Data processing method, device, processor, computer equipment, medium and program

Abstract

The embodiment of the present application provides a data processing method, apparatus, processor, computer equipment, medium and program, wherein the method includes: obtaining data to be processed; determining input data for a modular product operation of an elliptic curve cryptographic algorithm, wherein the input data includes multiple input multipliers; determining the accumulation of multiple product terms corresponding to the multiplication of the binary representations of the multiple input multipliers; using a correction factor of an intermediate domain and a prime number of a prime number domain, in the gradual accumulation process of the accumulation of multiple product terms, correcting the accumulated result of each step to obtain multiple corrected results, and the last corrected result corresponds to the result of the modular product operation of the intermediate domain; wherein the correction factor is used to map the operation to the intermediate domain to eliminate the division operation; mapping the last corrected result back to the prime number domain to obtain the result of the modular product operation in the prime number domain, and determining the data processing result based on the result of the operation. The embodiment of the present application can improve the data processing performance of the elliptic curve cryptographic algorithm.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data processing technology, and specifically to a data processing method, apparatus, processor, computer equipment, medium, and program. Background Art

[0002] Elliptic curve cryptography is a public-key cryptographic algorithm based on the elliptic curve discrete logarithm problem. It is widely used in data processing scenarios such as data encryption and decryption, and digital signatures. Typical elliptic curve cryptographic algorithms include the SM2 (Commercial Cryptography 2) algorithm and the ECDSA (Elliptic Curve Digital Signature) algorithm. Elliptic curve cryptographic algorithms like the SM2 algorithm are defined in the prime field. Therefore, elliptic curve cryptographic algorithms like the SM2 algorithm involve operations modulo the product of a prime number in the prime field, known as modular product operations (abbreviated as modular product operations). Typical modular product operations include modular multiplication and modular squaring.

[0003] Modular product operations are fundamental operations in elliptic curve cryptography, and their performance significantly impacts the performance of these algorithms. Therefore, in data processing scenarios where elliptic curve cryptography is used, improving the performance of modular product operations, and thereby improving the performance of elliptic curve cryptography, has become a pressing technical challenge for those skilled in the art. Summary of the Invention

[0004] In view of this, the embodiments of the present application provide a data processing method, apparatus, processor, computer equipment, medium and program, which, in a data processing scenario where an elliptic curve cryptographic algorithm is applied, improves the computational performance of modular product operations, thereby improving the algorithmic performance of the elliptic curve cryptographic algorithm, and further improving the data processing performance of the elliptic curve cryptographic algorithm.

[0005] To achieve the above objectives, the embodiments of the present application provide the following technical solutions.

[0006] In a first aspect, an embodiment of the present application provides a data processing method, comprising:

[0007] Acquiring data to be processed, wherein the data to be processed is processed using an elliptic curve cryptography algorithm, wherein an elliptic curve of the elliptic curve cryptography algorithm is defined in a prime number domain;

[0008] Determining input data for a modular product operation of an elliptic curve cryptography algorithm, wherein the modular product operation modulo a product by a prime number in a prime field, wherein the input data includes a plurality of input multipliers for obtaining the product, and the input multipliers are in binary representation;

[0009] determining a plurality of accumulations of product terms corresponding to multiplications of binary representations of the plurality of input multipliers;

[0010] Using the correction factor of the intermediate domain and the prime number of the prime number domain, in a stepwise accumulation process of accumulating a plurality of product terms, the accumulated result of each step is corrected to obtain a plurality of corrected results, wherein the last corrected result of the plurality of corrected results corresponds to the result of the modular product operation of the intermediate domain; wherein the correction factor of the intermediate domain is used to map the operation to the intermediate domain to eliminate the division operation;

[0011] Map the last corrected result back to the prime number field to obtain the result of the modular product operation in the prime number field;

[0012] The data processing result of the data to be processed is determined according to the operation result of the modular product operation in the prime number field.

[0013] In a second aspect, an embodiment of the present application provides a data processing device, including:

[0014] A module for acquiring data to be processed, configured to acquire data to be processed, wherein the data to be processed is processed using an elliptic curve cryptography algorithm, wherein the elliptic curve of the elliptic curve cryptography algorithm is defined in a prime number domain;

[0015] an operation input determination module, configured to determine input data for a modular product operation of an elliptic curve cryptography algorithm, wherein the modular product operation modulo a product by a prime number in a prime number domain, wherein the input data includes a plurality of input multipliers for obtaining the product, and the input multipliers are represented in binary;

[0016] a product term accumulation determination module, configured to determine a plurality of product term accumulations corresponding to the multiplication of the binary representations of the plurality of input multipliers;

[0017] an accumulation correction module, configured to correct an accumulation result of each step of accumulation during a stepwise accumulation of a plurality of product terms using a correction factor in the intermediate domain and a prime number in the prime number domain, to obtain a plurality of correction results, wherein a last correction result of the plurality of correction results corresponds to a result of a modular product operation in the intermediate domain; wherein the correction factor in the intermediate domain is used to map the operation to the intermediate domain to eliminate a division operation;

[0018] A mapping recovery module is used to map the last correction result back to the prime number domain to obtain the result of the modular product operation in the prime number domain;

[0019] The data processing result determination module is used to determine the data processing result of the data to be processed according to the operation result of the modular product operation under the prime number field.

[0020] In a third aspect, an embodiment of the present application provides a processor, which is designed based on an instruction set, and the instruction set has algorithm instructions of an elliptic curve cryptography algorithm, and the algorithm instructions are used by the processor to implement the data processing method described in the first aspect above.

[0021] In a fourth aspect, an embodiment of the present application provides a computer device comprising the processor as described in the third aspect above.

[0022] In a fifth aspect, an embodiment of the present application provides a computer device, comprising a processor and a memory, wherein the memory stores computer program instructions, and the processor calls the computer program instructions stored in the memory to execute the data processing method as described in the first aspect above.

[0023] In a sixth aspect, an embodiment of the present application provides a storage medium, which stores computer program instructions, and when the computer program instructions are executed by a processor, implements the data processing method described in the first aspect above.

[0024] In a seventh aspect, an embodiment of the present application provides a computer program product, which includes computer program instructions, and when the computer program instructions are executed by a processor, implements the data processing method described in the first aspect above.

[0025] The data processing method provided in the embodiment of the present application can determine the data processing result of the data to be processed based on the operation result of the modular product operation of the elliptic curve cryptography algorithm when using the elliptic curve cryptography algorithm to process the data to be processed, thereby realizing data processing in the data processing scenario where the elliptic curve cryptography algorithm is applied, and obtaining the data processing result of the data processing scenario. Specifically, the elliptic curve of the elliptic curve cryptography algorithm is defined in the prime number domain, and the modular product operation of the elliptic curve cryptography algorithm takes the product modulo the prime numbers of the prime number domain. Then, during the operation process of the modular product operation, the embodiment of the present application can determine multiple input multipliers of the modular product operation, and the input multipliers are represented in binary, thereby determining the accumulation of multiple product terms corresponding to the multiplication of the binary representations of the multiple input multipliers; further, in the gradual accumulation process of the product term accumulation, the accumulation result of each step of the accumulation is corrected using the correction factor of the intermediate domain and the prime numbers of the prime number domain to obtain multiple corrected results, and the last corrected result of the multiple corrected results corresponds to the result of the modular multiplication operation of the intermediate domain; then the last corrected result is mapped back to the prime number domain to obtain the operation result of the modular product operation in the prime number domain, so as to determine the data processing result of the data to be processed based on the operation result of the modular product operation in the prime number domain. Since the correction factor of the intermediate domain can map the operation to the intermediate domain to eliminate the division operation during the gradual accumulation of the product terms, the embodiment of the present application can simplify the complexity of the modular product operation, and the embodiment of the present application uses prime numbers to make the gradually obtained correction results converge in the direction of prime numbers, so that the last correction result can be mapped back to the prime number domain to ensure the accuracy of the operation result.

[0026] Therefore, the embodiments of the present application can utilize the correction factors in the intermediate domain and the prime numbers in the prime domain to convert the modular product operation to the intermediate domain during the gradual accumulation of product terms, thereby eliminating complex division operations, reducing computational overhead, improving the efficiency of the modular product operation, and ensuring the accuracy of the results. Therefore, the embodiments of the present application can improve the computational performance of the modular product operation, thereby improving the algorithmic performance of the elliptic curve cryptography algorithm, and further improving the data processing performance of the elliptic curve cryptography algorithm, achieving efficient and accurate data processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without any creative work.

[0028] Figure 1 This is an example diagram of the processing process of the SM2 algorithm.

[0029] Figure 2 A flowchart of a data processing method provided in an embodiment of the present application.

[0030] Figure 3 A flowchart of a modular multiplication operation provided in an embodiment of the present application.

[0031] Figure 4 A flowchart of a modular square operation provided in an embodiment of the present application.

[0032] Figure 5 A block diagram of a data processing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0033] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0034] Elliptic curve cryptography algorithms such as the SM2 algorithm and the ECDSA algorithm mainly use points on the elliptic curve for data encryption and decryption, digital signatures and other data processing, so as to realize the application of elliptic curve cryptography algorithms in data encryption and decryption, digital signatures and other data processing scenarios.

[0035] For ease of understanding, take the SM2 algorithm as an example. In the data encryption scenario where the SM2 algorithm is applied, Figure 1 The following is an example diagram showing the processing process of the SM2 algorithm: Figure 1 As shown, in the data encryption scenario, the input of the SM2 algorithm is plaintext M, public key P B , the output is ciphertext C; the operation process of the SM2 algorithm is as follows:

[0036] Generate a random number k, k∈[1,n-1], where n is the order of the base point G of the elliptic curve. The random number k is used to generate a random point on the elliptic curve during the encryption process to ensure that each encryption is random. That is, even if the same plaintext and public key are used for different encryptions, the encryption results will be different each time.

[0037] Calculate the point C1 on the elliptic curve, where C1 = k·G = (x1,y1). C1 can be calculated using the point multiplication operation on the elliptic curve (i.e., k·G), resulting in the point (x1,y1) on the elliptic curve. C1 will be included in the ciphertext C, providing the random information generated during the encryption process for use by the decryptor. Therefore, C1 can be regarded as the random information part of the ciphertext.

[0038] Calculate the point k·P of the elliptic curve B, and k·P B =(x2,y2), that is, the random number k and the public key P B Perform a point multiplication operation to obtain the point (x2, y2) on the elliptic curve. (x2, y2) is used to generate the symmetric key later.

[0039] Calculate the symmetric key t, where t = KDF(x²||y², klen). That is, (x², y²) is generated using a key derivation function (KDF). The length of the symmetric key t is the length of the plaintext M (i.e., klen). During the calculation of the symmetric key t, if t is a bit string of all 0s, return to the step of regenerating the random number k and repeat the process.

[0040] Calculate C2, and C2 = M ⊕ t, that is, perform a bit-by-bit XOR operation on the plaintext M and the symmetric key t to obtain C2, which can be regarded as the ciphertext part of the ciphertext;

[0041] Calculate C3, and C3 = Hash(x2|M|y2), that is, calculate the hash value using the point (x2, y2) on the elliptic curve and the plaintext M, which is used to verify the integrity of the ciphertext. C3 can be regarded as the hash part of the ciphertext;

[0042] A ciphertext C is formed, and C=C1||C3||C2, that is, the random information part C1, the partial ciphertext C2, and the hash part C3 form the output ciphertext C.

[0043] It should be noted that elliptic curve cryptographic algorithms such as SM2 can be applied to encryption, decryption, digital signatures, signature verification and other scenarios. The above only uses the encryption scenario of SM2 as an example.

[0044] It can be seen that elliptic curve cryptography algorithms such as SM2 involve using point multiplication operations to calculate the coordinates of points on the elliptic curve, so as to be used in data processing scenarios such as data encryption and decryption, digital signatures, etc. For example, the encryption process of SM2 in the above example involves using k·G, k·P B The point multiplication operation is performed to obtain the point on the elliptic curve, which is then used for data encryption. Since the point multiplication operation occupies the main time of elliptic curve cryptographic algorithms such as SM2, the performance of the point multiplication operation has a crucial impact on the performance of elliptic curve cryptographic algorithms such as SM2.

[0045] Furthermore, the point multiplication operation can be decomposed into point addition and point doubling operations, which can be further decomposed into modular multiplication, modular square, modular addition, and modular subtraction operations. That is, since the elliptic curve is defined on the prime field, modular multiplication, modular square, modular addition, and modular subtraction operations all involve taking the modulus with prime numbers in the prime field. Among them, modular multiplication and modular square operations involve taking the modulus of the product with prime numbers in the prime field, that is, modular product operations. For example, modular multiplication involves taking the modulus of the product of the multiplication operation with prime numbers in the prime field, and modular square operations involve taking the modulus of the product of the square operation with prime numbers in the prime field. Therefore, the point multiplication operation of elliptic curve cryptography algorithms such as SM2 relies on modular product operations (such as modular multiplication and modular square operations).

[0046] It can be seen that in elliptic curve cryptography algorithms such as the SM2 algorithm and the ECDSA algorithm, modular product operations (such as modular multiplication operations and modular square operations) are the basis of the point multiplication operations of the elliptic curve cryptography algorithm. Therefore, the computational performance of modular product operations has a significant impact on the algorithmic performance of the elliptic curve cryptography algorithm. In particular, in the point multiplication operations based on points on the elliptic curve, the computational performance of modular product operations (such as modular multiplication operations and modular square operations) on which the point multiplication operations depend is crucial to the algorithmic performance of the elliptic curve cryptography algorithm.

[0047] Based on this, the embodiments of the present application consider optimizing the modular product operation and provide a data processing solution for the elliptic curve cryptography algorithm using the optimized modular product operation. Thus, in the data processing scenario where the elliptic curve cryptography algorithm is applied, the algorithm performance of the elliptic curve cryptography algorithm is improved by improving the computing performance of the optimized modular product operation, thereby improving the data processing performance of the elliptic curve cryptography algorithm (such as the performance of data encryption and decryption, the performance of digital signatures, etc.).

[0048] As an optional implementation, Figure 2 The following exemplary flowchart illustrates an optional data processing method provided in an embodiment of the present application. This method can be executed by a computer device. For example, the computer device can use elliptic curve cryptographic algorithms such as the SM2 algorithm and the ECDSA algorithm to perform data encryption and decryption, digital signatures, and other data processing. The computer device includes, but is not limited to, any electronic device with data processing capabilities, such as a terminal device and a server device. In an optional specific implementation, a processor in the computer device can execute the data processing method provided in an embodiment of the present application.

[0049] Reference Figure 2 The method flow may include the following steps.

[0050] In step S210, data to be processed is obtained, and the data to be processed is processed using an elliptic curve cryptography algorithm.

[0051] As an optional implementation, the data to be processed using the elliptic curve cryptography algorithm can have different forms based on the different data processing scenarios in which the algorithm is applied. For example, if the elliptic curve cryptography algorithm is applied to data encryption, the data to be processed can be plaintext to be encrypted; for example, if the elliptic curve cryptography algorithm is applied to data decryption, the data to be processed can be ciphertext to be decrypted; for example, if the elliptic curve cryptography algorithm is applied to digital signatures, the data to be processed can be a data summary (such as a hash value) of the data to be signed.

[0052] In step S220 , input data of a modular product operation of an elliptic curve cryptography algorithm is determined, where the input data of the modular product operation includes a plurality of input multipliers for obtaining a product.

[0053] In an embodiment of the present application, the modular product operation involves taking the product modulo a prime number in the prime number field, so that the input data of the modular product operation may include multiple input multipliers used to obtain the product.

[0054] For example, taking the modular product operation as a modular multiplication operation as an example, the multiple input data of the modular multiplication operation may include two input multipliers, referred to as a first input multiplier and a second input multiplier, wherein one input multiplier may be a scalar (such as a private key or a random number), and the other input multiplier may correspond to an input point on an elliptic curve (such as a base point on the elliptic curve, etc.); for example, the first input multiplier may be a scalar, and the second input multiplier may be an input point on the elliptic curve. For another example, taking the modular product operation as a modular square operation as an example, the multiple input data of the modular square operation may be the same multiple input data, that is, the same input data is squared.

[0055] As an optional implementation, the input data of the modular product operation can be determined based on the data to be processed, or based on a scalar (private key or random number) and / or an input point on the elliptic curve (such as a base point), depending on the specific data processing scenario in which the elliptic curve cryptography algorithm is applied and the specific stage of the modular product operation.

[0056] For example, in a data encryption scenario, the elliptic curve cryptography algorithm is used to encrypt plaintext, and in the data encryption process, the modular product operation (such as modular multiplication operation, modular square operation) of the elliptic curve cryptography algorithm is used as part of the encryption operation, which can be used in the stages of generating public keys, generating random information parts, and generating symmetric keys.

[0057] For example, during the public key generation phase, a private key (a form of scalar) is modularly multiplied with a base point on an elliptic curve to generate a public key. For example, during the random information generation phase, a random number (a form of scalar) is modularly multiplied with a base point on an elliptic curve to generate a random information component. For example, during the symmetric key generation phase, a random number (a form of scalar) is modularly multiplied with a public key to generate a symmetric key. The result is then used to derive a symmetric key using a key derivation function. The symmetric key is then further multiplied with the plaintext (e.g., an exclusive-OR operation) to generate the ciphertext component, so that the random information component and the ciphertext component form encrypted ciphertext.

[0058] It can be seen that for the data encryption scenario, in the public key generation stage, the random information part generation stage and the symmetric key generation stage, the input data of the modular product operation (such as modular multiplication operation) can be the private key and the base point on the elliptic curve, the random number and the base point on the elliptic curve, the random number and the public key, respectively. Therefore, the input data of the modular product operation (such as modular multiplication operation) may not involve plaintext (the plaintext is encrypted by the symmetric key generated in the symmetric key generation stage).

[0059] For example, in a data decryption scenario, an elliptic curve cryptography algorithm is used to decrypt ciphertext. During the data decryption process, the modular product operation (e.g., modular multiplication) of the elliptic curve cryptography algorithm can be used as part of the decryption operation during the symmetric key generation phase. For example, during the symmetric key generation phase, a modular multiplication operation is performed on a private key (a form of scalar) and the random information portion of the ciphertext. The result of the modular multiplication operation is then used to derive a symmetric key using a key derivation function. The symmetric key is then further operated on the ciphertext portion of the ciphertext to recover the plaintext.

[0060] It can be seen that for the data decryption scenario, in the symmetric key generation stage, the input data of the modular product operation (such as modular multiplication operation) is the private key and the random information part in the ciphertext, so the input data of the modular product operation (such as modular multiplication operation) involves the ciphertext. At this time, it can be regarded as a situation where the input data of the modular product operation (such as modular multiplication operation) is determined based on the data to be processed, that is, the random information part in the ciphertext needs to be used as the input multiplier of the modular product operation (such as modular multiplication operation).

[0061] For example, in a digital signature scenario, the elliptic curve cryptography algorithm is used to sign the data summary (such as a hash value) of the data to be signed to obtain the signature data. During the digital signature process, the modular product operation (such as modular multiplication operation) of the elliptic curve cryptography algorithm, as part of the digital signature operation, can generate intermediate data during the signing process. For example, a random number (a form of scalar) is subjected to a modular product operation (such as modular multiplication operation) with the base point of the elliptic curve to generate intermediate data; then, the intermediate data (specifically, the horizontal coordinate of the intermediate data) participates in the generation process of the signature pair of the signature data to generate a signature pair corresponding to the signature data, thereby obtaining the signature data.

[0062] It can be seen that for the digital signature scenario, in the stage of generating intermediate data during the signing process, the input data of the modular product operation (such as modular multiplication operation) is the random number and the base point of the elliptic curve, so that the input data of the modular product operation (such as modular multiplication operation) may not involve the data summary of the data to be signed.

[0063] In step S230 , a binary representation of the input multiplier is determined.

[0064] In an optional implementation, the input multiplier can be an integer and have a corresponding binary representation in the computer; the binary representation of the input multiplier can be a linear combination of multiple components of the input multiplier and multiple position coefficients, where the size of a component corresponds to the bit width of the processor, and one component corresponds to a position coefficient, representing the shift of the component.

[0065] As an optional implementation, for any input multiplier, the embodiment of the present application can decompose the input multiplier into multiple components and set the position coefficient of each component to obtain multiple position coefficients corresponding to the multiple components, wherein one component corresponds to one position coefficient, which represents the shift of the component. For example, in the binary system of the processor, the position coefficient corresponding to the component of the input multiplier represents the shift of the component in the binary number of the input multiplier to ensure that the component is in the correct position. Thus, for any input multiplier, a linear combination of multiple components of the input multiplier and multiple position coefficients can form a binary representation of the input multiplier. For example, a weighted combination of each component of the input multiplier and the corresponding position coefficient can form a binary representation of the input multiplier.

[0066] In an optional implementation, the embodiment of the present application can determine the number of components into which the input multiplier is decomposed based on the size of the input multiplier and the bit width of the processor, and the size of each component corresponds to the bit width of the processor; wherein the bit width of the processor is the word length of the processor, which refers to the number of bits of binary data that the processor can process at one time, such as 64 bits, etc., and a bit is also called a bit. Taking the bit width of the processor as 64 bits as an example, a component can be a 64-bit component, so that an input multiplier can be decomposed into multiple 64-bit components, each 64-bit component has a corresponding position in the input multiplier (represented by a position coefficient), and then the linear combination of multiple 64-bit components with different position coefficients forms a binary representation of the input multiplier.

[0067] For example, assume that the bit width of the processor is w, and one of the multiple input multipliers of the modular product operation is represented by A (for example, the first input multiplier in the modular multiplication operation is represented by A), and the input multiplier A is decomposed into n components, then n is the size of the input multiplier divided by the bit width w of the processor, and the component size of each component corresponds to the bit width w of the processor; wherein, since the elliptic curve is defined in the prime number field GF(p), each input multiplier belongs to an element of the prime number field GF(p), that is, the size of the input multiplier corresponds to the size of the prime number p in the prime number field GF(p), so that the embodiment of the present application can adapt the expression of the binary representation of the input multiplier based on the element size of the prime number field GF(p) (corresponding to the prime number size) and the bit width of the processor.

[0068] As a further example, let the i-th component of the input multiplier A be represented by a i , if i starts at 0, then i is an integer from 0 to n-1, so under the binary mechanism of the processor, the i-th component a i The corresponding position coefficient is 2 w·i , that is, a i In the binary number of A, it occupies the position of w bits i, and the binary representation of A as an integer can be:

[0069]

[0070] In step S240 , a plurality of product terms corresponding to the multiplication of the binary representations of the plurality of input multipliers are determined and accumulated.

[0071] As an optional implementation, multiplying the binary representations of multiple input multipliers can obtain a product result; expanding the product result can obtain multiple product terms; classifying the multiple product terms according to the position coefficients can obtain multiple product term accumulations corresponding to different position coefficients, and one product term accumulation corresponds to one position coefficient, indicating the shift of the product term accumulation.

[0072] That is to say, the multiplication of the binary representations of multiple input multipliers is to cross-multiply each item in the binary representations of the multiple input multipliers, that is, each item in the binary representation of one input multiplier is multiplied with each item in the binary representation of another input multiplier, and one item in the binary representation represents a component multiplied by the corresponding position coefficient. Therefore, the embodiment of the present application can expand the product result obtained by multiplying the binary representations of multiple input multipliers to obtain multiple product terms (the product result can be the sum of the multiple product terms), and then based on the corresponding position coefficient of each product term, the multiple product terms of the product result are classified according to the position coefficient to obtain different product term accumulations corresponding to different position coefficients, thereby obtaining multiple product term accumulations. Accordingly, the accumulation of multiple product terms is shifted and accumulated with the corresponding position coefficients to restore the product result.

[0073] In step S250, the correction factor of the intermediate domain and the prime number of the prime number domain are used to correct the accumulated result of each step in the step-by-step accumulation process of the product term accumulation to obtain multiple corrected results, and the last corrected result of the multiple corrected results corresponds to the result of the modular product operation of the intermediate domain; wherein the correction factor of the intermediate domain is used to map the operation to the intermediate domain to eliminate the division operation.

[0074] It should be explained that modular product operation is to multiply the product of multiple input multipliers by a prime number p. For example, taking modular multiplication operation as an example, let the first input multiplier of modular multiplication operation be A and the second input multiplier be B, then the modular multiplication operation is expressed as A·B modp. For example, taking modular square operation as an example, let the input multiplier of modular square operation be A, then the modular square operation is expressed as A 2 modp. If division is used during a modulo operation, the complexity of the modular product operation (e.g., modular multiplication and modular squaring) increases. This is because division is more complex for the processor to perform than addition, subtraction, and multiplication. For example, when the number of bits of the multiple input multipliers is large, the number of bits of the product of the multiple input multipliers will also increase accordingly. In this case, if the modulo operation is implemented using division, the complexity of the division operation itself and the large number of bits of the product will cause the modulo operation to be very slow, affecting the efficiency of the modular multiplication operation.

[0075] Therefore, it is possible to consider converting the modular product operation (such as modular multiplication operation, modular square operation) in the prime field GF(p) to the intermediate field, thereby using the non-division operation such as the shift operation performed in the intermediate field to eliminate the division operation; then, the result obtained in the intermediate field is converted back to the prime field GF(p), and the result of the modular product operation (such as modular multiplication operation, modular square operation) under the prime field GF(p) can be obtained. For example, the intermediate field can be, for example, the Montgomery field, and the Montgomery field can be regarded as the intermediate calculation space used by the Montgomery modular product algorithm (such as the Montgomery modular multiplication algorithm, the Montgomery modular square algorithm). In an optional implementation, the modular product operation in the intermediate field (such as the Montgomery field) can be converted from the modular product operation (such as modular multiplication operation, modular square operation) originally in the prime field GF(p) to the intermediate field (such as the Montgomery field) by introducing a constant R. For example, taking the modular multiplication operation in the intermediate field as an example, the modular multiplication operation in the intermediate field can be expressed as A·B·R -1 mod p, taking the modular square operation of the intermediate domain as an example, the modular square operation of the intermediate domain can be expressed as A 2 ·R -1 mod p.

[0076] Based on this, in the embodiment of the present application, a correction factor of the intermediate domain (such as the Montgomery domain) and a prime number of the prime domain are introduced during the gradual accumulation process of the accumulation of product terms. Starting from the first product term accumulation of multiple product terms, the correction factor of the intermediate domain and the prime number of the prime domain are used to correct the accumulation result of each step of accumulation until the accumulation result of the last step of accumulation is corrected to obtain the last correction result, so that the last correction result corresponds to the result of the modular product operation (such as modular multiplication operation, modular square operation) of the intermediate domain; furthermore, the last correction result corresponding to the result of the modular product operation (such as modular multiplication operation, modular square operation) of the intermediate domain is subsequently mapped back to the prime number domain GF(p), and the operation result of the modular product operation (such as modular multiplication operation, modular square operation) under the prime number domain GF(p) can be obtained, thereby completing the modular product operation (such as modular multiplication operation, modular square operation) of the prime number domain GF(p).

[0077] Specifically, the embodiment of the present application introduces a correction factor of the intermediate domain (such as the Montgomery domain) to convert the operation to the intermediate domain (such as the Montgomery domain) to eliminate the division operation, that is, the correction factor is used to convert the operation to the intermediate domain (such as the Montgomery domain); thus, in the step-by-step accumulation process of the product term accumulation, each step of accumulation can be converted to the intermediate domain (such as the Montgomery domain) using the correction factor of the intermediate domain (such as the Montgomery domain), so that the accumulation result of each step of accumulation is corrected to the intermediate domain (such as the Montgomery domain) for calculation, so as to eliminate the division operation used in the modular product operation (such as modular multiplication operation, modular square operation), such as using non-division operations such as shift operations performed in the intermediate domain to eliminate the division operation.

[0078] At the same time, the embodiment of the present application introduces a prime number p in the prime number field GF(p) so that the calculation result approaches the prime number field; that is, in the step-by-step accumulation process of the product term accumulation, the embodiment of the present application introduces a prime number p to prevent the accumulated result of each accumulation step from being far away from the range of the prime number p. For example, the prime number p can be used to ensure that the accumulated result of each accumulation step, after being corrected, can approach the prime number field (at this time, it has not yet been mapped back to the prime number field).

[0079] That is to say, in the gradual accumulation process of product terms, the embodiment of the present application introduces a correction factor and a prime number p at each step of accumulation to correct the accumulation result; wherein the correction factor corresponds to the intermediate domain, and is at least used to convert the operation to the intermediate domain (such as the Montgomery domain) so that the accumulation result of each step of accumulation is corrected to the intermediate domain (such as the Montgomery domain) for calculation; at the same time, the prime number p is used to control the accumulation result of each step of accumulation to be corrected to a range close to the prime number p.

[0080] As an optional implementation, the gradual accumulation of product term accumulations can be regarded as gradually accumulating multiple product term accumulations in order from low to high, such as gradually accumulating product term accumulations in order from small to large position coefficients. For example, first accumulate the first product term accumulation (for example, the product term accumulation of the lowest position, such as the product term accumulation with the smallest position coefficient) among multiple product term accumulations, and use the correction factor and the prime number p to correct the accumulation result to obtain the first corrected result; then, based on the first corrected result, accumulate the next product term accumulation of the first product term accumulation in order from low position to high position, and use the correction factor and the prime number p to correct the accumulation result to obtain the next corrected result after the first corrected result; then, based on the obtained corrected result, accumulate the next product term accumulation in order from low position to high position, and use the correction factor and the prime number p to correct the accumulation result, and so on, until the accumulation result of the last step of accumulation is corrected, then the last corrected result can be obtained, and the last corrected result is used as the result of the modular product operation (for example, modular multiplication operation, modular square operation) of the intermediate domain.

[0081] That is, in the process of gradually accumulating product term accumulations, the next accumulation step is to accumulate the next product term accumulation based on the correction result corresponding to the previous accumulation step. For example, based on the first correction result, the next product term accumulation of the first product term accumulation is accumulated in order from low to high. Therefore, the embodiment of the present application can gradually accumulate multiple product term accumulations in order from low to high, and use correction factors and prime numbers to correct the accumulation result of each step of accumulation, so that the next accumulation step is to accumulate the next product term accumulation based on the correction result corresponding to the previous accumulation step, until the accumulation result of the last accumulation step is corrected, thereby obtaining multiple corrected results.

[0082] After obtaining the last correction result among multiple correction results, the last correction result corresponds to the result of the modular product operation (such as modular multiplication operation, modular square operation) of the intermediate domain. That is to say, in the gradual accumulation process of the above-mentioned product terms, the cumulative result of each step of accumulation is corrected using the correction factor and the prime number until the last correction result is obtained. It is then considered that the modular product operation of the intermediate domain is completed (that is, the modular product operation of the prime number domain is converted to the intermediate domain and the modular product operation of the intermediate domain is completed), so that the last correction result corresponds to the result of the modular product operation of the intermediate domain. This is because the accumulated product terms correspond to the product of multiple input multipliers, so in the step-by-step accumulation process, the accumulated result of each step is corrected by the correction factor and the prime number p, and then the final corrected result is obtained after multiple steps of accumulation, which actually means that the accumulated product terms are mapped to the intermediate domain and the prime number p operation (modulo) is performed; therefore, in the step-by-step accumulation process, the accumulated result of each step is corrected by the correction factor and the prime number p until the final corrected result is obtained, which is equivalent to correcting the product of multiple input multipliers and the prime number p operation (modulo) by the correction factor and the prime number p, that is, it is equivalent to mapping to the intermediate domain for modular product operation to eliminate the division operation, so that the final corrected result is equivalent to the result of the modular product operation of the intermediate domain.

[0083] As an optional implementation, taking the accumulation of step i as an example, the correction of the accumulation result of step i can be expressed as:

[0084] 2 64 ·C i =(C i-1 +d i )+(μ·(C i-1 +d i )mod 2 64 )·p;

[0085] Among them, C i is the i-th correction result corresponding to the i-th step accumulation, C i-1 is the i-1th correction result corresponding to the i-1th step, d i is the accumulation of the i-th product term, C i-1 +d i is the cumulative result of step i, μ is the correction factor; 2 64 ·C i 2 of 2 64 Indicates shift, which is used to adjust the number of bits to ensure that the correction result is in the correct position.

[0086] It can be seen that in the accumulation of step i, the correction factor μ and prime number p are introduced to correct the i-1th correction result C i-1 Cumulative d with the i-th product termi The cumulative result C i-1 +d i , so that the i-th correction result C i Map to the intermediate domain corresponding to the correction factor μ and keep it in the intermediate domain to eliminate the division operation; at the same time, make the i-th correction result C i within a reasonable range close to the prime number p.

[0087] In a further optional implementation, the correction factor μ can be a multiplicative inverse element associated with the prime number p, so that the correction factor μ can utilize the multiplicative inverse element associated with the prime number p to eliminate the division operation through a shift operation. For example, the correction factor μ is expressed as μ=-p -1 mod R, where R is a constant introduced by the intermediate field (eg, Montgomery field) for converting operations in the prime field GF(p) to the intermediate field (eg, Montgomery field), so that μ·p is equivalent to -1 mod R.

[0088] In an alternative implementation, R can take the value 2 k , and the value of k can be related to the number of cumulative steps of the accumulation of multiple product terms and the bit width of the processor. For example, if the bit width of the processor is 64 bits, the value of k is: the number of cumulative steps of the accumulation of multiple product terms multiplied by 64 bits. For example, if the number of cumulative steps of the accumulation of product terms is 4 steps, then k is 256 (i.e. 4×64). For example, when the modular multiplication operation involves 4 steps of accumulation of product terms, then μ=-p -1 Mod 2 256 , that is, the correction factor μ is the prime number p modulo 2 256 The multiplication inverse element under, correspondingly, R takes 2 256 For example, if the number of accumulation steps of the product term is 7, then k is 448 (i.e., 7×64). For example, when the modular product operation is a modular square operation involving 7 accumulation steps of the product term, then μ=-p -1 mod 2 448 , that is, the correction factor μ is the prime number p modulo 2 448 The multiplication inverse element under, correspondingly, R takes 2 448 .

[0089] Based on setting the correction factor μ as the multiplicative inverse element related to the prime number p, for example, the correction factor μ is expressed as μ=-p -1 modR, and μ·p is equivalent to -1mod R, then in the gradual accumulation process of product terms, the correction factor μ can map the operation to the intermediate domain, and through the shift operation (i.e. 2 k corresponding shift operations) to eliminate the division operation in the modular product operation (for example, eliminating the division by 2 k operations), thereby reducing the complexity of modular multiplication operations (such as modular multiplication operations, modular multiplication operations). For example, in modular multiplication operations,256 The corresponding shift operation is used to eliminate the division operation, and the modular square operation is performed by 2 448 The corresponding shift operation is used to eliminate the division operation.

[0090] Furthermore, the embodiment of the present application also provides a further calculation simplification scheme, that is, based on the specific form of the prime number p, the i-th correction result C i As an optional implementation, for a prime number p of 256 bits, the prime number p is expressed as p=2 256 -2 224 -2 96 +2 64 -1, then the i-th correction result C i The calculation formula can be simplified as:

[0091]

[0092] Among them, z i =(C i-1 +d i )mod 2 64 , p = 2 256 -2 224 -2 96 +2 64 -1, Indicates that the result is rounded down.

[0093] Specifically, since the modulus is 2 when performing each step of accumulation 64 (i.e., it does not overflow 64 bits), so that at any accumulation step, μ·p is equivalent to -1 mod 2 64 , then in the accumulation of step i, ((C i-1 +d i )+(μ·(C i-1 +d i )mod 2 64 )·p)mod 2 64 ≡(C i-1 +d i )mod 2 64 -(C i-1 +

[0094] d i )mod 2 64 =0;

[0095] That is ((C i-1 +d i )+(μ·(C i-1 +d i )mod 2 64 )·p)mod 2 64 Can be decomposed into (Ci-1 +d i )mod 2 64 +((μ·(C i-1 +d i )mod 2 64 )·p)mod 2 64 , that is, the two parts of the formula are modulo 2 64 The following operations are performed separately;

[0096] Since μ·p is equivalent to -1 mod 2 64 , and p=(2 256 -2 224 -2 96 +2 64 -1) mod 2 64 =-1, so μ≡1mod2 64 , so (μ·(C i-1 +d i )mod 2 64 )·p is simplified to ((C i-1 +d i )mod 2 64 )·p.

[0097] Based on this, the i-th correction result C i Can be an integer and can have the following representations:

[0098]

[0099] That is to say, p = 2 256 -2 224 -2 96 +2 64 -1 is substituted, and then the distributive law is applied. In the low-order processing, due to C i Since it is an integer, the lower part is rounded down; in the processing of the higher part, z i =(C i-1 +d i )mod 2 64 Substitute into, then the above C i The formula can be adjusted to:

[0100]

[0101] On this basis, let the accumulated result C of step i be i-1 +d i Expressed as: e4·2 256 +e3·2 192 +e2·2 128 +e1·2 64 +e0, then the i-th correction result is C iThere may further be the following representations:

[0102]

[0103] That is, when i>0, the i-th correction result C i The calculation of C is simplified to: i =(e4+e0-(e0>>32))·2 192 +(e3-(e0<<32))·2 128 +(e2-(e0>>32))·2 64 +(e1+e0-(e0<<32));

[0104] When i=0, the zeroth correction result C0=(e0-(e0>>32))·2 192 -(e0<<32)·2 128 -(e0>>32)·2 64 +(e1+e0-(e0<<32)).

[0105] It should be noted that when i>0, the cumulative result C of the i-th step is i-1 +d i It is represented as a linear combination of multiple 64-bit components at different positions, then e0, e1, e2, e3, e4 represent C i-1 +d i Each 64-bit component of , and there is a corresponding position coefficient; accordingly, when i = 0, e0, e1, e2, e3, e4 represent each 64-bit component of the zeroth product term accumulation (i.e., the first product term accumulation in multiple product term accumulations). In the above representation, z i After the expression is substituted, since operations with larger bits will involve carries, further shift operations are performed to ensure that the result does not overflow. That is, >> represents a right shift operation, and << represents a left shift operation. These shift operations ensure that each 64-bit component is processed correctly and there will be no carry errors, so that the final result is a reassembled 256-bit integer.

[0106] In step S260 , the last correction result is mapped back to the prime number domain to obtain the result of the modular product operation in the prime number domain.

[0107] Based on the fact that the last correction result among the multiple correction results corresponds to the result of the modular product operation (e.g., modular multiplication operation, modular product operation) of the intermediate field, the embodiment of the present application can map the last correction result back to the prime field GF(p), thereby obtaining the result of the modular product operation (e.g., modular multiplication operation, modular product operation) under the prime field GF(p). For example, multiply the last correction result by R to eliminate R -1 , thereby mapping back to the prime number field GF(p).

[0108] For example, in modular multiplication, the modular multiplication operation in the prime field GF(p) is expressed as A·B mod p, and the modular multiplication operation in the intermediate field (such as the Montgomery field) is expressed as A·B·R -1 mod p, then the last correction result can be multiplied by R to eliminate R -1 The function of , thus mapping back to the prime field GF(p). For example, R takes 2 256 , the modular multiplication operation of the intermediate field is expressed as A·B·2 - 256 mod p, then the last correction result can be multiplied by 2 256 , to map back to the prime field GF(p).

[0109] For example, in the modular square operation, the modular square operation under the prime field GF(p) is expressed as A 2 mod p, the modular square operation in the intermediate field (such as the Montgomery field) is represented by A 2 ·R -1 mod p, then the last correction result can be multiplied by R to eliminate R -1 The function of , thus mapping back to the prime field GF(p). For example, R takes 2 448 , the modular square operation of the intermediate domain is expressed as A 2 2 -448 mod p, then the last correction result can be multiplied by 2 448 , to map back to the prime field GF(p).

[0110] In step S270 , a data processing result of the data to be processed is determined according to the result of the modular product operation in the prime number field.

[0111] After obtaining the result of the modular product operation, the embodiment of the present application can determine the data processing result of the to-be-processed data based on the result of the modular product operation, thereby serving as the data processing result of the data processing scenario in which the elliptic curve cryptography algorithm is applied. In other words, regardless of the specific scenario form of the data processing scenario, the data processing result of any data processing scenario can be determined based on the result of the modular product operation. This is because in the data processing scenario in which the elliptic curve cryptography algorithm is applied, the modular product operation (such as modular multiplication operation and modular square operation) is the basis of the point multiplication operation of the elliptic curve. Therefore, when using points on the elliptic curve for data encryption and decryption, digital signature, and other data processing, the result of the modular product operation (such as modular multiplication operation and modular square operation) is required.

[0112] For example, the data processing result of the data encryption scenario is a ciphertext, and the ciphertext is formed by a random information part and a ciphertext part; wherein the random information part is the result of a modular product operation (such as a modular multiplication operation) of a random number and a base point on an elliptic curve; in the process of generating the ciphertext part, it is necessary to use the result of a modular product operation (such as a modular multiplication operation) of a random number and a public key, that is, the result of the operation is used to derive a symmetric key through a key derivation function, and then the symmetric key is further operated with the plaintext to obtain the ciphertext part.

[0113] For example, the data processing result of the data decryption scenario is plaintext, and the symmetric key required to decrypt the ciphertext part of the ciphertext is obtained based on the result of the modular product operation (such as modular multiplication operation) of the private key and the random information part, that is, the result of the modular product operation (such as modular multiplication operation) of the private key and the random information part is used to derive a symmetric key through a key derivation function, and then the symmetric key and the ciphertext part are further operated to restore the plaintext.

[0114] For example, the data processing result of the digital signature scenario is the signature data. The generation of the signature pair of the signature data requires the use of the result of the modular product operation (such as modular multiplication operation) of the random number and the base point of the elliptic curve, that is, the result of the modular product operation (such as modular multiplication operation) of the random number and the base point of the elliptic curve is used as the intermediate data to participate in the generation process of the signature pair of the signature data to generate the signature pair of the signature data.

[0115] The data processing method provided in the embodiment of the present application can determine the data processing result of the data to be processed based on the operation result of the modular product operation of the elliptic curve cryptography algorithm when using the elliptic curve cryptography algorithm to process the data to be processed, thereby realizing data processing in the data processing scenario where the elliptic curve cryptography algorithm is applied, and obtaining the data processing result of the data processing scenario. Specifically, the elliptic curve of the elliptic curve cryptography algorithm is defined in the prime number domain, and the modular product operation of the elliptic curve cryptography algorithm takes the product modulo the prime numbers of the prime number domain. Then, during the operation process of the modular product operation, the embodiment of the present application can determine multiple input multipliers of the modular product operation, and the input multipliers are represented in binary, thereby determining the accumulation of multiple product terms corresponding to the multiplication of the binary representations of the multiple input multipliers; further, in the gradual accumulation process of the product term accumulation, the accumulation result of each step of the accumulation is corrected using the correction factor of the intermediate domain and the prime numbers of the prime number domain to obtain multiple corrected results, and the last corrected result of the multiple corrected results corresponds to the result of the modular multiplication operation of the intermediate domain; then the last corrected result is mapped back to the prime number domain to obtain the operation result of the modular product operation in the prime number domain, so as to determine the data processing result of the data to be processed based on the operation result of the modular product operation in the prime number domain. Since the correction factor of the intermediate domain can map the operation to the intermediate domain to eliminate the division operation during the gradual accumulation of the product terms, the embodiment of the present application can simplify the complexity of the modular product operation, and the embodiment of the present application uses prime numbers to make the gradually obtained correction results converge in the direction of prime numbers, so that the last correction result can be mapped back to the prime number domain to ensure the accuracy of the operation result.

[0116] Therefore, the embodiments of the present application can utilize the correction factors in the intermediate domain and the prime numbers in the prime domain to convert the modular product operation to the intermediate domain during the gradual accumulation of product terms, thereby eliminating complex division operations, reducing computational overhead, improving the efficiency of the modular product operation, and ensuring the accuracy of the results. Therefore, the embodiments of the present application can improve the computational performance of the modular product operation, thereby improving the algorithmic performance of the elliptic curve cryptography algorithm, and further improving the data processing performance of the elliptic curve cryptography algorithm, achieving efficient and accurate data processing.

[0117] Furthermore, the embodiment of the present application can be based on the prime number p being 256 bits, and expressed as p=2 256 -2 224 -2 96 +2 64 -1, the i-th correction result C i The calculation is simplified, that is, Among them, z i =(C i-1 +d i )mod 2 64 , thereby simplifying the step-by-step accumulation process of product term accumulation.

[0118] On this basis, the i-th correction result C when i>0 and i=0 i The calculation of can be simplified to the shift operation of the components, that is, when i>0, the i-th correction result C i The calculation is (e4+e0-(e0>>32))·2 192 +(e3-(e0<<32))·2 128 +(e2-(e0>>32))·2 64 +(e1+e0-(e0<<32)), when i=0, the calculation of the zeroth correction result C0 is (e0-(e9>>32))·2 192 -(e0<<32)·2 128 -(e0>>32)·2 64 +(e1+e0-(e0<<32)), thereby further simplifying the amount of calculation, especially simplifying the number of multiplication operations.

[0119] The following uses modular product operations as modular multiplication and modular square operations as examples to illustrate the modular product operation process. It can be understood that modular square operations can actually be considered a special modular multiplication operation, that is, modular multiplication operations with the same input multipliers, but represented by squares.

[0120] As an optional implementation, take modular product operation as an example, Figure 3 The flowchart of the modular multiplication operation provided by the embodiment of the present application is exemplified. Figure 3 The relevant introduction of the process steps can refer to the previous description. The following is mainly Figure 3 The process uses the example of a prime field with an element size of 256 bits (i.e., a prime number of 256 bits) and a processor with a bit width of 64 bits to introduce optional examples in the process steps.

[0121] like Figure 3 As shown, the process may include the following steps.

[0122] In step S310 , a first binary representation of the first input multiplier is determined, where the first binary representation is a linear combination of multiple components of the first input multiplier and multiple position coefficients, where one component corresponds to one position coefficient, representing a shift of the component.

[0123] For ease of explanation, the binary representation of the first input multiplier is referred to as a first binary representation. Assuming the first input multiplier is represented by A, the first binary representation of the first input multiplier A can be:

[0124]

[0125] For example, the prime number p of the prime field GF(p) can be a 256-bit prime number. Accordingly, the size of the first input multiplier A is 256 bits. Furthermore, when the bit width w of the processor is 64 bits, the first binary representation of the first input multiplier A can be: a0+a1·2 64 +a2·2 128 +a3·2 192 .

[0126] Where a0 is the zeroth component of the first input multiplier A, and occupies the first 64 bits (i.e., bits 0 to 63) in the binary number of the first input multiplier A. a0 is already in the correct position of the first input multiplier A and does not need to be shifted. Therefore, the position coefficient of a0 is 2 0 , which is represented in the first binary representation as a0·2 0 , a0·2 0 Abbreviated as a0;

[0127] a1 is the first component of the first input multiplier A, and occupies the second 64-bit position (i.e., the 64th to the 127th bit) in the binary number of the first input multiplier A. In order to place a1 in the correct position of the first input multiplier A, a1 needs to be shifted by 64 bits, i.e., the position coefficient of a1 is 2 64 , which is represented in the first binary representation as a1·2 64 ;

[0128] a2 is the second component of the first input multiplier A, and occupies the third 64-bit position (i.e., the 128th to the 191st bit) in the binary number of the first input multiplier A. In order to place a2 in the correct position of the first input multiplier A, a2 needs to be shifted 128 bits, i.e., the position coefficient of a2 is 2 128 , which is represented in the first binary representation as a2·2 128 ;

[0129] a3 is the third component of the first input multiplier A and occupies the fourth 64-bit position (i.e., the 192th to the 255th bit) in the binary number of the first input multiplier A. In order to place a3 in the correct position of the first input multiplier A, a3 needs to be shifted by 192 bits, i.e., the position coefficient of a3 is 2 192 , which is represented in the first binary representation as a3·2 192 .

[0130] That is, in the first binary representation, each component of the first input multiplier A is correspondingly shifted by the position coefficient to ensure that each component can be placed in the correct position of the first input multiplier A.

[0131] In step S320 , a second binary representation of the second input multiplier is determined, where the second binary representation is a linear combination of multiple components of the second input multiplier and multiple position coefficients, where one component corresponds to one position coefficient, representing a shift of the component.

[0132] The implementation of step S320 is similar to that of step S310, except that step S320 is for the second input multiplier. For ease of explanation, the binary representation of the second input multiplier is referred to as the second binary representation. Let the second input multiplier be represented by B. The second binary representation of the second input multiplier B can be:

[0133]

[0134] The i-th component of the second input multiplier B is represented by b i .

[0135] For example, the second input multiplier B belongs to an element of the prime field GF(p), and the size of the second input multiplier B is 256 bits. Furthermore, when the bit width w of the processor is 64 bits, the second binary representation of the second input multiplier B can be: b0+b1·2 64 +b2·2 128 +b3·2 192 .

[0136] Among them, b0 is the zeroth component of the second input multiplier B, which is the lowest 64 bits of the second input multiplier B and does not require shifting. The corresponding position coefficient is 2 0 , in the second binary representation b0·2 0 Abbreviated as b0; b1 is the first component of the second input multiplier B. In the second binary representation, b1·2 64 b1 is shifted by 64 bits, that is, it corresponds to the 64th to 127th bits in the binary number of the second input multiplier B; b2 is the second component of the second input multiplier B, b2·2 128 b2 is shifted by 128 bits, which corresponds to the 128th to 191th bits in the binary number of the second input multiplier B; b3 is the third component of the second input multiplier B, b3·2 192 This represents b3 shifted by 192 bits, corresponding to bits 192 to 255 in the binary representation of the second input multiplier B. That is, in the second binary representation, each component of the second input multiplier B is shifted accordingly by the position coefficient to ensure that each component can be placed in the correct position of the second input multiplier B.

[0137] In step S330, the first binary representation and the second binary representation are multiplied to obtain a product result, and the product result is expanded to obtain a plurality of product terms, wherein the plurality of product terms are added to form the product result.

[0138] Assume that the product of the multiplication of the first binary representation and the second binary representation is D. Then, taking the above example of the first binary representation and the second binary representation, D=A·B=(a0+a1·2 64 +a2·2 128 +a3·2 192 )·(b0+b1·2 64 +b2·2 128 +b3·2 192 );

[0139] Furthermore, the product result D is expanded to obtain multiple product terms, and the product result D is expressed as the sum of multiple product terms. Specifically, the product result D can be expressed as follows after expansion:

[0140] a0b0+a0b1·2 64 +a0b2·2 128 +a0b3·2 192 +a1b0·2 64 +a1b1·2 128 +a1b2·2 192 +a1b3·2 256 +a2b0·2 128 +a2b1·2 192 +a2b2·2 256 +a2b3·2 320 +a3b0·2 192 +a3b1·2 256 +a3b2·2 320 +a3b3·2 384 .

[0141] That is, each term in the first binary representation and the second binary representation is cross-multiplied, for example, each term in the first binary representation is multiplied with each term in the second binary representation, to obtain a plurality of product terms, and the plurality of product terms are added to form a product result.

[0142] In step S340, multiple product terms are classified according to position coefficients to obtain multiple product term accumulations corresponding to different position coefficients, and one product term accumulation corresponds to one position coefficient, indicating the shift of the product term accumulation.

[0143] The embodiment of the present application can classify multiple product terms of the product result according to the position coefficient, so as to obtain different product term accumulations corresponding to different position coefficients, that is, multiple product term accumulations, and one product term accumulation corresponds to one position coefficient, which is used to represent the shift of the product term accumulation.

[0144] For example, in modular multiplication, the multiple product terms of the product result can be calculated according to 2 0 The position coefficient, 264 The position coefficient, 2 128 The position coefficient, 2 192 The position coefficients are classified respectively, so as to obtain the corresponding 2 0 The zeroth product term accumulation of the position coefficient (i.e., the accumulation of product terms that do not require additional shifting in multiple product terms) corresponds to 2 64 The first product term accumulation of the position coefficient (that is, the accumulation of product terms that need to be shifted 64 bits among multiple product terms) corresponds to 2 128 The second product term accumulation of the position coefficient (that is, the accumulation of product terms that need to be shifted 128 bits in multiple product terms) corresponds to 2 192 The third product term of the position coefficient is accumulated (that is, the accumulation of the product terms that need to be shifted 192 bits among the multiple product terms).

[0145] For example, corresponding to 2 0 The zeroth product term accumulation of the position coefficient can be expressed as d0, so based on the product result D of the above example, the zeroth product term accumulation d0 can be expressed as:

[0146] d0=a0b0+a0b1·2 64 +a0b2·2 128 +a0b3·2 192 ;

[0147] That is, the product term classified by the zeroth product term accumulation d0 is the product term that does not require additional shifting in the product result, so the position coefficient corresponding to the zeroth product term accumulation d0 is 2 0 .

[0148] For example, corresponding to 2 64 The first product term accumulation of the position coefficient can be expressed as d1, so based on the product result D of the above example, the first product term accumulation d1 can be expressed as:

[0149] d1=a1b0+a1b1·2 64 +a1b2·2 128 +a1b3·2 192 ;

[0150] That is, the product term classified by the first product term accumulation d1 is the product term that needs to be shifted 64 bits in the product result, so the position coefficient corresponding to the first product term accumulation d1 is 2 64 .

[0151] For example, corresponding to 2 128 The second product term accumulation of the position coefficient can be expressed as d2, so based on the product result D of the above example, the second product term accumulation d2 can be expressed as:

[0152] d2=a2b0+a2b1·2 64 +a2b2·2 128 +a2b3·2 192 ;

[0153] That is, the product term classified by the second product term accumulation d2 is the product term that needs to be shifted 128 bits in the product result, so the position coefficient corresponding to the second product term accumulation d2 is 2 128 .

[0154] For example, corresponding to 2 192 The third product term accumulation of the position coefficient can be expressed as d3, so based on the product result D of the above example, the third product term accumulation d3 can be expressed as:

[0155] d3=a3b0+a3b1·2 64 +a3b2·2 128 +a3b3·2 192 ;

[0156] That is, the product term classified by the third product term accumulation d3 is the product term that needs to be shifted 192 bits in the product result, so the position coefficient corresponding to the third product term accumulation d3 is 2 192 .

[0157] Furthermore, in the above example, the product D can be expressed as:

[0158] D=A·B=d0·2 0 +d1·2 64 +d2·2 128 +d3·2 192 =(a0b0+a0b1·2 64 +a0b2·2 128 +a0b3·2 192 )+(a1b0·2 64 +a1b1·2 128 +a1b2·2 192 +a1b3·2 256 )+(a2b0·2 128 +a2b1·2 192 +a2b2·2 256 +a2b3·2 320 )+(a3b0·2 192 +a3b1·2 256 +a3b2·2 320 +a3b3·2 384 ).

[0159] In step S350, multiple product terms are accumulated step by step in order from low to high, and the accumulated result of each step is corrected using a correction factor and a prime number, so that the next accumulation step is to accumulate the next product term on the basis of the corrected result corresponding to the previous accumulation step, until the accumulated result of the last accumulation step is corrected to obtain multiple corrected results; the last corrected result among the multiple corrected results corresponds to the result of the modular multiplication operation of the intermediate domain.

[0160] In an optional implementation, based on the i-th correction result C i The relevant formula is expressed as 2 64 ·C i =(C i-1 +d i )+(μ·(C i-1 +d i )mod 2 64 )·p, taking the zeroth product term accumulation d0 to the third product term accumulation d3 in the above example as an example, according to the order of position coefficients from small to large, the zeroth product term accumulation d0 to the third product term accumulation d3 are gradually accumulated, and the accumulation process can be as follows.

[0161] First, the zeroth product term accumulation d0 (i.e., the first product term accumulation) is accumulated, and the correction factor μ and the prime number p are used to correct it to obtain the zeroth correction result;

[0162] As an example, the zeroth correction result is represented as C0, and the formula related to the zeroth correction result C0 can be expressed as:

[0163] 2 64 C0=d0+(μ·d0mod 2 64 )·p;

[0164] As can be seen, the correction factor μ and the prime number p are introduced to modify the zeroth product term d0 of the first accumulation process, so that the accumulation process is mapped to the intermediate domain (e.g., the Montgomery domain) corresponding to the correction factor μ and remains in the intermediate domain (e.g., the Montgomery domain) to eliminate division operations. At the same time, the zeroth correction result C0 is kept within a reasonable range (i.e., close to the prime number p), preventing subsequent results from being unable to be mapped back to the prime field GF(p). In other words, the correction factor μ is used to map the operation to the intermediate domain to eliminate division operations, and the prime number p causes the correction result to converge toward the prime number p.

[0165] Furthermore, based on the zeroth correction result C0, the first product term d1 is accumulated, and the accumulated result is corrected using the correction factor μ and the prime number p to obtain the first correction result; as an example, the first correction result is expressed as C1, and the formula related to the first correction result C1 can be expressed as:

[0166] 2 64 ·C1=(C0+d1)+(μ·(C0+d1)mod 2 64 )·p;

[0167] It can be seen that the correction factor μ and the prime number p are introduced to correct the cumulative result (C0+d1) of the zeroth correction result C0 and the first product term accumulation d1, so that the accumulation process is mapped to the intermediate domain corresponding to the correction factor μ and remains in the intermediate domain to eliminate the division operation; at the same time, the first correction result C1 is close to the reasonable range of the prime number p.

[0168] Furthermore, based on the first corrected result C1, the second product term d2 is accumulated, and the accumulated result is corrected using the correction factor μ and the prime number p to obtain a second corrected result. As an example, the second corrected result is expressed as C2, and the formula related to the second corrected result C2 can be expressed as:

[0169] 2 64 ·C2=(C1+d2)+(μ·(C1+d2)mod 2 64 )·p;

[0170] It can be seen that the correction factor μ and the prime number p are introduced to correct the cumulative result (C1+d2) of the first correction result C1 and the second product term d2, so that the accumulation process is mapped to the intermediate domain corresponding to the correction factor μ and remains in the intermediate domain to eliminate the division operation; at the same time, the second correction result C2 is close to the reasonable range of the prime number p.

[0171] Furthermore, based on the second corrected result C2, the third product term d3 is accumulated, and the accumulated result is corrected using the correction factor μ and the prime number p to obtain a third corrected result. As an example, the third corrected result is expressed as C3, and the formula related to the third corrected result C3 can be expressed as:

[0172] 2 64 ·C3=(C2+d3)+(μ·(C2+d3)mod 2 64 )·p;

[0173] It can be seen that the correction factor μ and the prime number p are introduced to correct the cumulative result (C2+d3) of the second correction result C2 and the third product term d3, so that the accumulation process is mapped to the intermediate domain corresponding to the correction factor μ and remains in the intermediate domain to eliminate the division operation; at the same time, the third correction result C3 is close to the reasonable range of the prime number p.

[0174] That is, when accumulating in step i, the correction factor μ and prime number p are introduced to correct the i-1th correction result C i-1 Cumulative d with the i-th product termi The cumulative result (C i-1 +d i ), so that the accumulation of the i-th step is mapped to the intermediate domain corresponding to the correction factor μ and kept in the intermediate domain to eliminate the division operation; at the same time, the i-th correction result C i It is within the reasonable range close to the prime number p. It should be noted that when i is 0, the first accumulation process is actually performed, that is, the accumulation of the zeroth product term d0 is accumulated and corrected. Therefore, when i is 0, it is considered that C i-1 Does not exist.

[0175] After completing the above-mentioned step-by-step accumulation process, the last correction result (for example, the third correction result C3) is the result of the modular multiplication operation in the intermediate field. Therefore, the last correction result is mapped back to the prime number field GF(p), and the result of the modular multiplication operation under the prime number field GF(p) can be obtained.

[0176] Specifically, the modular multiplication operation in the prime field is expressed as A·B mod p, and the modular multiplication operation in the intermediate field is expressed as A·B·R -1 Mod p, taking the third correction result C3 in the above example as the last correction result, in the process of gradually accumulating and correcting to obtain the third correction result C3, a total of 4 steps of accumulation are performed, so R can be taken as 2 64×4 (i.e. 2 256 ), so C3≡A·B·2 -256 mod p, that is, the third correction result C3 is the result of the modular multiplication operation of the intermediate field; then, the third correction result C3 (the last correction result) is mapped back to the prime field GF(p), for example, multiplied by 2 256 , we can get the result of modular multiplication A·B mod p under the prime number field GF(p).

[0177] In a further optional implementation, based on the i-th correction result C further provided in the embodiment of the present application i The calculation is simplified, that is And the specific decomposition of i>0 and the simplified calculation when i=0 is expressed as follows: when i>0, the i-th correction result C i The calculation is (e4+e0-(e0>>32))·2 192 +(e3-(e0<<32))·2 128 +(e2-(e0>>32))·2 64 +(e1+e0-(e0<<32)), when i=0, the calculation of the zeroth correction result C0 is (e0-(e0>>32))·2 192 -(e0<<32)·2 128 -(e0>>32)·2 64+(e1+e0-(e0<<32)), the embodiment of the present application can further simplify the calculation of the i-th correction result C under the modular multiplication operation. i Calculation.

[0178] Taking the i-th step accumulation under modular multiplication as an example, the i-th correction result C corresponding to the i-th step accumulation is involved. i The formula is: 2 64 ·C i =(C i-1 +d i )+(μ·(C i-1 +d i )mod 2 64 )·p; It can be seen that one step of accumulation involves one multiplication by the prime number p, and one multiplication by the prime number p involves four 64-bit multiplications. Therefore, taking the third correction result C3 as the last correction result as an example, there are four step-by-step accumulations and each accumulation is multiplied by the prime number p, so there are a total of 16 (4 times 4) 64-bit multiplications. In this regard, the embodiment of the present application can use the i-th correction result C i The calculation simplification of , as well as the calculation simplification when i>0 and when i=0 are used to simplify the number of multiplication operations under modular multiplication operation.

[0179] Specifically, the calculation simplification of the zeroth correction result C0, the first correction result C1, the second correction result C2, and the third correction result C3 is illustrated below.

[0180] When calculating the zeroth correction result C0, i_0, and the zeroth product term d0 is accumulated and corrected, where d0 can be expressed as d0=a0b0+a0b1·2 64 +a0b2·2 128 +a0b3·2 192 = fl0+(fh0+fl1)·2 64 +(fh1+fl2)·2 128 +(fh2+fl3)·2 192 +fh3·2 256 ; Among them, fl i (e.g. fl0, fl1, fl2, fl3), fh i (e.g. fh0, fh1, fh2, fh3) are the intermediate values ​​generated during the expansion of d0, i.e. d0 is 2 0 to 2 256 The intermediate values ​​produced when the position coefficients are expanded;

[0181] Let eh = fl0 < < 32, indicating that fl0 is shifted to the left by 32 bits, and el = fl0 >> 32, indicating that fl0 is shifted to the right by 32 bits. The process of calculating the zeroth correction result C0 can be expressed as:

[0182] cf 01 2 64 +c 00 =e1+e0-(e0<<32)=fh0+fl1+fl0-eh=fh0+fl0+fl1+(2 64 -eh)-2 64 ;

[0183] cf 02 2 64 +c 01 =e2-(e0>>32)+cf 01 =fh1+fl2-el=fh1+fl2+(2 64 -el)+cf 01 -2 64 ;

[0184] cf 03 2 64 +c 02 =e3-(e0<<32)+cf 02 =fh2+fl3+(2 64 -eh)+cf 02 -2 64 ;

[0185] cf 04 2 64 +c 03 =e4+e0-(e0>>32)+cf 03 =fh3+fl0+(2 64 -el)+cf 03 -2 64 ;

[0186] c 04 =cf 04 ;

[0187] Among them, c 0i (For example, c 00 、c 01 、c 02 、c 03 、c 04 ) is the intermediate calculation result of each step in the calculation process of the zeroth correction result C0, that is, the intermediate calculation result of the zeroth correction result C0 at different positions, and then the intermediate calculation result c at each position 0i The zeroth correction result C0 is obtained by carrying; cf 0i (For example, cf 01 ,cf 02 ,cf 03 ,cf 04 ) is the carry value.

[0188] Further simplifying, the above process of calculating the zeroth correction result C0 can be simplified to:

[0189] cf 01 2 64 +c 00 =e1+e0-(e0<<32)=fh0+fl1+fl0-eh=fh0+fl0+fl1+(~eh)+1;

[0190] cf 02 2 64 +c 01 =e2-(e0>>32)+cf 01 =fh1+fl2-el=fh1+fl2+(~el)+cf 01 ;

[0191] cf 03 2 64 +c 02 =e3-(e0<<32)+cf 02 =fh2+fl3+(~eh)+cf 02 ;

[0192] cf 04 2 64 +c 03 =e4+e0-(e0>>32)+cf 03 =fh3+fl0+(~el)+cf 03 ;

[0193] c 04 =cf 04 -1;

[0194] Among them, ~ represents the bitwise inversion operation, that is, each bit of the binary number is inverted in the bit operation, such as 0 becomes 1, 1 becomes 0;

[0195] It can be seen that when i_0, the calculation of the zeroth correction result C0 requires 4 multiplications, 9 additions, 2 shifts and 2 inversions of 64 bits, where the carry value cf 0i The value of 0 or 1; when using the carry addition instruction, cf 0i The addition time can be hidden in the 64-bit addition.

[0196] When calculating the first correction result C1, i_1, and the first product term d1 is accumulated and corrected, where d1 can be expressed as d1 = a1b0 + a1b1·2 64 +a1b2·2 128 +a1b3·2 192= fl0+(fh0+fl1)·2 64 +(fh1+fl2)·2 128 +(fh2+fl3)·2 192 +fh3·2 256 , similarly, the fl here i (e.g. fl0, fl1, fl2, fl3), fh i (e.g. fh0, fh1, fh2, fh3) to move d1 to 2 0 to 2 256 The intermediate values ​​produced when the position coefficients are expanded;

[0197] Correspondingly, the cumulative result C0+d1 of the first (i_1) step can be expressed as C0+d1=(c 04 +fh3)·2 256 +(c 03 +fh2+fl3)·2 192 +(c 02 +fh1+fl2)·2 128 +(c 01 +fh0+fl1)·2 64 +(c 00 +fl0), where cf 10 2 64 +e0=c 00 +fl0;

[0198] Let eh=e0<<32, el=e0>>32, then the process of calculating the first correction result C1 can be expressed as:

[0199] cf 11 2 64 +c 10 =e1+e0-(e0<<32)=(c 01 +fh0+fl1)+e0-eh=(c 01 +fh0+fl1)+e0+(~eh)+1+cf10;

[0200] cf 12 2 64 +c 11 =e2-(e0>>32)+cf 11 +cf 10 =(c 02 +fh1+fl2)+(~el)+cf 11 ;

[0201] cf 13 2 64 +c 12 =e3-(e0<<32)+cf12 =(c 03 +fh2+fl3)+(~eh)+cf 12 ;

[0202] cf 14 2 64 +c 13 =e4+e0-(e0>>32)+cf 13 =(c 04 +fh3)+e0+(~el)+cf 13 ;

[0203] c 14 =cf 14 -1;

[0204] It should be noted that when i>0, e0, e1, e2, e3, and e4 represent the cumulative result C of the i-th step. i-1 +d i Each 64-bit component of , correspondingly, when the current i_1, e0, e1, e2, e3, e4 represent each 64-bit component of the accumulated result C0+d1 accumulated in step 1;

[0205] Similarly, c 1i (For example, c 10 、c 11 、c 12 、c 13 、c 14 ) is the intermediate calculation result of each step in the calculation process of the first correction result C1, that is, the intermediate calculation result of the first correction result C1 at different positions, and then the intermediate calculation result c at each position 1i The first correction result C1 is obtained by carrying; cf 1i (For example, cf 10 ,cf 11 ,cf 12 ,cf 13 ,cf 14 ) is the carry value;

[0206] It can be seen that when i_1, the calculation of the first correction result C1 requires 4 multiplications, 13 additions, 2 shifts and 2 inversions of 64 bits, where the carry value cf 1i The value is 0 or 1; when using the carry addition instruction, cf 1i The addition time can be hidden in the 64-bit addition.

[0207] When calculating the second correction result C2, i_2, and the second product term d2 is accumulated and corrected, where d2 can be expressed as d2 = a2b0 + a2b1·2 64 +a2b2·2128 +a2b3·2 192 = fl0+(fh0+fl1)·2 64 +(fh1+fl2)·2 128 +(fh2+fl3)·2 192 +fh3·2 256 ; Similarly, the fl here i (e.g. fl0, fl1, fl2, fl3), fh i (e.g. fh0, fh1, fh2, fh3) to move d2 to 2 0 to 2 256 The intermediate values ​​produced when the position coefficients are expanded;

[0208] Correspondingly, the cumulative result C1+d2 of step 2(i_2) can be expressed as C1+d2=(c 14 +fh3)·2 256 +(c 13 +fh2+fl3)·2 192 +(c 12 +fh1+fl2)·2 128 +(c 11 +fh0+fl1)·2 64 +(c 10 +fl0), where cf 20 2 64 +e0=c 10 +fl0;

[0209] Let eh=e0<<32, el=e0>>32, then the process of calculating the second correction result C2 can be expressed as:

[0210] cf 21 2 64 +c 20 =e1+e0-(e0<<32)=(c 11 +fh0+fl1)+e0+(~eh)+1+cf 20 ;

[0211] cf 22 2 64 +c 21 =e2-(e0>>32)+cf 20 +cf 21 =(c 12 +fh1+fl2)+(~el)+cf 21 ;

[0212] cf 23 2 64 +c 22=e3-(e0<<32)+cf 22 =(c 13 +fh2+fl3)+(~eh)+cf 22 ;

[0213] cf 24 2 64 +c 23 =e4+e0-(e0>>32)+cf 23 =(c 14 +fh3)+e0+(~el)+cf 23 ;

[0214] c 24 =cf 24 -1;

[0215] Similarly, when i_2, e0, e1, e2, e3, and e4 are represented by each 64-bit component of the accumulated result C1+d2 in step 2; c 2i (For example, c 20 、c 21 、c 22 、c 23 、c 24 ) is the intermediate calculation result of each step in the calculation process of the second correction result C2, that is, the intermediate calculation result of the second correction result C2 at different positions, and then the intermediate calculation result c at each position 2i The second correction result C2 is obtained by carrying; cf 2i (For example, cf 20 ,cf 21 ,cf 22 ,cf 23 ,cf 24 ) is the carry value;

[0216] It can be seen that when i_2, the calculation of the second correction result C2 requires 4 multiplications, 13 additions, 2 shifts and 2 inversions of 64 bits, where the carry value cf 2i The value is 0 or 1. When using the carry addition instruction, cf 2i The addition time can be hidden in the 64-bit addition.

[0217] When calculating the third correction result C3, i_3, and the third product term d3 is accumulated and corrected, where d3 can be expressed as d3 = a3b0 + a3b1·2 64 +a3b2·2 128 +a3b3·2 192 = fl0+(fh0+fl1)·2 64 +(fh1+fl2)·2 128+(fh2+fl3)·2 192 +fh3·2 256 ; Similarly, the fl here i (e.g. fl0, fl1, fl2, fl3), fh i (e.g. fh0, fh1, fh2, fh3) to move d3 to 2 0 to 2 256 The intermediate values ​​produced when the position coefficients are expanded;

[0218] Correspondingly, the cumulative result C2+d3 of the third (i_3) step can be expressed as C2+d3=(c 24 +fh3)·2 256 +(c 23 +fh2+fl3)·2 192 +(c 22 +fh1+fl2)·2 128 +(c 21 +fh0+fl1)·2 64 +(c 20 +fl0), where cf 30 2 64 +e0=c 20 +fl0;

[0219] Let eh=e0<<32, el=e0>>32, then the process of calculating the third correction result C3 can be expressed as:

[0220] cf 31 2 64 +c 30 =e1+e0-(e0<<32)=(c 21 +fh0+fl1)+e0+(~eh)+1+cf 30 ;

[0221] cf 32 2 64 +c 31 =e2-(e0>>32)+cf 30 +cf 31 =(c 22 +fh1+fl2)+(~el)+cf 31 ;

[0222] cf 33 2 64 +c 32 =e3-(e0<<32)+cf 32 =(c 23 +fh2+fl3)+(~eh)+cf 32 ;

[0223] cf 34 2 64 +c 33 =e4+e0-(e0>>32)+cf 33 =(c 24 +fh3)+e0+(~el)+cf 33 ;

[0224] c 34 =cf 34 -1;

[0225] Similarly, when the current i_3, e0, e1, e2, e3, e4 are represented by each 64-bit component of the accumulated result C2+d3 in step 3; c 3i (For example, c 30 、c 31 、c 32 、c 33 、c 34 ) is the intermediate calculation result of each step in the calculation process of the third correction result C3, that is, the intermediate calculation result of the third correction result C3 at different positions, and then the intermediate calculation result c at each position 3i The third correction result C3 is obtained by carrying; cf 3i (For example, cf 30 ,cf 31 ,cf 32 ,cf 33 ,cf 34 ) is the carry value;

[0226] It can be seen that when i=3, the calculation of the third correction result C3 requires 4 multiplications, 13 additions, 2 shifts and 2 inversions of 64 bits, where the carry value cf 3i The value is 0 or 1. When using the carry addition instruction, cf 3i The addition time can be hidden in the 64-bit addition.

[0227] In summary, the total amount of calculation from the zeroth correction result C0 to the third correction result C3 is 16 multiplications, 48 ​​additions, 8 shifts and 8 inversions of 64 bits. Compared with directly performing modular multiplication in the Montgomery field, the amount of calculation can be greatly reduced. That is, in the modular multiplication operation, the above-mentioned i-th correction result C is used. i The simplified calculation and the simplified calculation when i>0 and when i=0 can reduce the amount of calculation; for example, compared with 32 multiplications of 64 bits required for direct modular multiplication in the Montgomery field, the above simplified calculation method can greatly reduce the amount of calculation in the multiplication operation (for example, reduce the amount of calculation by half).

[0228] As an optional implementation, take the modular product operation as the modular square operation as an example, Figure 4 The flowchart of the modular square operation provided in the embodiment of the present application is exemplarily shown. Figure 4 The relevant introduction of the process steps can refer to the previous description. The following is mainly Figure 4 The process uses the example of a prime field with an element size of 256 bits (i.e., a prime number of 256 bits) and a processor with a bit width of 64 bits to introduce optional examples in the process steps.

[0229] like Figure 4 As shown, the process may include the following steps.

[0230] In step S410, a binary representation of an input multiplier of a modular square operation is determined, where the binary representation of the input multiplier is a linear combination of multiple components of the input multiplier and multiple position coefficients, wherein one component corresponds to one position coefficient, representing a shift of the component.

[0231] When performing a modular square operation, the multiple input multipliers are identical. That is, the same input multiplier is squared and modulo a prime number. Therefore, it is sufficient to determine the binary representation of the identical input multiplier. For ease of explanation, the representation of the first input multiplier A defined in the modular multiplication operation is borrowed, and the input multiplier to be performed on the modular square operation is represented as A. The representation of the input multiplier A in the modular square operation can refer to the description of the corresponding section above.

[0232] For example, the prime number p in the prime field GF(p) is 256 bits (the prime number p is represented by p=2 256 -2 224 -2 96 +2 64 -1), the input multiplier A of the modular square operation is an element of the prime field GF(p), and the binary representation of the input multiplier A of the modular square operation is a0+a1·2 64 +a2·2 128 +a3·2 192 .

[0233] In step S420, a binary representation of the input multiplier of the modular square operation is squared to obtain a product result, and the product result is expanded to obtain a plurality of product terms, wherein the plurality of product terms are added to form the product result.

[0234] In step S430, multiple product terms are classified according to position coefficients to obtain multiple product term accumulations corresponding to different position coefficients, and one product term accumulation corresponds to one position coefficient, indicating the shift of the product term accumulation.

[0235] The result of the square operation of the binary representation of the input multiplier of the modular square operation is called the product result. Let the product result of the modular square operation be expressed as A2 , then A 2 =(a0+a1·2 64 +a2·2 128 +a3·2 192 ) 2 .

[0236] Furthermore, the product result A 2 Expand, and you can get multiple product terms, and the product result A 2 It is expressed as the addition of multiple product terms, and then the multiple product terms are classified according to the position coefficients, so that the accumulation of multiple product terms can be obtained.

[0237] For example, the product result A 2 After the multiple product terms of are classified according to the position coefficients, they can be expressed as:

[0238]

[0239] In the above example, the product A 2 There are 7 product term accumulations (the product term accumulation sequence starts from 0), specifically:

[0240] The zeroth product term accumulates d0, Represents the product result A 2 The lowest bit component (i.e. the first 64-bit component) does not need to be shifted, and the position coefficient is 2 0 ;

[0241] The first product term accumulates d1, d1 = 2a0a1, representing the product result A 2 The second 64-bit component in the value needs to be shifted 64 bits, with a position coefficient of 2. 64 ;

[0242] The second product term accumulates d2, Represents the product result A 2 The third 64-bit component in the byte needs to be shifted 128 bits, and the position coefficient is 2. 128 ;

[0243] The third product term accumulates d3, d3 = 2a0a3 + 2a1a2, representing the product result A 2 The fourth 64-bit component in the digits needs to be shifted 192 bits, and the position coefficient is 2. 192 ;

[0244] The fourth product term accumulates d4, Represents the product result A 2 The fifth 64-bit component in the digits needs to be shifted 256 bits, and the position coefficient is 2 256 ;

[0245] The fifth product term accumulates d5, d5 = 2a2a3, representing the product result A 2 The sixth 64-bit component in the digits needs to be shifted 320 bits, and the position coefficient is 2. 320 ;

[0246] The sixth product term accumulates d6, Represents the product result A 2 The seventh 64-bit component in the digits needs to be shifted 384 bits, and the position coefficient is 2 384 .

[0247] In step S440, multiple product terms are gradually accumulated in order from low to high, and the accumulated result of each step is corrected using a correction factor and a prime number, so that the next accumulation step is to accumulate the next product term on the basis of the corrected result corresponding to the previous accumulation step, until the accumulated result of the last accumulation step is corrected to obtain multiple corrected results; the last corrected result among the multiple corrected results corresponds to the result of the modular square operation of the intermediate domain.

[0248] In an optional implementation, based on the i-th correction result C i The relevant formula is expressed as 2 64 ·C i =(C i-1 +d i )+(μ·(C i-1 +d i )mod 2 64 )·p, taking the zeroth product term accumulation d0 to the sixth product term accumulation d6 in the above example as an example, the zeroth product term accumulation d0 to the sixth product term accumulation d6 are gradually accumulated in the order of position coefficients from small to large, and the accumulation process can be as follows.

[0249] First, the zeroth product term d0 is accumulated and corrected using the correction factor μ and the prime number p to obtain the zeroth correction result C0. The formula related to the zeroth correction result C0 can be expressed as:

[0250] 2 64 C0=d0+(μ·d0 mod 2 64 )·p.

[0251] Furthermore, based on the zeroth correction result C0, the first product term d1 is accumulated, and the accumulated result is corrected using the correction factor μ and the prime number p to obtain the first correction result C1. The formula related to the first correction result C1 can be expressed as:

[0252] 2 64 ·C1=(C0+d1)+(u·(C0+d1)mod 2 64 )·p.

[0253] Furthermore, based on the first corrected result C1, the second product term d2 is accumulated, and the accumulated result is corrected using the correction factor μ and the prime number p to obtain the second corrected result C2. The formula related to the second corrected result C2 can be expressed as:

[0254] 2 64 ·C2=(C1+d2)+(u·(C1+d2)mod 2 64 )·p.

[0255] Furthermore, based on the second corrected result C2, the third product term d3 is accumulated, and the accumulated result is corrected using the correction factor μ and the prime number p to obtain the third corrected result C3. The formula related to the third corrected result C3 can be expressed as:

[0256] 2 64 ·C3=(C2+d3)+(u·(C2+d3)mod 2 64 )·p.

[0257] Furthermore, based on the third corrected result C3, the fourth product term d4 is accumulated, and the accumulated result is corrected using the correction factor μ and the prime number p to obtain the fourth corrected result C4. The formula related to the fourth corrected result C4 can be expressed as:

[0258] 2 64 ·C4=(C3+d4)+(u·(C3+d4)mod 2 64 )·p.

[0259] Furthermore, based on the fourth corrected result C4, the fifth product term d5 is accumulated, and the accumulated result is corrected using the correction factor μ and the prime number p to obtain the fifth corrected result C5. The formula related to the fifth corrected result C5 can be expressed as:

[0260] 2 64 ·C5=(C4+d5)+(u·(C4+d5)mod 2 64 )·p.

[0261] Furthermore, based on the fifth corrected result C5, the sixth product term d6 is accumulated, and the accumulated result is corrected using the correction factor μ and the prime number p to obtain the sixth corrected result C6. The formula related to the sixth corrected result C6 can be expressed as:

[0262] 2 64 ·C6=(C5+d6)+(u·(C5+d6)mod 2 64 )·p.

[0263] In the above gradual accumulation process, the roles of the correction factor μ and the prime number p can be similarly referred to the description of the corresponding parts in the previous text and will not be explained in detail.

[0264] After completing the above-mentioned step-by-step accumulation process, the last correction result (for example, the sixth correction result C6) is the result of the modular square operation of the intermediate field, so the last correction result is mapped back to the prime number field GF(p), and the result of the modular square operation under the prime number field GF(p) can be obtained.

[0265] Specifically, the modular square operation in the prime field is represented by A 2 mod p, the modular square operation of the intermediate field is expressed as A 2 ·R -1 Mod p, taking the sixth correction result C6 in the above example as the last correction result, under the property of square operation, in the process of gradually accumulating and correcting to obtain the sixth correction result C6, a total of 7 steps of accumulation are performed, so R can be 2 64×7 (i.e. 2 448 ), so C6≡A 2 2 -448 mod p, that is, the sixth correction result C6 is the result of the modular square operation of the intermediate field; then, the sixth correction result C6 (the last correction result) is mapped back to the prime field GF(p), for example, multiplied by 2 448 , we can get the result A of the modular square operation under the prime field GF(p) 2 mod p.

[0266] In a further optional implementation, the embodiment of the present application can further simplify the calculation of the i-th correction result C under the modular square operation. i Taking the ith step accumulation under the modular square operation as an example, the ith correction result C corresponding to the ith step accumulation is i The formula is: 2 64 ·C i =(C i-1 +d i )+(μ·(C i-1 +d i )mod 2 64 )·p; It can be seen that one step of accumulation involves one multiplication by the prime number p, and one multiplication by the prime number p involves four 64-bit multiplications. Therefore, taking the sixth correction result C6 as the last correction result as an example, there are 7 step-by-step accumulations and each accumulation is multiplied by the prime number p, so there are a total of 28 (4 times 7) 64-bit multiplications. In this regard, the embodiment of the present application can use the i-th correction result C i The calculation simplification of , as well as the calculation simplification when i>0 and when i=0 are expressed to simplify the number of multiplication operations under the modular square operation.

[0267] That is to say, the i-th correction result C further provided in the embodiment of the present application i The calculation is simplified, that is, when p = 2 256 -2 224 -2 96 +2 64 Under the definition of -1, the i-th corrected result C of the modular square operation i Can be simplified to Among them, z i =(C i-1 +d i )mod 2 64 ; and the specific decomposition of i>0 and the simplified calculation when i=0, that is, when i>0, the i-th correction result C i The calculation is simplified to (e4+e0-(e0>>32))·2 192 +(e3-(e0<<32))·2 128 +(e2-(e0>>32))·2 64 +(e1+e0-(e0<<32)), when i_0, the zeroth correction result C0=(e0-(e0>>32))·2 192 -(e0<<32)·2 128 -(e0>>32)·2 64 +(e1+e0-(e0<<32)), the embodiment of the present application can further simplify the calculation of the i-th correction result C under the modular square operation. i calculations, especially the multiplication operations.

[0268] Specifically, under the modular square operation, use the i-th correction result C i The calculation simplification of i>0 and i=0 is shown as follows: i Calculation and d i The calculation of the zeroth correction result C0 requires only 1 multiplication, 1 addition, 2 shifts and 4 subtractions of 64 bits; the calculation of the first correction result C1 requires 1 multiplication, 7 additions, 2 shifts and 4 subtractions of 64 bits; the calculation of the second correction result C2 requires 2 multiplications, 9 additions, 2 shifts and 4 subtractions of 64 bits; the calculation of the third correction result C3 requires 2 multiplications, 11 additions, 2 shifts and 4 subtractions of 64 bits; the calculation of the fourth correction result C4 requires 2 multiplications, 9 additions, 2 shifts and 4 subtractions of 64 bits; the calculation of the fifth correction result C5 requires 1 multiplication, 7 additions, 2 shifts and 4 subtractions of 64 bits; the calculation of the sixth correction result C6 requires 1 multiplication, 5 additions, 2 shifts and 4 subtractions of 64 bits.

[0269] In summary, the total amount of calculation for the zeroth correction result C0 to the sixth correction result C6 is 10 multiplications, 49 additions, 14 shifts and 28 subtractions of 64 bits, and it can be completed using only 16 general registers; that is, in the modular square operation, the above i-th correction result C i The simplified calculation can reduce the amount of calculation. For example, compared with 26 64-bit multiplications required for directly performing modular square operations in the Montgomery field, the simplified calculation method can greatly reduce the amount of calculation in the multiplication operation (for example, reducing the amount of calculation by more than half).

[0270] In summary, the embodiments of the present application can optimize the computing performance of modular product operations (such as modular multiplication operations and modular square operations), thereby improving the computing performance of elliptic curve cryptographic algorithms such as the SM2 algorithm, for example, improving the operating efficiency of elliptic curve cryptographic algorithms such as the SM2 algorithm in software implementation, and then improving the data processing performance of data processing scenarios that apply elliptic curve cryptographic algorithms such as the SM2 algorithm.

[0271] In addition to software implementation, embodiments of the present application can extract an optimization scheme for modular product operations (such as modular multiplication and modular square operations) into an instruction set to support hardware acceleration of the processor. For example, based on the optimization scheme for modular product operations (such as modular multiplication and modular square operations), an instruction set for an elliptic curve cryptographic algorithm such as the SM2 algorithm is extracted. Then, when the instruction set is used for hardware implementation, an instruction set for an elliptic curve cryptographic algorithm such as the SM2 algorithm with optimized modular product operations (such as modular multiplication and modular square operations) can be used to develop a hardware acceleration module for the processor, so as to utilize the hardware acceleration module of the processor to perform the optimized modular product operations (such as modular multiplication and modular square operations), thereby accelerating the execution of elliptic curve cryptographic algorithms such as the SM2 algorithm, and thereby improving the data processing performance of data processing scenarios in which elliptic curve cryptographic algorithms such as the SM2 algorithm are applied.

[0272] That is to say, the data processing method provided in the embodiment of the present application (i.e., a data processing scheme using an elliptic curve cryptographic algorithm with modular product operation optimization) can be applied to software implementation or to hardware-level instruction sets, thereby achieving computational acceleration in the processor's hardware.

[0273] The data processing device provided in the embodiment of the present application is introduced below. The data processing device described below can be regarded as a functional module required to implement the data processing method provided in the embodiment of the present application. The content described below can be referenced in correspondence with the content described above.

[0274] As an optional implementation, Figure 5An optional block diagram of a data processing device provided in an embodiment of the present application is exemplarily shown. The device can be applied to a computer device, such as a computer device that uses an elliptic curve cryptographic algorithm such as the SM2 algorithm and the ECDSA algorithm to perform data encryption and decryption, digital signature and other data processing, including but not limited to terminal devices, server devices and other electronic devices with data processing functions; in an optional specific implementation, the data processing device can be applied to a processor in a computer device.

[0275] like Figure 5 As shown, the data processing device may include:

[0276] The data to be processed acquisition module 510 is used to acquire the data to be processed, and the data to be processed is processed using an elliptic curve cryptography algorithm, wherein the elliptic curve of the elliptic curve cryptography algorithm is defined in a prime number field;

[0277] An operation input determination module 520 is configured to determine input data for a modular product operation of an elliptic curve cryptography algorithm, wherein the modular product operation modulo a product by a prime number in a prime field, wherein the input data includes a plurality of input multipliers for obtaining the product, and the input multipliers are represented in binary.

[0278] a product term accumulation determination module 530 for determining a plurality of product term accumulations corresponding to the multiplication of the binary representations of the plurality of input multipliers;

[0279] An accumulation correction module 540 is configured to use a correction factor in the intermediate domain and a prime number in the prime number domain to correct an accumulation result in each step of the accumulation of multiple product terms, thereby obtaining multiple correction results, wherein a last correction result of the multiple correction results corresponds to a result of the modular product operation in the intermediate domain; wherein the correction factor in the intermediate domain is used to map the operation to the intermediate domain to eliminate a division operation;

[0280] A mapping recovery module 550 is used to map the last correction result back to the prime number domain to obtain the result of the modular product operation in the prime number domain;

[0281] The data processing result determination module 560 is used to determine the data processing result of the data to be processed according to the result of the modular product operation in the prime number field, as the data processing result of the data processing scenario applying the elliptic curve cryptography algorithm.

[0282] In an optional implementation, the accumulation correction module 540 is configured to use the correction factor of the intermediate field and the prime number of the prime field to correct the accumulation result of each step of the accumulation in the step-by-step accumulation process of the multiple product terms to obtain multiple correction results, which may include:

[0283] In order from low to high, multiple product terms are gradually accumulated, and the accumulated result of each step is corrected by using correction factors and prime numbers, so that the next step of accumulation is to accumulate the next product term on the basis of the corrected result corresponding to the previous step of accumulation, until the accumulated result of the last step of accumulation is corrected to obtain multiple corrected results.

[0284] In an optional implementation, the accumulation correction module 540 is configured to gradually accumulate multiple product terms in order from low to high bits, and correct the accumulation result of each accumulation step using a correction factor and a prime number, so that the next accumulation step accumulates the next product term based on the corrected result corresponding to the previous accumulation step, until the accumulation result of the last accumulation step is corrected. The multiple corrected results may include:

[0285] During the accumulation in step i, the accumulated result of step i is corrected according to the following formula:

[0286] 2 64 ·C i =(C i-1 +d i )+(μ·(C i-1 +d i )mod 2 64 )·p;

[0287] Among them, C i is the i-th correction result corresponding to the i-th step accumulation, C i-1 is the i-1th correction result corresponding to the i-1th step, d i is the accumulation of the i-th product term, C i-1 +d i is the cumulative result of the i-th step, μ is the correction factor, and p is a prime number.

[0288] In an alternative implementation, the correction factor is a multiplicative inverse associated with a prime number, and the correction factor is expressed as μ = -p -1 modR, where R is a constant introduced in the intermediate domain, used to convert the operation of the prime field GF(p) to the intermediate domain; R takes 2 k The value of k is: the number of cumulative steps of the gradual accumulation of multiple product terms multiplied by 64 bits.

[0289] In an optional implementation, the prime number is 256 bits and is represented as p=2 256 -2 224 -2 96 +2 64 -1; the i-th correction result C i The calculation includes:

[0290]

[0291] Among them, z i =(C i-1 +d i )mod 2 64 , Indicates that the result is rounded down.

[0292] In an optional implementation, the i-th correction result C i The calculation specifically includes:

[0293] When i>0, the i-th correction result C i The calculation is: (e4+e0-(e0>>32))·2 192 +(e3-(e0<<32))·2 128 +(e2-(e0>>32))·2 64 +(e1+e0-(e0<<32));

[0294] Among them, when i>0, e0, e1, e2, e3, and e4 represent the cumulative result C of the i-th step accumulation. i-1 +d i For each 64-bit component of , >> represents a right shift operation, and << represents a left shift operation.

[0295] In an optional implementation, the i-th correction result C i The calculation specifically includes:

[0296] When i=0, the calculation of the zeroth correction result C0 is (e0-(e0>>32))·2 192 -(e0<<32)·2 128 -(e0>>32)·2 64 +(e1+e0-(e0<<32));

[0297] Wherein, when i=0, e0, e1, e2, e3, and e4 represent each 64-bit component of the zeroth product term accumulation, and the zeroth product term accumulation is the first product term accumulation among multiple product term accumulations.

[0298] In an optional implementation, the modular product operation includes a modular multiplication operation or a modular square operation.

[0299] In an optional implementation, the binary representation of the input multiplier is a linear combination of multiple components of the input multiplier and multiple position coefficients, where the size of a component corresponds to the bit width of the processor and one component corresponds to one position coefficient, representing the shift of the component.

[0300] In an optional implementation, the product term accumulation determination module 530 for determining a plurality of accumulated product terms corresponding to the multiplication of the binary representations of the plurality of input multipliers may include:

[0301] determining a product result of multiplying binary representations of the plurality of input multipliers, and expanding the product result to obtain a plurality of product terms, wherein the plurality of product terms are added to form the product result;

[0302] The multiple product terms are classified according to the position coefficients to obtain multiple product term accumulations corresponding to different position coefficients, and one product term accumulation corresponds to one position coefficient, indicating the shift of the product term accumulation.

[0303] In an optional implementation, the binary representation of the input multiplier is:

[0304]

[0305] Wherein, A is one of the multiple input multipliers, w is the bit width of the processor, and a i is the i-th component, 2 wi for a i The corresponding position coefficient, indicating a i displacement.

[0306] In an optional implementation, the modular product operation includes a modular multiplication operation, and the plurality of input multipliers include a first input multiplier and a second input multiplier; wherein the prime number is 256 bits and the bit width of the processor is 64 bits;

[0307] The accumulation of the plurality of product terms includes: corresponding position coefficient 2 0 The zeroth product term accumulates, and the corresponding position coefficient is 2 64 The first product term accumulates, corresponding to the position coefficient 2 128 The second product term accumulation and the corresponding position coefficient 2 192 The third product term of is accumulated;

[0308] The multiple correction results include:

[0309] In step 0, the zeroth product term is accumulated and corrected to obtain the zeroth correction result;

[0310] In the first step of accumulation, the first correction result is obtained by correcting the cumulative result of the zeroth correction result and the first product term;

[0311] In step 2, the accumulated result of the first correction result and the second product term is corrected to obtain a second corrected result;

[0312] In the third step of accumulation, the accumulated result of the second correction result and the third product term is corrected to obtain a third correction result; the third correction result corresponds to the result of the modular multiplication operation of the intermediate domain.

[0313] In an optional implementation, for modular multiplication operation, the third modified result is expressed corresponding to the result of the modular multiplication operation of the intermediate field as follows:

[0314] C3≡A·B·2 -256 mod p;

[0315] Wherein, C3 is the third correction result, A is the first input multiplier, B is the second input multiplier, p is a prime number, ≡ is the congruence symbol, and both sides of the congruence symbol are equivalent.

[0316] In an optional implementation, the modular product operation includes a modular square operation, and the multiple input multipliers are the same input multipliers; wherein the prime number is 256 bits and the bit width of the processor is 64 bits;

[0317] The accumulation of the plurality of product terms includes: corresponding position coefficient 2 0 The zeroth product term accumulates, and the corresponding position coefficient is 2 64 The first product term accumulates, corresponding to the position coefficient 2 128 The second product term is accumulated, and the corresponding position coefficient is 2 192 The third product term is accumulated, and the corresponding position coefficient is 2 256 The fourth product term is accumulated, and the corresponding position coefficient is 2 320 The fourth product term is accumulated, and the corresponding position coefficient is 2 320 The fifth product term accumulation and the corresponding position coefficient 2 384 The sixth product term of is accumulated;

[0318] The multiple correction results include:

[0319] In step 0, the zeroth product term is accumulated and corrected to obtain the zeroth correction result;

[0320] In the first step of accumulation, the first correction result is obtained by correcting the cumulative result of the zeroth correction result and the first product term;

[0321] In step 2, the accumulated result of the first correction result and the second product term is corrected to obtain a second corrected result;

[0322] In step 3, the third corrected result is obtained by correcting the accumulated result of the second corrected result and the third product term;

[0323] In step 4, the accumulated result of the third correction result and the fourth product term is corrected to obtain a fourth correction result;

[0324] In step 5, the accumulated result of the fourth corrected result and the fifth product term is corrected to obtain a fifth corrected result;

[0325] In the sixth step of accumulation, the accumulated result of the fifth correction result and the sixth product term is corrected to obtain a sixth correction result; the sixth correction result corresponds to the result of the modular square operation of the intermediate domain.

[0326] In an optional implementation, for the modular square operation, the sixth correction result is expressed corresponding to the result of the modular square operation of the intermediate field as follows:

[0327] C6≡A 2 2 -448 mod p;

[0328] Wherein, C6 is the sixth correction result, A is the input multiplier of the modular square operation, p is a prime number, ≡ is the congruence sign, and both sides of the congruence sign are equivalent.

[0329] In an optional implementation, the step-by-step accumulation process of the plurality of product terms is performed in an ascending order of position coefficients, where the ascending order of position coefficients represents an order from low to high bits.

[0330] In a further optional implementation, the data processing method provided in the embodiment of the present application is adapted to an instruction set applicable to the hardware level. The embodiment of the present application also provides a processor, which is designed based on an instruction set, and the instruction set has algorithm instructions for elliptic curve cryptographic algorithms such as the SM2 algorithm. The algorithm instructions are used by the processor to implement the data processing method provided in the embodiment of the present application to accelerate the execution of elliptic curve cryptographic algorithms such as the SM2 algorithm, thereby accelerating data processing in data processing scenarios that apply elliptic curve cryptographic algorithms such as the SM2 algorithm.

[0331] In a further optional implementation, an embodiment of the present application also provides a computer device, including the processor provided in the above-mentioned embodiment of the present application.

[0332] In a further optional implementation, the data processing method provided in the embodiment of the present application is suitable for software implementation. The embodiment of the present application also provides a computer device for running a software program. The computer device may include a processor and a memory, the memory stores computer program instructions, and the processor calls the computer program instructions stored in the memory to execute the data processing method provided in the embodiment of the present application.

[0333] In a further optional implementation, the embodiment of the present application also provides a storage medium, which stores computer program instructions. When the computer program instructions are executed by a processor, the data processing method provided in the embodiment of the present application is implemented.

[0334] In a further optional implementation, the embodiment of the present application also provides a computer program product, which includes computer program instructions. When the computer program instructions are executed by a processor, they implement the data processing method provided in the embodiment of the present application.

[0335] The above describes multiple embodiment schemes provided by the embodiments of the present application. The various optional methods introduced in each embodiment scheme can be combined and cross-referenced with each other without conflict, thereby extending a variety of possible embodiment schemes, which can all be considered as embodiment schemes disclosed and open in the embodiments of the present application.

[0336] Although the embodiments of the present application are disclosed above, the present application is not limited thereto. Any person skilled in the art may make various changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be based on the scope defined by the claims.

Claims

1. A data processing method, characterized in that: include: Acquiring data to be processed, wherein the data to be processed is processed using an elliptic curve cryptography algorithm, wherein an elliptic curve of the elliptic curve cryptography algorithm is defined in a prime number domain; Determining input data for a modular product operation of an elliptic curve cryptography algorithm, wherein the modular product operation modulo a product by a prime number in a prime field, wherein the input data includes a plurality of input multipliers for obtaining the product, and the input multipliers are in binary representation; determining a plurality of accumulations of product terms corresponding to multiplications of binary representations of the plurality of input multipliers; Using the correction factor of the intermediate domain and the prime number of the prime number domain, in a stepwise accumulation process of accumulating a plurality of product terms, the accumulated result of each step is corrected to obtain a plurality of corrected results, wherein the last corrected result of the plurality of corrected results corresponds to the result of the modular product operation of the intermediate domain; wherein the correction factor of the intermediate domain is used to map the operation to the intermediate domain to eliminate the division operation; Map the last corrected result back to the prime number field to obtain the result of the modular product operation in the prime number field; The data processing result of the data to be processed is determined according to the operation result of the modular product operation in the prime number field.

2. The method according to claim 1, characterized in that The method of using the correction factor of the intermediate field and the prime number of the prime field to correct the accumulated result of each step of the accumulation in the step-by-step accumulation process of the multiple product terms to obtain multiple corrected results includes: In order from low to high, multiple product terms are gradually accumulated, and the accumulated result of each step is corrected by using correction factors and prime numbers, so that the next step of accumulation is to accumulate the next product term on the basis of the corrected result corresponding to the previous step of accumulation, until the accumulated result of the last step of accumulation is corrected to obtain multiple corrected results.

3. The method according to claim 2, characterized in that The accumulation of multiple product terms is performed step by step from low to high order, and the accumulation result of each step is corrected by using a correction factor and a prime number, so that the next accumulation step is to accumulate the next product term based on the correction result corresponding to the previous accumulation step, until the accumulation result of the last accumulation step is corrected, and the multiple correction results obtained include: During the accumulation in step i, the accumulated result of step i is corrected according to the following formula: 2 64 ·C i =(C i-1 +d i )+(μ·(C i-1 +d i )mod 2 64 )·p; Among them, C i is the i-th correction result corresponding to the i-th step accumulation, C i-1 is the i-1th correction result corresponding to the i-1th step, d i is the accumulation of the i-th product term, C i-1 +d i is the cumulative result of the i-th step, μ is the correction factor, and p is a prime number.

4. The method according to claim 3, characterized in that The correction factor is the multiplicative inverse element associated with the prime number, and the correction factor is expressed as μ = -p -1 mod R, where R is a constant introduced in the intermediate domain, used to convert the operation of the prime field GF(p) to the intermediate domain; R is 2 k The value of k is: the number of cumulative steps of the gradual accumulation of multiple product terms multiplied by 64 bits.

5. The method according to claim 4, characterized in that The prime number is 256 bits and is represented by p=2 256 -2 224 -2 96 +2 64 -1; The i-th correction result C i The calculation includes: Among them, z i =(C i-1 +d i )mod 2 64 , Indicates that the result is rounded down.

6. The method according to claim 5, characterized in that The i-th correction result C i The calculation specifically includes: When i>0, the i-th correction result C i The calculation is: (e4+e0-(e0>>32))·2 192 +(e3-(e0<<32))·2 128 +(e2-(e0>>32))·2 64 +(e1+e0-(e0<<32)); Among them, when i>0, e0, e1, e2, e3, and e4 represent the cumulative result C of the i-th step accumulation. i-1 +d i For each 64-bit component, >> represents a right shift operation, and << represents a left shift operation.

7. The method according to claim 5, characterized in that The i-th correction result C i The calculation specifically includes: When i=0, the calculation of the zeroth correction result C0 is (e0-(e0>>32))·2 192 -(e0<<32)·2 128 -(e0>>32)·2 64 +(e1+e0-(e0<<32)); Wherein, when i=0, e0, e1, e2, e3, and e4 represent each 64-bit component of the zeroth product term accumulation, and the zeroth product term accumulation is the first product term accumulation among multiple product term accumulations; >> represents a right shift operation, and << represents a left shift operation.

8. The method according to any one of claims 3 to 7, characterized in that: The binary representation is a linear combination of multiple components of the input multiplier and multiple position coefficients, wherein the size of a component corresponds to the bit width of the processor, and one component corresponds to one position coefficient, representing a shift of the component; Determining and accumulating a plurality of product terms corresponding to the multiplication of the binary representations of the plurality of input multipliers comprises: determining a product result of multiplying binary representations of the plurality of input multipliers, and expanding the product result to obtain a plurality of product terms, wherein the plurality of product terms are added to form the product result; The multiple product terms are classified according to the position coefficients to obtain multiple product term accumulations corresponding to different position coefficients, and one product term accumulation corresponds to one position coefficient, indicating the shift of the product term accumulation.

9. The method according to claim 8, characterized in that The binary representation of the input multiplier is: Wherein, A is one of the multiple input multipliers, w is the bit width of the processor, and a i is the i-th component, 2 wi for a i The corresponding position coefficient represents a i Shift.

10. The method according to claim 9, characterized in that The modular product operation includes a modular multiplication operation, and the multiple input multipliers include a first input multiplier and a second input multiplier; wherein the prime number is 256 bits and the bit width of the processor is 64 bits; The accumulation of the plurality of product terms includes: corresponding position coefficient 2 0 The zeroth product term accumulates, and the corresponding position coefficient is 2 64 The first product term accumulates, corresponding to the position coefficient 2 128 The second product term accumulation and the corresponding position coefficient 2 192 The third product term of is accumulated; The multiple correction results include: In step 0, the zeroth product term is accumulated and corrected to obtain the zeroth correction result; In the first step of accumulation, the first correction result is obtained by correcting the cumulative result of the zeroth correction result and the first product term; In step 2, the accumulated result of the first correction result and the second product term is corrected to obtain a second corrected result; In the third step of accumulation, the accumulated result of the second correction result and the third product term is corrected to obtain a third correction result; the third correction result corresponds to the result of the modular multiplication operation of the intermediate domain.

11. The method according to claim 10, characterized in that The third correction result corresponds to the result of the modular multiplication operation of the intermediate domain and is expressed as follows: C3≡A·B·2 -256 towards p; Wherein, C3 is the third correction result, A is the first input multiplier, B is the second input multiplier, p is a prime number, ≡ is the congruence symbol, and both sides of the congruence symbol are equivalent.

12. The method according to claim 8, characterized in that The modular product operation includes a modular square operation, and the multiple input multipliers are the same input multipliers; wherein the prime number is 256 bits and the bit width of the processor is 64 bits; The accumulation of the plurality of product terms includes: corresponding position coefficient 2 0 The zeroth product term accumulates, and the corresponding position coefficient is 2 64 The first product term accumulates, corresponding to the position coefficient 2 128 The second product term is accumulated, and the corresponding position coefficient is 2 192 The third product term is accumulated, and the corresponding position coefficient is 2 256 The fourth product term is accumulated, and the corresponding position coefficient is 2 320 The fourth product term is accumulated, and the corresponding position coefficient is 2 320 The fifth product term accumulation and the corresponding position coefficient 2 384 The sixth product term of is accumulated; The multiple correction results include: In step 0, the zeroth product term is accumulated and corrected to obtain the zeroth correction result; In the first step of accumulation, the first correction result is obtained by correcting the cumulative result of the zeroth correction result and the first product term; In step 2, the accumulated result of the first correction result and the second product term is corrected to obtain a second corrected result; In step 3, the third corrected result is obtained by correcting the accumulated result of the second corrected result and the third product term; In step 4, the accumulated result of the third correction result and the fourth product term is corrected to obtain a fourth correction result; In step 5, the accumulated result of the fourth corrected result and the fifth product term is corrected to obtain a fifth corrected result; In the sixth step of accumulation, the accumulated result of the fifth correction result and the sixth product term is corrected to obtain a sixth correction result; the sixth correction result corresponds to the result of the modular square operation of the intermediate domain.

13. The method according to claim 12, characterized in that The sixth correction result corresponds to the result of the modular square operation of the intermediate domain and is expressed as: C6≡A 2 ·2 -448 towards p; Wherein, C6 is the sixth correction result, A is the input multiplier of the modular square operation, p is a prime number, ≡ is the congruence sign, and both sides of the congruence sign are equivalent.

14. The method according to claim 8, characterized in that The step-by-step accumulation process of the accumulation of the plurality of product terms is performed in the order of position coefficients from small to large, where the order of position coefficients from small to large represents the order from low to high bits.

15. A data processing device, characterized in that: include: A module for acquiring data to be processed, configured to acquire data to be processed, wherein the data to be processed is processed using an elliptic curve cryptography algorithm, wherein the elliptic curve of the elliptic curve cryptography algorithm is defined in a prime number domain; an operation input determination module, configured to determine input data for a modular product operation of an elliptic curve cryptography algorithm, wherein the modular product operation modulo a product by a prime number in a prime number domain, wherein the input data includes a plurality of input multipliers for obtaining the product, and the input multipliers are represented in binary; a product term accumulation determination module, configured to determine a plurality of product term accumulations corresponding to the multiplication of the binary representations of the plurality of input multipliers; an accumulation correction module, configured to correct an accumulation result of each step of accumulation during a stepwise accumulation of a plurality of product terms using a correction factor in the intermediate domain and a prime number in the prime number domain, to obtain a plurality of correction results, wherein a last correction result of the plurality of correction results corresponds to a result of a modular product operation in the intermediate domain; wherein the correction factor in the intermediate domain is used to map the operation to the intermediate domain to eliminate a division operation; A mapping recovery module is used to map the last correction result back to the prime number domain to obtain the result of the modular product operation in the prime number domain; The data processing result determination module is used to determine the data processing result of the data to be processed according to the operation result of the modular product operation under the prime number field.

16. The device according to claim 15, characterized in that The accumulation correction module is used to use the correction factor of the intermediate field and the prime number of the prime number field to correct the accumulation result of each step of the accumulation in the step-by-step accumulation process of the multiple product terms to obtain multiple correction results including: In order from low to high, multiple product terms are gradually accumulated, and the accumulated result of each step is corrected by using correction factors and prime numbers, so that the next step of accumulation is to accumulate the next product term on the basis of the corrected result corresponding to the previous step of accumulation, until the accumulated result of the last step of accumulation is corrected to obtain multiple corrected results.

17. The device according to claim 16, characterized in that The accumulation correction module is used to gradually accumulate multiple product terms in order from low to high, and use the correction factor and prime number to correct the accumulation result of each step of accumulation, so that the next accumulation step is to accumulate the next product term on the basis of the correction result corresponding to the previous accumulation step, until the accumulation result of the last accumulation step is corrected, and the multiple correction results obtained include: During the accumulation in step i, the accumulated result of step i is corrected according to the following formula: 2 64 ·C i =(C i-1 +d i )+(μ·(C i-1 +d i )mod 2 64 )·p; Among them, C i is the i-th correction result corresponding to the i-th step accumulation, C i-1 is the i-1th correction result corresponding to the i-1th step, d i is the accumulation of the i-th product term, C i-1 +d i is the cumulative result of the i-th step, μ is the correction factor, and p is a prime number.

18. The device according to claim 17, characterized in that The prime number is 256 bits and is represented by p=2 256 -2 224 -2 96 +2 64 -1; The i-th correction result C i The calculation includes: Among them, z i =(C i-1 +d i )mod 2 64 , Indicates that the result is rounded down.

19. The device according to claim 18, characterized in that The i-th correction result C i The calculation specifically includes: When i>0, the i-th correction result C i The calculation is: (e4+e0-(e0>>32))·2 192 +(e3-(e0<<32))·2 128 +(e2-(e0>>32))·2 64 +(e1+e0-(e0<<32)), where, when i>0, e0, e1, e2, e3, and e4 represent the cumulative result C of the i-th step. i-1 +d i For each 64-bit component of , " represents a right shift operation, " represents a left shift operation; When i=0, the calculation of the zeroth correction result C0 is: (e0-(e0>32))·2 192 -(e0<<32)·2 128 -(e0>>32)·2 64 +(e1+e0-(e0<<32)), when i=0, e0, e1, e2, e3, e4 represent each 64-bit component of the zeroth product term accumulation, and the zeroth product term accumulation is the first product term accumulation among multiple product term accumulations.

20. A processor, characterized in that: The processor is designed based on an instruction set, and the instruction set has algorithm instructions of an elliptic curve cryptography algorithm. The algorithm instructions are used by the processor to implement the data processing method according to any one of claims 1 to 14.

21. A computer device, characterized in that: comprising a processor as claimed in claim 20.

22. A computer device, characterized in that: The method comprises a processor and a memory, wherein the memory stores computer program instructions, and the processor calls the computer program instructions stored in the memory to execute the data processing method according to any one of claims 1 to 14.

23. A storage medium, characterized in that The storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the data processing method according to any one of claims 1 to 14 is implemented.

24. A computer program product, characterized in that The computer program product comprises computer program instructions, which, when executed by a processor, implement the data processing method according to any one of claims 1 to 14.

Images