The calculation formula can be simplified as:

[0091]

[0092] Among them, z i =(C i-1 +d i )mod 2 64 , p = 2 256 -2 224 -2 96 +2 64 -1, Indicates that the result is rounded down.

[0093] Specifically, since the modulus is 2 at each step of accumulation 64 (i.e., it does not overflow 64 bits), so that at any accumulation step, μ·p is equivalent to -1 mod 2 64 , then in the accumulation of step i, ((C i-1 +d i )+(μ·(C i-1 +d i )mod 2 64 )·p)mod 2 64 ≡(C i-1 +d i )mod 2 64 -(C i-1 +

[0094] d i )mod 2 64 =0;

[0095] That is ((C i-1 +d i )+(μ·(C i-1 +d i )mod 2 64 )·p)mod 2 64 It can be decomposed into (Ci-1 +d i )mod 2 64 +((μ·(C i-1 +d i )mod 2 64 )·p)mod 2 64 , that is, the two parts of the formula are modulo 2 64 The following operations are performed separately;

[0096] Since μ·p is equivalent to -1 mod 2 64 , and p=(2 256 -2 224 -2 96 +2 64 -1) mod 2 64 =-1, so μ≡1mod2 64 , so (μ·(C i-1 +d i )mod 2 64 )·p is simplified to ((C i-1 +d i )mod 2 64 )·p.

[0097] Based on this, the i-th corrected result C i Can be an integer and can have the following representations:

[0098]

[0099] That is, p = 2 256 -2 224 -2 96 +2 64 -1 is substituted, and then the distributive law is applied. In the processing of low bits, due to C i is an integer, so the lower part is rounded down; in the processing of the higher part, z i =(C i-1 +d i )mod 2 64 Substitute into, then the above C i The formula can be adjusted to:

[0100]

[0101] On this basis, let the accumulated result C of step i be i-1 +d i Expressed as: e4·2 256 +e3·2 192 +e2·2 128 +e1·2 64 +e0, then the i-th correction result is C iThere may further be the following representations:

[0102]

[0103] That is, when i>0, the i-th correction result C i The calculation of C is simplified to: i =(e4+e0-(e0>>32))·2 192 +(e3-(e0<<32))·2 128 +(e2-(e0>>32))·2 64 +(e1+e0-(e0<<32));

[0104] When i=0, the zeroth correction result C0=(e0-(e0>>32))·2 192 -(e0<<32)·2 128 -(e0>>32)·2 64 +(e1+e0-(e0<<32)).

[0105] It should be noted that when i>0, the cumulative result C of the i-th step is i-1 +d i It is represented as a linear combination of multiple 64-bit components at different positions, then e0, e1, e2, e3, e4 represent C i-1 +d i Each 64-bit component of has a corresponding position coefficient; accordingly, when i = 0, e0, e1, e2, e3, e4 represent each 64-bit component of the zeroth product term accumulation (i.e., the first product term accumulation in multiple product term accumulations). In the above representation, z i After substituting the expression into the integer, since operations with larger bits will involve carries, further shift operations are performed to ensure that the result does not overflow, that is, >> represents a right shift operation, and << represents a left shift operation. These shift operations ensure that each 64-bit component is processed correctly and there will be no carry errors, so that the final result is a reassembled 256-bit integer.

[0106] In step S260, the last correction result is mapped back to the prime number domain to obtain the result of the modular product operation in the prime number domain.

[0107] Based on the fact that the last correction result among the multiple correction results corresponds to the result of the modular product operation (e.g., modular multiplication operation, modular product operation) in the intermediate domain, the embodiment of the present application can map the last correction result back to the prime field GF(p), thereby obtaining the result of the modular product operation (e.g., modular multiplication operation, modular product operation) under the prime field GF(p). For example, multiply the last correction result by R to eliminate R -1 , thereby mapping back to the prime number field GF(p).

[0108] For example, in modular multiplication, the modular multiplication operation in the prime field GF(p) is expressed as A·B mod p, and the modular multiplication operation in the intermediate field (such as the Montgomery field) is expressed as A·B·R -1 mod p, then the last correction result can be multiplied by R to eliminate R -1 , and thus map back to the prime field GF(p). For example, R takes 2 256 , the modular multiplication operation of the intermediate field is expressed as A·B·2 - 256 mod p, then the last correction result can be multiplied by 2 256 , to map back to the prime field GF(p).

[0109] For example, in the modular square operation, the modular square operation under the prime field GF(p) is expressed as A 2 mod p, the modular square operation in the intermediate domain (such as the Montgomery domain) is denoted by A 2 ·R -1 mod p, then the last correction result can be multiplied by R to eliminate R -1 , and thus map back to the prime field GF(p). For example, R takes 2 448 , the modular square operation of the intermediate domain is represented by A 2 2 -448 mod p, then the last correction result can be multiplied by 2 448 , to map back to the prime field GF(p).

[0110] In step S270, the data processing result of the data to be processed is determined according to the result of the modular product operation in the prime number field.

[0111] After obtaining the result of the modular product operation, the embodiment of the present application can determine the data processing result of the data to be processed based on the result of the modular product operation, thereby serving as the data processing result of the data processing scenario in which the elliptic curve cryptographic algorithm is applied. In other words, regardless of the specific scenario form of the data processing scenario, the data processing result of any data processing scenario can be determined based on the result of the modular product operation. This is because in the data processing scenario in which the elliptic curve cryptographic algorithm is applied, the modular product operation (such as modular multiplication operation, modular square operation) is the basis of the point multiplication operation of the elliptic curve, so when using the points on the elliptic curve for data encryption and decryption, digital signature and other data processing, the result of the modular product operation (such as modular multiplication operation, modular square operation) is required.

[0112] For example, the data processing result of the data encryption scenario is a ciphertext, and the ciphertext is formed by a random information part and a ciphertext part; wherein the random information part is the result of a modular product operation (such as a modular multiplication operation) of a random number and a base point on an elliptic curve; in the process of generating the ciphertext part, it is necessary to use the result of a modular product operation (such as a modular multiplication operation) of a random number and a public key, that is, the result of the operation is used to derive a symmetric key through a key derivation function, and then the symmetric key and the plaintext are further operated to obtain the ciphertext part.

[0113] For example, the data processing result of the data decryption scenario is plaintext, and the symmetric key required to decrypt the ciphertext part of the ciphertext is obtained based on the result of a modular product operation (such as a modular multiplication operation) between the private key and the random information part, that is, the result of a modular product operation (such as a modular multiplication operation) between the private key and the random information part is used to derive a symmetric key through a key derivation function, and then the symmetric key and the ciphertext part are further operated to restore the plaintext.

[0114] For example, the data processing result of the digital signature scenario is the signature data. The generation of the signature pair of the signature data requires the use of the result of the modular product operation (such as modular multiplication operation) of the random number and the base point of the elliptic curve, that is, the result of the modular product operation (such as modular multiplication operation) of the random number and the base point of the elliptic curve is used as the intermediate data to participate in the generation process of the signature pair of the signature data to generate the signature pair of the signature data.

[0115] The data processing method provided in the embodiment of the present application can determine the data processing result of the data to be processed based on the result of the modular product operation of the elliptic curve cryptographic algorithm when using the elliptic curve cryptographic algorithm to process the data to be processed, thereby realizing data processing in the data processing scenario of applying the elliptic curve cryptographic algorithm and obtaining the data processing result of the data processing scenario. Specifically, the elliptic curve of the elliptic curve cryptography algorithm is defined in the prime number domain, and the modular product operation of the elliptic curve cryptography algorithm takes the product modulo the prime numbers in the prime number domain. Then, during the operation process of the modular product operation, the embodiment of the present application can determine multiple input multipliers of the modular product operation, where the input multipliers are represented in binary, thereby determining the accumulation of multiple product terms corresponding to the multiplication of the binary representations of the multiple input multipliers; further, in the step-by-step accumulation process of the product term accumulation, the accumulation result of each step of the accumulation is corrected using the correction factor of the intermediate domain and the prime numbers of the prime number domain to obtain multiple corrected results, and the last corrected result of the multiple corrected results corresponds to the result of the modular multiplication operation in the intermediate domain; then the last corrected result is mapped back to the prime number domain to obtain the operation result of the modular product operation in the prime number domain, so as to determine the data processing result of the data to be processed based on the operation result of the modular product operation in the prime number domain. Since the correction factor of the intermediate domain can map the operation to the intermediate domain to eliminate the division operation during the gradual accumulation of the product terms, the embodiment of the present application can simplify the complexity of the modular product operation, and the embodiment of the present application uses prime numbers to make the gradually obtained correction results converge in the direction of prime numbers, so that the last correction result can be mapped back to the prime number domain to ensure the accuracy of the operation result.

[0116] Therefore, the embodiment of the present application can utilize the correction factor of the intermediate domain and the prime number of the prime number domain to convert the modular product operation to the intermediate domain during the gradual accumulation of the product terms, so as to eliminate the complex division operation, reduce the computational overhead, improve the computational efficiency of the modular product operation, and ensure the accuracy of the computational result. Therefore, the embodiment of the present application can improve the computational performance of the modular product operation, thereby improving the algorithm performance of the elliptic curve cryptographic algorithm, and further improve the data processing performance of the elliptic curve cryptographic algorithm, and realize efficient and accurate data processing.

[0117] Furthermore, the embodiment of the present application can be based on the prime number p being 256 bits, and represented as p=2 256 -2 224 -2 96 +2 64 -1, the i-th correction result C i The calculation is simplified to Among them, z i =(C i-1 +d i )mod 2 64 , thereby simplifying the step-by-step accumulation process of product term accumulation.

[0118] On this basis, the i-th correction result C when i>0 and i=0 i The calculation of can be simplified to the shift operation of the components, that is, when i>0, the i-th correction result C i The calculation is (e4+e0-(e0>>32))·2 192 +(e3-(e0<<32))·2 128 +(e2-(e0>>32))·2 64 +(e1+e0-(e0<<32)), when i=0, the calculation of the zeroth correction result C0 is (e0-(e9>>32))·2 192 -(e0<<32)·2 128 -(e0>>32)·2 64 +(e1+e0-(e0<<32)), thereby further simplifying the amount of calculation, especially simplifying the number of multiplication operations.

[0119] The modular product operation is described below by taking the modular product operation as a modular multiplication operation and the modular square operation as examples. It can be understood that the modular square operation can actually be regarded as a special modular multiplication operation, that is, a modular multiplication operation with the same input multipliers, but it is expressed as a square in the operation.

[0120] As an optional implementation, taking modular product operation as modular multiplication operation as an example, Figure 3 The flowchart of the modular multiplication operation provided in the embodiment of the present application is shown by way of example. Figure 3 The relevant introduction of the process steps can be referred to the previous description. The following is mainly Figure 3 The process below takes the example that the element size of the prime number field is 256 bits (ie, the prime number is 256 bits) and the bit width of the processor is 64 bits to introduce the optional examples under the process steps.

[0121] like Figure 3 As shown, the process may include the following steps.

[0122] In step S310, a first binary representation of a first input multiplier is determined, where the first binary representation is a linear combination of multiple components of the first input multiplier and multiple position coefficients, wherein one component corresponds to one position coefficient, representing a shift of the component.

[0123] For ease of explanation, the binary representation of the first input multiplier is referred to as a first binary representation. Assuming the first input multiplier is represented by A, the first binary representation of the first input multiplier A can be:

[0124]

[0125] For example, the prime number p of the prime field GF(p) may be a 256-bit prime number, and accordingly, the size of the first input multiplier A is 256 bits. Furthermore, when the bit width w of the processor is 64 bits, the first binary representation of the first input multiplier A may be: a0+a1·2 64 +a2·2 128 +a3·2 192 .

[0126] Where a0 is the zeroth component of the first input multiplier A, and occupies the first 64 bits (i.e., bits 0 to 63) in the binary number of the first input multiplier A. a0 is already in the correct position of the first input multiplier A and does not need to be shifted, so the position coefficient of a0 is 2 0 , which is represented in the first binary representation as a0·2 0 , a0·2 0 Abbreviated as a0;

[0127] a1 is the first component of the first input multiplier A, and occupies the second 64-bit position (i.e., the 64th to the 127th bit) in the binary number of the first input multiplier A. In order to place a1 in the correct position of the first input multiplier A, a1 needs to be shifted by 64 bits, i.e., the position coefficient of a1 is 2 64 , which is represented in the first binary representation as a1·2 64 ;

[0128] a2 is the second component of the first input multiplier A, and occupies the third 64-bit position (i.e., the 128th to the 191st bit) in the binary number of the first input multiplier A. In order to place a2 in the correct position of the first input multiplier A, a2 needs to be shifted 128 bits, i.e., the position coefficient of a2 is 2 128 , which is represented in the first binary representation as a2·2 128 ;

[0129] a3 is the third component of the first input multiplier A, and occupies the fourth 64-bit position (i.e., the 192th to the 255th bit) in the binary number of the first input multiplier A. In order to place a3 in the correct position of the first input multiplier A, a3 needs to be shifted by 192 bits, i.e., the position coefficient of a3 is 2 192 , which is represented in the first binary representation as a3·2 192 .

[0130] That is, in the first binary representation, each component of the first input multiplier A is correspondingly shifted by the position coefficient to ensure that each component can be placed in the correct position of the first input multiplier A.

[0131] In step S320, a second binary representation of the second input multiplier is determined, where the second binary representation is a linear combination of multiple components of the second input multiplier and multiple position coefficients, wherein one component corresponds to one position coefficient, representing a shift of the component.

[0132] The implementation of step S320 is similar to step S310, except that step S320 is for the second input multiplier. For ease of explanation, the binary representation of the second input multiplier is referred to as the second binary representation. Assuming the second input multiplier is represented as B, the second binary representation of the second input multiplier B can be:

[0133]

[0134] The i-th component of the second input multiplier B is represented by b i .

[0135] For example, the second input multiplier B belongs to an element of the prime field GF(p), and the size of the second input multiplier B is 256 bits. Furthermore, when the bit width w of the processor is 64 bits, the second binary representation of the second input multiplier B can be: b0+b1·2 64 +b2·2 128 +b3·2 192 .

[0136] Among them, b0 is the zeroth component of the second input multiplier B, which is the lowest 64 bits of the second input multiplier B and does not need to be shifted. The corresponding position coefficient is 2 0 , in the second binary representation b0·2 0 Abbreviated as b0; b1 is the first component of the second input multiplier B. In the second binary representation, b1·2 64 b1 is shifted by 64 bits, which corresponds to the 64th to 127th bits in the binary number of the second input multiplier B; b2 is the second component of the second input multiplier B, b2·2 128 b2 is shifted by 128 bits, which corresponds to the 128th to 191th bits in the binary number of the second input multiplier B; b3 is the third component of the second input multiplier B, b3·2 192 It indicates that b3 is shifted by 192 bits, that is, it corresponds to the 192th to 255th bits in the binary number of the second input multiplier B. That is to say, in the second binary representation, each component of the second input multiplier B is shifted accordingly by the position coefficient to ensure that each component can be placed in the correct position of the second input multiplier B.

[0137] In step S330, the first binary representation and the second binary representation are multiplied to obtain a product result, and the product result is expanded to obtain a plurality of product terms, wherein the plurality of product terms are added to form the product result.

[0138] Assume that the product of the multiplication of the first binary representation and the second binary representation is D. Taking the above example of the first binary representation and the second binary representation, D = A·B = (a0+a1·2 64 +a2·2 128 +a3·2 192 )·(b0+b1·2 64 +b2·2 128 +b3·2 192 );

[0139] Further, the product result D is expanded to obtain multiple product terms, and the product result D is expressed as the addition of multiple product terms. Specifically, the product result D can be expressed as follows after expansion:

[0140] a0b0+a0b1·2 64 +a0b2·2 128 +a0b3·2 192 +a1b0·2 64 +a1b1·2 128 +a1b2·2 192 +a1b3·2 256 +a2b0·2 128 +a2b1·2 192 +a2b2·2 256 +a2b3·2 320 +a3b0·2 192 +a3b1·2 256 +a3b2·2 320 +a3b3·2 384 .

[0141] That is, each term in the first binary representation and the second binary representation is cross-multiplied, for example, each term in the first binary representation is multiplied with each term in the second binary representation, to obtain a plurality of product terms, and the plurality of product terms are added to form a product result.

[0142] In step S340, multiple product terms are classified according to position coefficients to obtain multiple product term accumulations corresponding to different position coefficients, and one product term accumulation corresponds to one position coefficient, indicating the shift of the product term accumulation.

[0143] The embodiment of the present application can classify multiple product terms of the product result according to the position coefficients, so as to obtain different product term accumulations corresponding to different position coefficients, that is, multiple product term accumulations, and one product term accumulation corresponds to one position coefficient, which is used to represent the shift of the product term accumulation.

[0144] For example, in modular multiplication, the multiple product terms of the product result can be calculated according to 2 0 The position coefficient, 264 The position coefficient, 2 128 The position coefficient, 2 192 The position coefficients are classified respectively, so as to obtain the corresponding 2 0 The zeroth product term accumulation of the position coefficient (i.e., the accumulation of product terms that do not require additional shifting among multiple product terms) corresponds to 2 64 The first product term accumulation of the position coefficient (that is, the accumulation of product terms that need to be shifted 64 bits among multiple product terms) corresponds to 2 128 The second product term accumulation of the position coefficient (that is, the accumulation of product terms that need to be shifted 128 bits among multiple product terms) corresponds to 2 192 The third product term of the position coefficient is accumulated (that is, the accumulation of the product terms among the multiple product terms that need to be shifted 192 bits).

[0145] For example, corresponding to 2 0 The zeroth product term accumulation of the position coefficient can be expressed as d0, so based on the product result D of the above example, the zeroth product term accumulation d0 can be expressed as:

[0146] d0=a0b0+a0b1·2 64 +a0b2·2 128 +a0b3·2 192 ;

[0147] That is, the product term classified by the zeroth product term accumulation d0 is the product term that does not require additional shifting in the product result, so the position coefficient corresponding to the zeroth product term accumulation d0 is 2 0 .

[0148] For example, corresponding to 2 64 The first product term accumulation of the position coefficient can be expressed as d1, so based on the product result D of the above example, the first product term accumulation d1 can be expressed as:

[0149] d1=a1b0+a1b1·2 64 +a1b2·2 128 +a1b3·2 192 ;

[0150] That is, the product term classified by the first product term accumulation d1 is the product term that needs to be shifted 64 bits in the product result, so the position coefficient corresponding to the first product term accumulation d1 is 2 64 .

[0151] For example, corresponding to 2 128 The second product term accumulation of the position coefficient can be expressed as d2, so based on the product result D of the above example, the second product term accumulation d2 can be expressed as:

[0152] d2=a2b0+a2b1·2 64 +a2b2·2 128 +a2b3·2 192 ;

[0153] That is, the product term classified by the second product term accumulation d2 is the product term that needs to be shifted 128 bits in the product result, so the position coefficient corresponding to the second product term accumulation d2 is 2 128 .

[0154] For example, corresponding to 2 192 The third product term accumulation of the position coefficient can be expressed as d3, so based on the product result D of the above example, the third product term accumulation d3 can be expressed as:

[0155] d3=a3b0+a3b1·2 64 +a3b2·2 128 +a3b3·2 192 ;

[0156] That is, the product term classified by the third product term accumulation d3 is the product term that needs to be shifted 192 bits in the product result, so the position coefficient corresponding to the third product term accumulation d3 is 2 192 .

[0157] Furthermore, in the above example, the product result D can be expressed as:

[0158] D=A·B=d0·2 0 +d1·2 64 +d2·2 128 +d3·2 192 =(a0b0+a0b1·2 64 +a0b2·2 128 +a0b3·2 192 )+(a1b0·2 64 +a1b1·2 128 +a1b2·2 192 +a1b3·2 256 )+(a2b0·2 128 +a2b1·2 192 +a2b2·2 256 +a2b3·2 320 )+(a3b0·2 192 +a3b1·2 256 +a3b2·2 320 +a3b3·2 384 ).

[0159] In step S350, multiple product terms are accumulated step by step in order from low to high, and the accumulated result of each step is corrected by using correction factors and prime numbers, so that the next step of accumulation accumulates the next product term on the basis of the corrected result corresponding to the previous step of accumulation, until the accumulated result of the last step of accumulation is corrected to obtain multiple corrected results; the last corrected result among the multiple corrected results corresponds to the result of the modular multiplication operation of the intermediate domain.

[0160] In an optional implementation, based on the i-th modified result C i The relevant formula is expressed as 2 64 ·C i =(C i-1 +d i )+(μ·(C i-1 +d i )mod 2 64 )·p, taking the zeroth product term accumulation d0 to the third product term accumulation d3 in the above example as an example, according to the order of the position coefficient from small to large, the zeroth product term accumulation d0 to the third product term accumulation d3 are gradually accumulated, and the accumulation process can be as follows.

[0161] First, the zeroth product term accumulation d0 (i.e., the first product term accumulation) is accumulated, and the correction factor μ and the prime number p are used to correct it to obtain the zeroth correction result;

[0162] As an example, the zeroth correction result is represented as C0, and the formula related to the zeroth correction result C0 can be expressed as:

[0163] 2 64 C0=d0+(μ·d0mod 2 64 )·p;

[0164] It can be seen that the correction factor μ and the prime number p are introduced to correct the zeroth product term accumulation d0 of the first accumulation process, so that the accumulation process is mapped to the intermediate domain (such as the Montgomery domain) corresponding to the correction factor μ and maintained in the intermediate domain (such as the Montgomery domain) to eliminate the division operation; at the same time, the zeroth correction result C0 is maintained in a reasonable range (i.e., a range close to the prime number p) to avoid the subsequent results being unable to be mapped back to the prime number domain GF(p). In other words, the correction factor μ is used to map the operation to the intermediate domain to eliminate the division operation, and the prime number p makes the correction result converge toward the direction of the prime number p.

[0165] Further, based on the zeroth correction result C0, the first product term accumulation d1 is accumulated, and the accumulated result is corrected by using the correction factor μ and the prime number p to obtain the first correction result; as an example, the first correction result is expressed as C1, and the formula related to the first correction result C1 can be expressed as:

[0166] 2 64 ·C1=(C0+d1)+(μ·(C0+d1)mod 2 64 )·p;

[0167] It can be seen that the correction factor μ and the prime number p are introduced to correct the cumulative result (C0+d1) of the zeroth correction result C0 and the first product term accumulation d1, so that the accumulation process is mapped to the intermediate domain corresponding to the correction factor μ and maintained in the intermediate domain to eliminate the division operation; at the same time, the first correction result C1 is close to the reasonable range of the prime number p.

[0168] Further, based on the first corrected result C1, the second product term d2 is accumulated, and the accumulated result is corrected by using the correction factor μ and the prime number p to obtain a second corrected result; as an example, the second corrected result is expressed as C2, and the formula related to the second corrected result C2 can be expressed as:

[0169] 2 64 ·C2=(C1+d2)+(μ·(C1+d2)mod 2 64 )·p;

[0170] It can be seen that the correction factor μ and the prime number p are introduced to correct the cumulative result (C1+d2) of the first correction result C1 and the second product term accumulation d2, so that the accumulation process is mapped to the intermediate domain corresponding to the correction factor μ and maintained in the intermediate domain to eliminate the division operation; at the same time, the second correction result C2 is close to the reasonable range of the prime number p.

[0171] Further, based on the second corrected result C2, the third product term d3 is accumulated, and the accumulated result is corrected by using the correction factor μ and the prime number p to obtain a third corrected result; as an example, the third corrected result is expressed as C3, and the formula related to the third corrected result C3 can be expressed as:

[0172] 2 64 ·C3=(C2+d3)+(μ·(C2+d3)mod 2 64 )·p;

[0173] It can be seen that the correction factor μ and the prime number p are introduced to correct the cumulative result (C2+d3) of the second correction result C2 and the third product term accumulation d3, so that the accumulation process is mapped to the intermediate domain corresponding to the correction factor μ and maintained in the intermediate domain to eliminate the division operation; at the same time, the third correction result C3 is close to the reasonable range of the prime number p.

[0174] That is, in the accumulation of step i, the correction factor μ and the prime number p are introduced to correct the i-1th correction result C i-1 Cumulative product d with the i-th product termi The cumulative result (C i-1 +d i ), so that the i-th step accumulation is mapped to the intermediate domain corresponding to the correction factor μ and kept in the intermediate domain to eliminate the division operation; at the same time, the i-th correction result C i It is within the reasonable range close to the prime number p. It should be noted that when i is 0, the first accumulation process is actually performed, that is, the zeroth product term is accumulated and d0 is corrected. Therefore, when i is 0, C i-1 Does not exist.

[0175] After completing the above-mentioned step-by-step accumulation process, the last correction result (for example, the third correction result C3) is the result of the modular multiplication operation in the intermediate field, so the last correction result is mapped back to the prime number field GF(p), and the result of the modular multiplication operation under the prime number field GF(p) can be obtained.

[0176] Specifically, the modular multiplication operation in the prime field is expressed as A·B mod p, and the modular multiplication operation in the intermediate field is expressed as A·B·R -1 mod p, taking the third correction result C3 in the above example as the last correction result, in the above step-by-step accumulation and correction process to obtain the third correction result C3, a total of 4 steps of accumulation are performed, so R can be 2 64×4 (i.e. 2 256 ), so C3≡A·B·2 -256 mod p, that is, the third correction result C3 is the result of the modular multiplication operation of the intermediate field; then, the third correction result C3 (the last correction result) is mapped back to the prime field GF(p), for example, multiplied by 2 256 , we can get the result of modular multiplication A·B mod p under the prime field GF(p).

[0177] In a further optional implementation, based on the i-th correction result C further provided in the embodiment of the present application i The calculation is simplified, that is And the specific decomposition of i>0 and the simplified calculation when i=0 is expressed as follows: when i>0, the i-th correction result C i The calculation is (e4+e0-(e0>>32))·2 192 +(e3-(e0<<32))·2 128 +(e2-(e0>>32))·2 64 +(e1+e0-(e0<<32)), when i=0, the calculation of the zeroth correction result C0 is (e0-(e0>>32))·2 192 -(e0<<32)·2 128 -(e0>>32)·2 64+(e1+e0-(e0<<32)), the embodiment of the present application can further simplify the calculation of the i-th correction result C under modular multiplication operation. i Calculation.

[0178] Taking the ith step accumulation under modular multiplication as an example, the ith correction result C corresponding to the ith step accumulation is i The formula is:2 64 ·C i =(C i-1 +d i )+(μ·(C i-1 +d i )mod 2 64 )·p; It can be seen that one step of accumulation involves one multiplication by the prime number p, and one multiplication by the prime number p involves four 64-bit multiplications. Therefore, taking the third correction result C3 as the last correction result as an example, there are four step-by-step accumulations and each accumulation is multiplied by the prime number p, so there are a total of 16 (4 times 4) 64-bit multiplications. In this regard, the embodiment of the present application can use the i-th correction result C i The calculation simplification of , as well as the calculation simplification when i>0 and when i=0, are used to simplify the number of multiplication operations under modular multiplication operations.

[0179] Specifically, the calculation simplification of the zeroth correction result C0, the first correction result C1, the second correction result C2, and the third correction result C3 is illustrated below.

[0180] When calculating the zeroth correction result C0, i_0, and the zeroth product term d0 is accumulated and corrected, where d0 can be expressed as d0=a0b0+a0b1·2 64 +a0b2·2 128 +a0b3·2 192 = fl0+(fh0+fl1)·2 64 +(fh1+fl2)·2 128 +(fh2+fl3)·2 192 +fh3·2 256 ; Among them, fl i (e.g. fl0, fl1, fl2, fl3), fh i (e.g. fh0, fh1, fh2, fh3) are the intermediate values ​​generated in the process of expanding d0, that is, d0 is 2 0 to 2 256 The intermediate values ​​produced when the position coefficients are expanded;

[0181] Let eh=fl0<<32, indicating that fl0 is shifted to the left by 32 bits, and el=fl0>>32, indicating that fl0 is shifted to the right by 32 bits. Then the process of calculating the zeroth correction result C0 can be expressed as:

[0182] cf 01 2 64 +c 00 =e1+e0-(e0<<32)=fh0+fl1+fl0-eh=fh0+fl0+fl1+(2 64 -eh)-2 64 ;

[0183] cf 02 2 64 +c 01 =e2-(e0>>32)+cf 01 =fh1+fl2-el=fh1+fl2+(2 64 -el)+cf 01 -2 64 ;

[0184] cf 03 2 64 +c 02 =e3-(e0<<32)+cf 02 =fh2+fl3+(2 64 -eh)+cf 02 -2 64 ;

[0185] cf 04 2 64 +c 03 =e4+e0-(e0>>32)+cf 03 =fh3+fl0+(2 64 -el)+cf 03 -2 64 ;

[0186] c 04 =cf 04 ;

[0187] Among them, c 0i (For example, c 00 、c 01 、c 02 、c 03 、c 04 ) is the intermediate calculation result of each step in the calculation process of the zeroth correction result C0, that is, the intermediate calculation result of the zeroth correction result C0 at different positions, and then the intermediate calculation result c at each position 0i The zeroth correction result C0 is obtained by carrying; cf 0i (For example, cf 01 , cf 02 , cf 03 , cf 04 ) is the carry value.

[0188] Further simplifying, the above process of calculating the zeroth correction result C0 can be simplified as follows:

[0189] cf 01 2 64 +c 00 =e1+e0-(e0<<32)=fh0+fl1+fl0-eh=fh0+fl0+fl1+(~eh)+1;

[0190] cf 02 2 64 +c 01 =e2-(e0>>32)+cf 01 =fh1+fl2-el=fh1+fl2+(~el)+cf 01 ;

[0191] cf 03 2 64 +c 02 =e3-(e0<<32)+cf 02 =fh2+fl3+(~eh)+cf 02 ;

[0192] cf 04 2 64 +c 03 =e4+e0-(e0>>32)+cf 03 =fh3+fl0+(~el)+cf 03 ;

[0193] c 04 =cf 04 -1;

[0194] Among them, ~ represents the bitwise inversion operation, that is, inverting each bit of the binary number in the bit operation, such as changing 0 to 1 and 1 to 0;

[0195] It can be seen that when i_0, the calculation of the zeroth correction result C0 requires 4 multiplications, 9 additions, 2 shifts and 2 inversions of 64 bits, where the carry value cf 0i The value of cf is 0 or 1; when using the carry addition instruction, 0i The addition time can be hidden in the 64-bit addition.

[0196] When calculating the first correction result C1, i_1, and the first product term d1 is accumulated and corrected, where d1 can be expressed as d1 = a1b0 + a1b1 · 2 64 +a1b2·2 128 +a1b3·2 192= fl0+(fh0+fl1)·2 64 +(fh1+fl2)·2 128 +(fh2+fl3)·2 192 +fh3·2 256 , similarly, the fl here i (e.g. fl0, fl1, fl2, fl3), fh i (e.g. fh0, fh1, fh2, fh3) is to convert d1 to 2 0 to 2 256 The intermediate values ​​produced when the position coefficients are expanded;

[0197] Correspondingly, the cumulative result C0+d1 of step 1(i_1) can be expressed as C0+d1=(c 04 +fh3)·2 256 +(c 03 +fh2+fl3)·2 192 +(c 02 +fh1+fl2)·2 128 +(c 01 +fh0+fl1)·2 64 +(c 00 +fl0), where cf 10 2 64 +e0=c 00 +fl0;

[0198] Let eh=e0<<32, el=e0>>32, then the process of calculating the first correction result C1 can be expressed as:

[0199] cf 11 2 64 +c 10 =e1+e0-(e0<<32)=(c 01 +fh0+fl1)+e0-eh=(c 01 +fh0+fl1)+e0+(~eh)+1+cf10;

[0200] cf 12 2 64 +c 11 =e2-(e0>>32)+cf 11 +cf 10 =(c 02 +fh1+fl2)+(~el)+cf 11 ;

[0201] cf 13 2 64 +c 12 =e3-(e0<<32)+cf12 =(c 03 +fh2+fl3)+(~eh)+cf 12 ;

[0202] cf 14 2 64 +c 13 =e4+e0-(e0>>32)+cf 13 =(c 04 +fh3)+e0+(~el)+cf 13 ;

[0203] c 14 =cf 14 -1;

[0204] It should be noted that when i>0, e0, e1, e2, e3, and e4 represent the cumulative result C of the i-th step accumulation. i-1 +d i Each 64-bit component of , correspondingly, when the current i_1, e0, e1, e2, e3, e4 represent each 64-bit component of the accumulated result C0+d1 accumulated in step 1;

[0205] Similarly, c 1i (For example, c 10 、c 11 、c 12 、c 13 、c 14 ) is the intermediate calculation result of each step in the calculation process of the first correction result C1, that is, the intermediate calculation result of the first correction result C1 at different positions, and then the intermediate calculation result c at each position 1i The first correction result C1 is obtained by carrying; cf 1i (For example, cf 10 , cf 11 , cf 12 , cf 13 , cf 14 ) is the carry value;

[0206] It can be seen that when i_1, the calculation of the first correction result C1 requires 4 multiplications, 13 additions, 2 shifts and 2 inversions of 64 bits, where the carry value cf 1i The value is 0 or 1; when using the carry addition instruction, cf 1i The addition time can be hidden in the 64-bit addition.

[0207] When calculating the second correction result C2, i_2, and the second product term d2 is accumulated and corrected, where d2 can be expressed as d2 = a2b0 + a2b1 · 2 64 +a2b2·2128 +a2b3·2 192 = fl0+(fh0+fl1)·2 64 +(fh1+fl2)·2 128 +(fh2+fl3)·2 192 +fh3·2 256 ; Similarly, the fl here i (e.g. fl0, fl1, fl2, fl3), fh i (e.g. fh0, fh1, fh2, fh3) is to change d2 to 2 0 to 2 256 The intermediate values ​​produced when the position coefficients are expanded;

[0208] Correspondingly, the cumulative result C1+d2 of step 2(i_2) can be expressed as C1+d2=(c 14 +fh3)·2 256 +(c 13 +fh2+fl3)·2 192 +(c 12 +fh1+fl2)·2 128 +(c 11 +fh0+fl1)·2 64 +(c 10 +fl0), where cf 20 2 64 +e0=c 10 +fl0;

[0209] Let eh=e0<<32, el=e0>>32, then the process of calculating the second correction result C2 can be expressed as:

[0210] cf 21 2 64 +c 20 =e1+e0-(e0<<32)=(c 11 +fh0+fl1)+e0+(~eh)+1+cf 20 ;

[0211] cf 22 2 64 +c 21 =e2-(e0>>32)+cf 20 +cf 21 =(c 12 +fh1+fl2)+(~el)+cf 21 ;

[0212] cf 23 2 64 +c 22=e3-(e0<<32)+cf 22 =(c 13 +fh2+fl3)+(~eh)+cf 22 ;

[0213] cf 24 2 64 +c 23 =e4+e0-(e0>>32)+cf 23 =(c 14 +fh3)+e0+(~el)+cf 23 ;

[0214] c 24 =cf 24 -1;

[0215] Similarly, when i_2, e0, e1, e2, e3, and e4 are respectively represented as the 64-bit components of the accumulated result C1+d2 in step 2; c 2i (For example, c 20 、c 21 、c 22 、c 23 、c 24 ) is the intermediate calculation result of each step in the calculation process of the second correction result C2, that is, the intermediate calculation result of the second correction result C2 at different positions, and then the intermediate calculation result c at each position 2i The second correction result C2 is obtained by carrying; cf 2i (For example, cf 20 , cf 21 , cf 22 , cf 23 , cf 24 ) is the carry value;

[0216] It can be seen that when i_2, the calculation of the second correction result C2 requires 4 multiplications, 13 additions, 2 shifts and 2 inversions of 64 bits, where the carry value cf 2i The value is 0 or 1. When using the carry addition instruction, cf 2i The addition time can be hidden in the 64-bit addition.

[0217] When calculating the third correction result C3, i_3, and the third product term d3 is accumulated and corrected, where d3 can be expressed as d3 = a3b0 + a3b1 · 2 64 +a3b2·2 128 +a3b3·2 192 = fl0+(fh0+fl1)·2 64 +(fh1+fl2)·2 128+(fh2+fl3)·2 192 +fh3·2 256 ; Similarly, the fl here i (e.g. fl0, fl1, fl2, fl3), fh i (e.g. fh0, fh1, fh2, fh3) is to change d3 to 2 0 to 2 256 The intermediate values ​​produced when the position coefficients are expanded;

[0218] Correspondingly, the cumulative result C2+d3 of step 3 (i_3) can be expressed as C2+d3=(c 24 +fh3)·2 256 +(c 23 +fh2+fl3)·2 192 +(c 22 +fh1+fl2)·2 128 +(c 21 +fh0+fl1)·2 64 +(c 20 +fl0), where cf 30 2 64 +e0=c 20 +fl0;

[0219] Let eh=e0<<32, el=e0>>32, then the process of calculating the third correction result C3 can be expressed as:

[0220] cf 31 2 64 +c 30 =e1+e0-(e0<<32)=(c 21 +fh0+fl1)+e0+(~eh)+1+cf 30 ;

[0221] cf 32 2 64 +c 31 =e2-(e0>>32)+cf 30 +cf 31 =(c 22 +fh1+fl2)+(~el)+cf 31 ;

[0222] cf 33 2 64 +c 32 =e3-(e0<<32)+cf 32 =(c 23 +fh2+fl3)+(~eh)+cf 32 ;

[0223] cf 34 2 64 +c 33 =e4+e0-(e0>>32)+cf 33 =(c 24 +fh3)+e0+(~el)+cf 33 ;

[0224] c 34 =cf 34 -1;

[0225] Similarly, when i_3, e0, e1, e2, e3, and e4 are respectively represented as the 64-bit components of the accumulated result C2+d3 accumulated in step 3; c 3i (For example, c 30 、c 31 、c 32 、c 33 、c 34 ) is the intermediate calculation result of each step in the calculation process of the third correction result C3, that is, the intermediate calculation result of the third correction result C3 at different positions, and then the intermediate calculation result c at each position 3i The third correction result C3 is obtained by carrying; cf 3i (For example, cf 30 , cf 31 , cf 32 , cf 33 , cf 34 ) is the carry value;

[0226] It can be seen that when i=3, the calculation of the third correction result C3 requires 4 multiplications of 64 bits, 13 additions, 2 shifts and 2 inversions, where the carry value cf 3i The value is 0 or 1. When using the carry addition instruction, cf 3i The addition time can be hidden in the 64-bit addition.

[0227] In summary, the total amount of calculation from the zeroth correction result C0 to the third correction result C3 is 16 multiplications, 48 ​​additions, 8 shifts and 8 inversions of 64 bits, which can greatly reduce the amount of calculation compared to directly performing modular multiplication in the Montgomery domain. That is, using the above-mentioned i-th correction result C i The simplified calculation and simplified calculation when i>0 and when i=0 can reduce the amount of calculation; for example, compared with 32 multiplications of 64 bits required for modular multiplication directly in the Montgomery field, the above simplified calculation method can greatly reduce the amount of calculation in the multiplication operation (for example, reduce the amount of calculation by half).

[0228] As an optional implementation, take the modular product operation as the modular square operation as an example, Figure 4 The flowchart of the modular square operation provided in the embodiment of the present application is exemplarily shown. Figure 4 The relevant introduction of the process steps can be referred to the previous description. The following is mainly Figure 4 The process below takes the example that the element size of the prime number field is 256 bits (ie, the prime number is 256 bits) and the bit width of the processor is 64 bits to introduce the optional examples under the process steps.

[0229] like Figure 4 As shown, the process may include the following steps.

[0230] In step S410, a binary representation of an input multiplier of a modular square operation is determined, wherein the binary representation of the input multiplier is a linear combination of multiple components of the input multiplier and multiple position coefficients, wherein one component corresponds to one position coefficient, indicating a shift of the component.

[0231] When performing a modular square operation, multiple input multipliers of the modular square operation are the same, that is, the same input multiplier is squared and modulo a prime number, so it is sufficient to determine the binary representation of the same input multiplier. For ease of explanation, the representation of the first input multiplier A defined by the modular multiplication operation is borrowed, and the input multiplier for the modular square operation is represented as A, and the representation of the input multiplier A of the modular square operation can refer to the description of the corresponding part of the previous text.

[0232] For example, the prime number p in the prime field GF(p) is 256 bits (the prime number p is represented by p=2 256 -2 224 -2 96 +2 64 -1), the input multiplier A of the modular square operation is an element of the prime field GF(p), and the binary representation of the input multiplier A of the modular square operation is a0+a1·2 64 +a2·2 128 +a3·2 192 .

[0233] In step S420, a binary representation of an input multiplier of the modular square operation is squared to obtain a product result, and the product result is expanded to obtain a plurality of product terms, wherein the plurality of product terms are added to form the product result.

[0234] In step S430, multiple product terms are classified according to position coefficients to obtain multiple product term accumulations corresponding to different position coefficients, and one product term accumulation corresponds to one position coefficient, indicating the shift of the product term accumulation.

[0235] The result of the square operation of the binary representation of the input multiplier of the modular square operation is called the product result. Let the product result of the modular square operation be represented by A2 , then A 2 =(a0+a1·2 64 +a2·2 128 +a3·2 192 ) 2 .

[0236] Furthermore, the product result A 2 Expanding, we can get multiple product terms, and the product result A 2 It is expressed as the addition of multiple product terms, and then the multiple product terms are classified according to the position coefficients, so that multiple product terms can be accumulated.

[0237] For example, the product result is A 2 After the multiple product terms of are classified according to the position coefficients, they can be expressed as:

[0238]

[0239] In the above example, the product A 2 There are 7 product term accumulations (the product term accumulation sequence starts from 0), specifically:

[0240] The zeroth product term accumulates d0, Represents the product result A 2 The lowest-order component (i.e., the first 64-bit component) does not need to be shifted, and the position coefficient is 2 0 ;

[0241] The first product term accumulates d1, d1 = 2a0a1, representing the product result A 2 The second 64-bit component in needs to be shifted 64 bits, and the position coefficient is 2 64 ;

[0242] The second product term accumulates d2, Represents the product result A 2 The third 64-bit component in needs to be shifted 128 bits, and the position coefficient is 2 128 ;

[0243] The third product term accumulates d3, d3 = 2a0a3 + 2a1a2, representing the product result A 2 The fourth 64-bit component in needs to be shifted 192 bits, and the position coefficient is 2 192 ;

[0244] The fourth product term accumulates d4, Represents the product result A 2 The fifth 64-bit component in needs to be shifted 256 bits, and the position coefficient is 2 256 ;

[0245] The fifth product term accumulates d5, d5 = 2a2a3, representing the product result A 2 The sixth 64-bit component in needs to be shifted 320 bits, and the position coefficient is 2 320 ;

[0246] The sixth product term accumulates d6, Represents the product result A 2 The seventh 64-bit component in needs to be shifted 384 bits, and the position coefficient is 2 384 .

[0247] In step S440, multiple product terms are accumulated step by step in order from low to high, and the accumulated result of each step is corrected by using correction factors and prime numbers, so that the next step of accumulation is to accumulate the next product term on the basis of the corrected result corresponding to the previous step of accumulation, until the accumulated result of the last step of accumulation is corrected to obtain multiple corrected results; the last corrected result among the multiple corrected results corresponds to the result of the modular square operation of the intermediate domain.

[0248] In an optional implementation, based on the i-th modified result C i The relevant formula is expressed as 2 64 ·C i =(C i-1 +d i )+(μ·(C i-1 +d i )mod 2 64 )·p, taking the zeroth product term accumulation d0 to the sixth product term accumulation d6 in the above example as an example, the zeroth product term accumulation d0 to the sixth product term accumulation d6 are gradually accumulated in the order of the position coefficient from small to large, and the accumulation process can be as follows.

[0249] First, the zeroth product term d0 is accumulated and corrected using the correction factor μ and the prime number p to obtain the zeroth corrected result C0. The formula related to the zeroth corrected result C0 can be expressed as:

[0250] 2 64 C0=d0+(μ·d0 mod 2 64 )·p.

[0251] Further, based on the zeroth correction result C0, the first product term d1 is accumulated, and the accumulated result is corrected by using the correction factor μ and the prime number p to obtain the first correction result C1. The formula related to the first correction result C1 can be expressed as:

[0252] 2 64 ·C1=(C0+d1)+(u·(C0+d1)mod 2 64 )·p.

[0253] Further, based on the first corrected result C1, the second product term d2 is accumulated, and the accumulated result is corrected by using the correction factor μ and the prime number p to obtain the second corrected result C2. The formula related to the second corrected result C2 can be expressed as:

[0254] 2 64 ·C2=(C1+d2)+(u·(C1+d2)mod 2 64 )·p.

[0255] Further, based on the second corrected result C2, the third product term d3 is accumulated, and the accumulated result is corrected by using the correction factor μ and the prime number p to obtain the third corrected result C3. The formula related to the third corrected result C3 can be expressed as:

[0256] 2 64 ·C3=(C2+d3)+(u·(C2+d3)mod 2 64 )·p.

[0257] Further, based on the third corrected result C3, the fourth product term d4 is accumulated, and the accumulated result is corrected by using the correction factor μ and the prime number p to obtain the fourth corrected result C4. The formula related to the fourth corrected result C4 can be expressed as:

[0258] 2 64 ·C4=(C3+d4)+(u·(C3+d4)mod 2 64 )·p.

[0259] Further, based on the fourth corrected result C4, the fifth product term d5 is accumulated, and the accumulated result is corrected by using the correction factor μ and the prime number p to obtain the fifth corrected result C5. The formula related to the fifth corrected result C5 can be expressed as:

[0260] 2 64 ·C5=(C4+d5)+(u·(C4+d5)mod 2 64 )·p.

[0261] Further, based on the fifth corrected result C5, the sixth product term d6 is accumulated, and the accumulated result is corrected by using the correction factor μ and the prime number p to obtain the sixth corrected result C6. The formula related to the sixth corrected result C6 can be expressed as:

[0262] 2 64 ·C6=(C5+d6)+(u·(C5+d6)mod 2 64 )·p.

[0263] In the above gradual accumulation process, the effects of the correction factor μ and the prime number p can be similarly referred to the description of the corresponding parts in the previous text and will not be elaborated again.

[0264] After completing the above-mentioned step-by-step accumulation process, the last correction result (for example, the sixth correction result C6) is the result of the modular square operation of the intermediate field, so the last correction result is mapped back to the prime number field GF(p), and the result of the modular square operation under the prime number field GF(p) can be obtained.

[0265] Specifically, the modular square operation performed in the prime field is represented by A 2 mod p, the modular square operation of the intermediate field is represented by A 2 ·R -1 mod p, taking the sixth correction result C6 in the above example as the last correction result, under the property of square operation, in the process of gradually accumulating and correcting to obtain the sixth correction result C6, a total of 7 steps of accumulation are performed, so R can be 2 64×7 (i.e. 2 448 ), so C6≡A 2 2 -448 mod p, that is, the sixth correction result C6 is the result of the modular square operation of the intermediate field; then, the sixth correction result C6 (the last correction result) is mapped back to the prime field GF(p), for example, multiplied by 2 448 , then we can get the result A of the modular square operation under the prime field GF(p) 2 mod p.

[0266] In a further optional implementation, the embodiment of the present application can further simplify the calculation of the i-th correction result C under the modular square operation. i Taking the ith step accumulation under the modular square operation as an example, the ith correction result C corresponding to the ith step accumulation is i The formula is:2 64 ·C i =(C i-1 +d i )+(μ·(C i-1 +d i )mod 2 64 )·p; It can be seen that one step of accumulation involves one multiplication by the prime number p, and one multiplication by the prime number p involves four 64-bit multiplications. Therefore, taking the sixth correction result C6 as the last correction result as an example, there are 7 step-by-step accumulations and each accumulation is multiplied by the prime number p, so there are a total of 28 (4 times 7) 64-bit multiplications. In this regard, the embodiment of the present application can use the i-th correction result C i The calculation simplification of , as well as the calculation simplification when i>0 and when i=0 are used to simplify the number of multiplication operations under the modular square operation.

[0267] That is to say, the i-th correction result C further provided in the embodiment of the present application i The calculation is simplified, that is, when p = 2 256 -2 224 -2 96 +2 64 -1, the i-th corrected result C of the modular square operation i can be simplified to Among them, z i =(C i-1 +d i )mod 2 64 ; and the specific decomposition of i>0 and the simplified calculation when i=0, that is, when i>0, the i-th correction result C i The calculation is simplified to (e4+e0-(e0>>32))·2 192 +(e3-(e0<<32))·2 128 +(e2-(e0>>32))·2 64 +(e1+e0-(e0<<32)), when i_0, the zeroth correction result C0=(e0-(e0>>32))·2 192 -(e0<<32)·2 128 -(e0>>32)·2 64 +(e1+e0-(e0<<32)), the embodiment of the present application can further simplify the calculation of the i-th correction result C under the modular square operation. i calculations, especially the multiplication operations.

[0268] Specifically, under the modular square operation, use the i-th correction result C i The calculation simplification of i>0 and the calculation simplification when i=0 are shown as follows: i Calculation and d i The calculation of the zeroth correction result C0 only requires 1 multiplication, 1 addition, 2 shifts and 4 subtractions of 64 bits; the calculation of the first correction result C1 requires 1 multiplication, 7 additions, 2 shifts and 4 subtractions of 64 bits; the calculation of the second correction result C2 requires 2 multiplications, 9 additions, 2 shifts and 4 subtractions of 64 bits; the calculation of the third correction result C3 requires 2 multiplications, 11 additions, 2 shifts and 4 subtractions of 64 bits; the calculation of the fourth correction result C4 requires 2 multiplications, 9 additions, 2 shifts and 4 subtractions of 64 bits; the calculation of the fifth correction result C5 requires 1 multiplication, 7 additions, 2 shifts and 4 subtractions of 64 bits; the calculation of the sixth correction result C6 requires 1 multiplication, 5 additions, 2 shifts and 4 subtractions of 64 bits.

[0269] In summary, the total amount of calculation for the zeroth correction result C0 to the sixth correction result C6 is 10 multiplications, 49 additions, 14 shifts and 28 subtractions of 64 bits, and it can be completed using only 16 general registers; that is, under the modular square operation, the above i-th correction result C i The simplified calculation can reduce the amount of calculation. For example, compared with 26 multiplications of 64 bits required for directly performing modular square operations in the Montgomery field, the simplified calculation method can greatly reduce the amount of calculation in the multiplication operation (for example, reducing the amount of calculation by more than half).

[0270] In summary, the embodiments of the present application can optimize the computing performance of modular product operations (such as modular multiplication operations and modular square operations), thereby improving the computing performance of elliptic curve cryptographic algorithms such as the SM2 algorithm, for example, improving the operating efficiency of elliptic curve cryptographic algorithms such as the SM2 algorithm in software implementation, and then improving the data processing performance of data processing scenarios that apply elliptic curve cryptographic algorithms such as the SM2 algorithm.

[0271] In addition to software implementation, the embodiments of the present application can extract the optimization scheme of modular product operations (such as modular multiplication operations and modular square operations) into an instruction set to support hardware acceleration of the processor. For example, based on the optimization scheme of modular product operations (such as modular multiplication operations and modular square operations), the instruction set of elliptic curve cryptographic algorithms such as the SM2 algorithm is extracted, and then when the instruction set is used for hardware implementation, the instruction set of elliptic curve cryptographic algorithms such as the SM2 algorithm with optimized modular product operations (such as modular multiplication operations and modular square operations) can develop a hardware acceleration module of the processor to use the hardware acceleration module of the processor to perform the optimized modular product operations (such as modular multiplication operations and modular square operations), thereby accelerating the execution of elliptic curve cryptographic algorithms such as the SM2 algorithm, and then improving the data processing performance of data processing scenarios in which elliptic curve cryptographic algorithms such as the SM2 algorithm are applied.

[0272] That is to say, the data processing method provided in the embodiment of the present application (i.e., the data processing scheme using the elliptic curve cryptographic algorithm with modular product operation optimization) can be applicable to software implementation or to hardware-level instruction sets, thereby achieving operation acceleration in the processor hardware.

[0273] The data processing device provided in the embodiment of the present application is introduced below. The data processing device described below can be regarded as a functional module required to implement the data processing method provided in the embodiment of the present application, and the content described below can be referenced to the content described above.

[0274] As an optional implementation, Figure 5An optional block diagram of a data processing device provided in an embodiment of the present application is shown by way of example. The device can be applied to a computer device, such as a computer device that uses an elliptic curve cryptographic algorithm such as an SM2 algorithm and an ECDSA algorithm to perform data encryption and decryption, digital signature and other data processing, including but not limited to any electronic device with data processing functions such as a terminal device and a server device; in an optional specific implementation, the data processing device can be applied to a processor in a computer device.

[0275] like Figure 5 As shown, the data processing device may include:

[0276] The to-be-processed data acquisition module 510 is used to acquire the to-be-processed data, wherein the to-be-processed data is processed using an elliptic curve cryptographic algorithm, wherein the elliptic curve of the elliptic curve cryptographic algorithm is defined in a prime number domain;

[0277] An operation input determination module 520 is used to determine input data of a modular product operation of an elliptic curve cryptographic algorithm, wherein the modular product operation takes a product modulo a prime number in a prime number field, wherein the input data includes a plurality of input multipliers for obtaining the product, and the input multipliers are in binary representation;

[0278] A product term accumulation determination module 530, configured to determine a plurality of product term accumulations corresponding to the multiplication of the binary representations of the plurality of input multipliers;

[0279] The accumulation correction module 540 is used to correct the accumulation result of each step of accumulation in the step-by-step accumulation process of accumulating multiple product terms by using the correction factor of the intermediate domain and the prime number of the prime number domain to obtain multiple correction results, wherein the last correction result of the multiple correction results corresponds to the result of the modular product operation of the intermediate domain; wherein the correction factor of the intermediate domain is used to map the operation to the intermediate domain to eliminate the division operation;

[0280] A mapping recovery module 550 is used to map the last correction result back to the prime number domain to obtain the result of the modular product operation in the prime number domain;

[0281] The data processing result determination module 560 is used to determine the data processing result of the data to be processed according to the operation result of the modular product operation in the prime number field, as the data processing result of the data processing scenario applying the elliptic curve cryptography algorithm.

[0282] In an optional implementation, the accumulation correction module 540 is used to use the correction factor of the intermediate field and the prime number of the prime field to correct the accumulation result of each step of accumulation in the step-by-step accumulation process of accumulating multiple product terms to obtain multiple correction results, which may include:

[0283] In order from low to high, multiple product terms are gradually accumulated, and the accumulated result of each step is corrected by using correction factors and prime numbers, so that the next step of accumulation is to accumulate the next product term based on the corrected result corresponding to the previous step of accumulation, until the accumulated result of the last step of accumulation is corrected to obtain multiple corrected results.

[0284] In an optional implementation, the accumulation correction module 540 is used to gradually accumulate multiple product terms in order from low to high, and use the correction factor and the prime number to correct the accumulation result of each step of accumulation, so that the next accumulation step accumulates the next product term based on the correction result corresponding to the previous accumulation step, until the accumulation result of the last accumulation step is corrected, and the multiple correction results obtained may include:

[0285] When accumulating in the i-th step, the accumulated result of the i-th step is corrected according to the following formula;

[0286] 2 64 ·C i =(C i-1 +d i )+(μ·(C i-1 +d i )mod 2 64 )·p;

[0287] Among them, C i is the i-th correction result corresponding to the i-th step accumulation, C i-1 The i-1th correction result corresponding to the i-1th step is accumulated, d i is the accumulation of the i-th product term, C i-1 +d i is the cumulative result of the i-th step, μ is the correction factor, and p is a prime number.

[0288] In an alternative implementation, the correction factor is a multiplicative inverse associated with a prime number, and the correction factor is expressed as μ = -p -1 modR, where R is a constant introduced in the intermediate domain, used to convert the operation of the prime field GF(p) to the intermediate domain; R is 2 k , the value of k is: the number of cumulative steps of the gradual accumulation of multiple product terms multiplied by 64 bits.

[0289] In an optional implementation, the prime number is 256 bits and is represented by p=2 256 -2 224 -2 96 +2 64 -1; the i-th correction result C i The calculation includes:

[0290]

[0291] Among them, z i =(C i-1 +d i )mod 2 64 , Indicates that the result is rounded down.

[0292] In an optional implementation, the i-th corrected result C i The calculation specifically includes:

[0293] When i>0, the i-th corrected result C i The calculation is: (e4+e0-(e0>>32))·2 192 +(e3-(e0<<32))·2 128 +(e2-(e0>>32))·2 64 +(e1+e0-(e0<<32));

[0294] Among them, when i>0, e0, e1, e2, e3, and e4 represent the cumulative result C of the i-th step accumulation. i-1 +d i For each 64-bit component of , >> represents a right shift operation, and << represents a left shift operation.

[0295] In an optional implementation, the i-th corrected result C i The calculation specifically includes:

[0296] When i=0, the calculation of the zeroth correction result C0 is (e0-(e0>>32))·2 192 -(e0<<32)·2 128 -(e0>>32)·2 64 +(e1+e0-(e0<<32));

[0297] Wherein, when i=0, e0, e1, e2, e3, and e4 represent each 64-bit component of the zeroth product term accumulation, and the zeroth product term accumulation is the first product term accumulation among multiple product term accumulations.

[0298] In an alternative implementation, the modular product operation includes a modular multiplication operation or a modular square operation.

[0299] In an optional implementation, the binary representation of the input multiplier is a linear combination of multiple components of the input multiplier and multiple position coefficients, wherein the size of a component corresponds to the bit width of the processor and one component corresponds to one position coefficient, indicating a shift of the component.

[0300] In an optional implementation, the product term accumulation determination module 530 for determining a plurality of product term accumulations corresponding to the multiplication of the binary representations of the plurality of input multipliers may include:

[0301] Determining a product result of multiplying the binary representations of the plurality of input multipliers, and expanding the product result to obtain a plurality of product terms, wherein the plurality of product terms are added to form the product result;

[0302] A plurality of product terms are classified according to position coefficients to obtain a plurality of product term accumulations corresponding to different position coefficients, and one product term accumulation corresponds to one position coefficient, indicating a shift of the product term accumulation.

[0303] In an optional implementation, the binary representation of the input multiplier is:

[0304]

[0305] Where A is one of the multiple input multipliers, w is the bit width of the processor, and a i is the i-th component, 2 wi for a i The corresponding position coefficient represents a i displacement.

[0306] In an optional implementation, the modular product operation includes a modular multiplication operation, and the multiple input multipliers include a first input multiplier and a second input multiplier; wherein the prime number is 256 bits and the bit width of the processor is 64 bits;

[0307] The accumulation of multiple product terms includes: corresponding position coefficient 2 0 The zeroth product term is accumulated, and the corresponding position coefficient is 2 64 The first product term is accumulated, corresponding to the position coefficient 2 128 The second product term accumulation and the corresponding position coefficient 2 192 The third product term of is accumulated;

[0308] The multiple correction results include:

[0309] In the accumulation at step 0, the zeroth product term is accumulated and corrected to obtain the zeroth correction result;

[0310] In the first step of accumulation, the first correction result is obtained by correcting the cumulative result of the zeroth correction result and the first product term accumulation;

[0311] In step 2, the accumulated result of the first corrected result and the second product term is corrected to obtain a second corrected result;

[0312] In the third step of accumulation, the accumulated result of the second correction result and the third product term is corrected to obtain a third correction result; the third correction result corresponds to the result of the modular multiplication operation of the intermediate domain.

[0313] In an optional implementation, for modular multiplication operation, the third modified result is expressed corresponding to the result of the modular multiplication operation of the intermediate field as follows:

[0314] C3≡A·B·2 -256 mod p;

[0315] Among them, C3 is the third correction result, A is the first input multiplier, B is the second input multiplier, p is a prime number, ≡ is the congruence symbol, and both sides of the congruence symbol are equivalent.

[0316] In an optional implementation, the modular product operation includes a modular square operation, and the multiple input multipliers are the same input multipliers; wherein the prime number is 256 bits and the bit width of the processor is 64 bits;

[0317] The accumulation of multiple product terms includes: corresponding position coefficient 2 0 The zeroth product term is accumulated, and the corresponding position coefficient is 2 64 The first product term is accumulated, corresponding to the position coefficient 2 128 The second product term is accumulated, corresponding to the position coefficient 2 192 The third product term is accumulated, corresponding to the position coefficient 2 256 The fourth product term is accumulated, and the corresponding position coefficient is 2 320 The fourth product term is accumulated, and the corresponding position coefficient is 2 320 The fifth product term of the accumulation and the corresponding position coefficient 2 384 The sixth product term of is accumulated;

[0318] The multiple correction results include:

[0319] In the accumulation at step 0, the zeroth product term is accumulated and corrected to obtain the zeroth correction result;

[0320] In the first step of accumulation, the first correction result is obtained by correcting the cumulative result of the zeroth correction result and the first product term accumulation;

[0321] In step 2, the accumulated result of the first corrected result and the second product term is corrected to obtain a second corrected result;

[0322] In step 3, the third corrected result is obtained by correcting the accumulated result of the second corrected result and the third product term;

[0323] In step 4, the accumulated result of the third corrected result and the fourth product term is corrected to obtain a fourth corrected result;

[0324] In step 5, the accumulated result of the fourth corrected result and the fifth product term is corrected to obtain a fifth corrected result;

[0325] In the sixth step of accumulation, the accumulated result of the fifth corrected result and the sixth product term is corrected to obtain a sixth corrected result; the sixth corrected result corresponds to the result of the modular square operation of the intermediate domain.

[0326] In an optional implementation, for the modular square operation, the sixth correction result is expressed corresponding to the result of the modular square operation of the intermediate domain as follows:

[0327] C6≡A 2 2 -448 mod p;

[0328] Among them, C6 is the sixth correction result, A is the input multiplier of the modular square operation, p is a prime number, ≡ is the congruence symbol, and the two sides of the congruence symbol are equivalent.

[0329] In an optional implementation, the step-by-step accumulation process of the accumulation of the multiple product terms is performed in the order of position coefficients from small to large, and the order of position coefficients from small to large represents the order from low to high.

[0330] In a further optional implementation, the data processing method provided in the embodiment of the present application is adapted to an instruction set applicable to the hardware level. The embodiment of the present application also provides a processor, which is designed based on an instruction set, and the instruction set has algorithm instructions for elliptic curve cryptographic algorithms such as the SM2 algorithm. The algorithm instructions are used by the processor to implement the data processing method provided in the embodiment of the present application to accelerate the execution of elliptic curve cryptographic algorithms such as the SM2 algorithm, thereby accelerating data processing in data processing scenarios that apply elliptic curve cryptographic algorithms such as the SM2 algorithm.

[0331] In a further optional implementation, the embodiment of the present application also provides a computer device, including the processor provided in the above-mentioned embodiment of the present application.

[0332] In a further optional implementation, the data processing method provided in the embodiment of the present application is suitable for software implementation. The embodiment of the present application also provides a computer device for running a software program. The computer device may include a processor and a memory. The memory stores computer program instructions. The processor calls the computer program instructions stored in the memory to execute the data processing method provided in the embodiment of the present application.

[0333] In a further optional implementation, the embodiment of the present application also provides a storage medium, which stores computer program instructions. When the computer program instructions are executed by a processor, the data processing method provided in the embodiment of the present application is implemented.

[0334] In a further optional implementation, the embodiment of the present application also provides a computer program product, which includes computer program instructions, and when the computer program instructions are executed by a processor, the data processing method provided in the embodiment of the present application is implemented.

[0335] The above describes multiple implementation schemes provided by the embodiments of the present application. The various optional methods introduced in each implementation scheme can be combined and cross-referenced with each other without conflict, thereby extending a variety of possible implementation schemes, which can all be considered as implementation schemes disclosed and open in the embodiments of the present application.

[0336] Although the embodiments of the present application are disclosed above, the present application is not limited thereto. Any person skilled in the art may make various changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be subject to the scope defined by the claims.

Claims

1. A data processing method, characterized in that: include: Acquire data to be processed, wherein the data to be processed is processed using an elliptic curve cryptographic algorithm, wherein an elliptic curve of the elliptic curve cryptographic algorithm is defined in a prime number domain; Determine input data for a modular product operation of an elliptic curve cryptographic algorithm, wherein the modular product operation takes a product modulo a prime number in a prime number field, wherein the input data includes a plurality of input multipliers for obtaining the product, and the input multipliers are in binary representation; Determine a plurality of accumulations of product terms corresponding to multiplications of binary representations of the plurality of input multipliers; Using the correction factor of the intermediate domain and the prime number of the prime number domain, in the step-by-step accumulation process of accumulating multiple product terms, the accumulated result of each step of accumulation is corrected to obtain multiple corrected results, the last corrected result of the multiple corrected results corresponds to the result of the modular product operation of the intermediate domain; wherein the correction factor of the intermediate domain is used to map the operation to the intermediate domain to eliminate the division operation; Map the last corrected result back to the prime number domain to obtain the result of the modular product operation in the prime number domain; According to the result of the modular product operation in the prime number field, the data processing result of the data to be processed is determined.

2. The method according to claim 1, characterized in that The method of using the correction factor of the intermediate domain and the prime number of the prime number domain to correct the accumulated result of each step of accumulation in the step-by-step accumulation process of accumulating multiple product terms to obtain multiple corrected results includes: In order from low to high, multiple product terms are gradually accumulated, and the accumulated result of each step is corrected by using correction factors and prime numbers, so that the next step of accumulation is to accumulate the next product term based on the corrected result corresponding to the previous step of accumulation, until the accumulated result of the last step of accumulation is corrected to obtain multiple corrected results.

3. The method according to claim 2, characterized in that The accumulation of multiple product terms is performed step by step from low to high, and the accumulation result of each step is corrected by using the correction factor and the prime number, so that the next step of accumulation is to accumulate the next product term based on the correction result corresponding to the previous step of accumulation, until the accumulation result of the last step of accumulation is corrected, and the multiple correction results obtained include: When accumulating in the i-th step, the accumulated result of the i-th step is corrected according to the following formula; 2 64 ·C i =(C i-1 +d i )+(μ·(C i-1 +d i )mod 2 64 )·p; Among them, C i is the i-th correction result corresponding to the i-th step accumulation, C i-1 The i-1th correction result corresponding to the i-1th step is accumulated, d i is the accumulation of the i-th product term, C i-1 +d i is the cumulative result of the i-th step, μ is the correction factor, and p is a prime number.

4. The method according to claim 3, characterized in that: The correction factor is the multiplicative inverse element associated with the prime number, and the correction factor is expressed as μ=-p -1 mod R, where R is a constant introduced in the intermediate domain, used to convert the operation of the prime field GF(p) to the intermediate domain; R is 2 k , the value of k is: the number of cumulative steps of the gradual accumulation of multiple product terms multiplied by 64 bits.

5. The method according to claim 4, characterized in that The prime number is 256 bits and is represented by p=2 256 -2 224 -2 96 +2 64 -1; The i-th corrected result C i The calculation includes: Among them, z i =(C i-1 +d i )mod 2 64 , Indicates that the result is rounded down.

6. The method according to claim 5, characterized in that The i-th corrected result C i The calculation includes: When i>0, the i-th corrected result C i The calculation is: (e4+e0-(e0>>32))·2 192 +(e3-(e0<<32))·2 128 +(e2-(e0>>32))·2 64 +(e1+e0-(e0<<32)); Among them, when i>0, e0, e1, e2, e3, and e4 represent the cumulative result C of the i-th step accumulation. i-1 +d i For each 64-bit component of , >> represents a right shift operation, and << represents a left shift operation.

7. The method according to claim 5, characterized in that The i-th corrected result C i The calculation includes: When i=0, the calculation of the zeroth correction result C0 is (e0-(e0>>32))·2 192 -(e0<<32)·2 128 -(e0>>32)·2 64 +(e1+e0-(e0<<32)); Among them, when i=0, e0, e1, e2, e3, e4 represent each 64-bit component of the zeroth product term accumulation, and the zeroth product term accumulation is the first product term accumulation among multiple product term accumulations; >> represents a right shift operation, and << represents a left shift operation.

8. The method according to any one of claims 3 to 7, characterized in that: The binary representation is a linear combination of multiple components of the input multiplier and multiple position coefficients, wherein the size of a component corresponds to the bit width of the processor, and one component corresponds to one position coefficient, indicating a shift of the component; Determining the accumulation of a plurality of product terms corresponding to the multiplication of the binary representations of the plurality of input multipliers comprises: Determining a product result of multiplying the binary representations of the plurality of input multipliers, and expanding the product result to obtain a plurality of product terms, wherein the plurality of product terms are added to form the product result; A plurality of product terms are classified according to position coefficients to obtain a plurality of product term accumulations corresponding to different position coefficients, and one product term accumulation corresponds to one position coefficient, indicating a shift of the product term accumulation.

9. The method according to claim 8, characterized in that The binary representation of the input multiplier is: Where A is one of the multiple input multipliers, w is the bit width of the processor, and a i is the i-th component, 2 wi for a i The corresponding position coefficient represents a i displacement.

10. The method according to claim 9, characterized in that The modular product operation includes a modular multiplication operation, and the multiple input multipliers include a first input multiplier and a second input multiplier; wherein the prime number is 256 bits, and the bit width of the processor is 64 bits; The accumulation of multiple product terms includes: corresponding position coefficient 2 0 The zeroth product term is accumulated, and the corresponding position coefficient is 2 64 The first product term is accumulated, corresponding to the position coefficient 2 128 The second product term accumulation and the corresponding position coefficient 2 192 The third product term of is accumulated; The multiple correction results include: In the accumulation at step 0, the zeroth product term is accumulated and corrected to obtain the zeroth correction result; In the first step of accumulation, the first correction result is obtained by correcting the cumulative result of the zeroth correction result and the first product term accumulation; In step 2, the accumulated result of the first corrected result and the second product term is corrected to obtain a second corrected result; In the third step of accumulation, the accumulated result of the second correction result and the third product term is corrected to obtain a third correction result; the third correction result corresponds to the result of the modular multiplication operation of the intermediate domain.

11. The method according to claim 10, characterized in that The third correction result corresponds to the result of the modular multiplication operation of the intermediate domain and is expressed as: C3≡A·B·2 -256 towards p; Among them, C3 is the third correction result, A is the first input multiplier, B is the second input multiplier, p is a prime number, ≡ is the congruence symbol, and both sides of the congruence symbol are equivalent.

12. The method according to claim 8, characterized in that The modular product operation includes a modular square operation, and the multiple input multipliers are the same input multipliers; wherein the prime number is 256 bits and the bit width of the processor is 64 bits; The accumulation of multiple product terms includes: corresponding position coefficient 2 0 The zeroth product term is accumulated, and the corresponding position coefficient is 2 64 The first product term is accumulated, corresponding to the position coefficient 2 128 The second product term is accumulated, corresponding to the position coefficient 2 192 The third product term is accumulated, corresponding to the position coefficient 2 256 The fourth product term is accumulated, and the corresponding position coefficient is 2 320 The fourth product term is accumulated, and the corresponding position coefficient is 2 320 The fifth product term of the accumulation and the corresponding position coefficient 2 384 The sixth product term of is accumulated; The multiple correction results include: In the accumulation at step 0, the zeroth product term is accumulated and corrected to obtain the zeroth correction result; In the first step of accumulation, the first correction result is obtained by correcting the cumulative result of the zeroth correction result and the first product term accumulation; In step 2, the accumulated result of the first corrected result and the second product term is corrected to obtain a second corrected result; In step 3, the third corrected result is obtained by correcting the accumulated result of the second corrected result and the third product term; In step 4, the accumulated result of the third corrected result and the fourth product term is corrected to obtain a fourth corrected result; In step 5, the accumulated result of the fourth corrected result and the fifth product term is corrected to obtain a fifth corrected result; In the sixth step of accumulation, the accumulated result of the fifth corrected result and the sixth product term is corrected to obtain a sixth corrected result; the sixth corrected result corresponds to the result of the modular square operation of the intermediate domain.

13. The method according to claim 12, characterized in that The sixth correction result corresponds to the result of the modular square operation of the intermediate domain and is expressed as: C6≡A 2 ·2 -448 towards p; Among them, C6 is the sixth correction result, A is the input multiplier of the modular square operation, p is a prime number, ≡ is the congruence symbol, and the two sides of the congruence symbol are equivalent.

14. The method according to claim 8, characterized in that The step-by-step accumulation process of the accumulation of the plurality of product terms is performed in the order of position coefficients from small to large, and the order of position coefficients from small to large represents the order from low to high.

15. A data processing device, characterized in that: include: A module for acquiring data to be processed, used for acquiring data to be processed, wherein the data to be processed is processed using an elliptic curve cryptographic algorithm, wherein an elliptic curve of the elliptic curve cryptographic algorithm is defined in a prime number domain; An operation input determination module, used for determining input data of a modular product operation of an elliptic curve cryptographic algorithm, wherein the modular product operation takes a product modulo a prime number in a prime number field, wherein the input data includes a plurality of input multipliers for obtaining the product, and the input multipliers are represented in binary; A product term accumulation determination module, configured to determine a plurality of product term accumulations corresponding to the multiplication of the binary representations of the plurality of input multipliers; An accumulation correction module, used for correcting the accumulation result of each step of accumulation in the step-by-step accumulation process of accumulating multiple product terms by using the correction factor of the intermediate domain and the prime number of the prime number domain, so as to obtain multiple correction results, wherein the last correction result of the multiple correction results corresponds to the result of the modular product operation of the intermediate domain; wherein the correction factor of the intermediate domain is used to map the operation to the intermediate domain to eliminate the division operation; A mapping recovery module, used for mapping the last correction result back to the prime number domain to obtain the result of the modular product operation in the prime number domain; The data processing result determination module is used to determine the data processing result of the data to be processed according to the operation result of the modular product operation in the prime number field.

16. The device according to claim 15, characterized in that The accumulation correction module is used to use the correction factor of the intermediate domain and the prime number of the prime number domain to correct the accumulation result of each step of accumulation in the step-by-step accumulation process of accumulating multiple product terms, so as to obtain multiple correction results including: In order from low to high, multiple product terms are gradually accumulated, and the accumulated result of each step is corrected by using correction factors and prime numbers, so that the next step of accumulation is to accumulate the next product term based on the corrected result corresponding to the previous step of accumulation, until the accumulated result of the last step of accumulation is corrected to obtain multiple corrected results.

17. The device according to claim 16, characterized in that The accumulation correction module is used to gradually accumulate multiple product terms in order from low to high, and use the correction factor and the prime number to correct the accumulation result of each step of accumulation, so that the next step of accumulation is to accumulate the next product term on the basis of the correction result corresponding to the previous step of accumulation, until the accumulation result of the last step of accumulation is corrected, and the multiple correction results obtained include: When accumulating in the i-th step, the accumulated result of the i-th step is corrected according to the following formula; 2 64 ·C i =(C i-1 +d i )+(μ·(C i-1 +d i )mod 2 64 )·p; Among them, C i is the i-th correction result corresponding to the i-th step accumulation, C i-1 The i-1th correction result corresponding to the i-1th step is accumulated, d i is the accumulation of the i-th product term, C i-1 +d i is the cumulative result of the i-th step, μ is the correction factor, and p is a prime number.

18. The device according to claim 17, characterized in that The prime number is 256 bits and is represented by p=2 256 -2 224 -2 96 +2 64 -1; The i-th corrected result C i The calculation includes: Among them, z i =(C i-1 +d i )mod 2 64 , Indicates that the result is rounded down.

19. The device according to claim 18, characterized in that The i-th corrected result C i The calculation specifically includes: When i>0, the i-th corrected result C i The calculation is: (e4+e0-(e0>>32))·2 192 +(e3-(e0<<32))·2 128 +(e2-(e0>>32))·2 64 +(e1+e0-(e0<<32)), where, when i>0, e0, e1, e2, e3, e4 represent the cumulative result C of the i-th step accumulation. i-1 +d i For each 64-bit component of , 》 represents a right shift operation, and 〈 represents a left shift operation; When i=0, the calculation of the zeroth correction result C0 is: (e0-(e0>32))·2 192 -(e0<<32)·2 128 -(e0>>32)·2 64 +(e1+e0-(e0<<32)), when i=0, e0, e1, e2, e3, e4 represent each 64-bit component of the zeroth product term accumulation, and the zeroth product term accumulation is the first product term accumulation among multiple product term accumulations.

20. A processor, characterized in that: The processor is designed based on an instruction set, and the instruction set has algorithm instructions of an elliptic curve cryptographic algorithm. The algorithm instructions are used by the processor to implement the data processing method as described in any one of claims 1-14.

21. A computer device, characterized in that: Comprising a processor as claimed in claim 20.

22. A computer device, characterized in that: It comprises a processor and a memory, the memory stores computer program instructions, and the processor calls the computer program instructions stored in the memory to execute the data processing method according to any one of claims 1 to 14.

23. A storage medium, characterized in that: The storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the data processing method according to any one of claims 1 to 14 is implemented.

24. A computer program product, characterized in that The computer program product comprises computer program instructions, and when the computer program instructions are executed by a processor, the data processing method according to any one of claims 1 to 14 is implemented.

Images