Chip, method and apparatus for modular multiplication

Abstract

The embodiment of the invention provides a method and equipment for modular multiplication. A modular multiplication unit for any modulo is typically composed of a binary multiplication unit and a subsequent modular reduction unit. Almost all the aims of improving modular multiplication are to reduce the complexity and size of the reduction step. According to the scheme provided by the invention, basic model characteristics are used, and carry bits are not explicitly processed. Reduction operation and splitting operation are repeatedly performed on the intermediate result, so that the hardware area can be reduced, and the power efficiency can be improved.

Description

Technical Field

[0001] Embodiments of the present application relate to the field of residual number systems (RNS), and more particularly, to a method and apparatus for modular multiplication. Background Art

[0002] In a residual number system (RNS), a modular multiplication unit for arbitrary modules usually consists of a binary multiplication unit followed by a modular reduction unit. Almost all improvements to modular multiplication aim to reduce the complexity and size of the reduction step.

[0003] The original way to calculate the modular reduction c = a mod m is to use the division algorithm: Another approach is the Barrett reduction algorithm, which aims to replace very expensive divisions with multiplications. This approach is cheaper than the original approach, but still requires two multiplications to get the result. Another approach is partition reduction, in which the result of the multiplication is split into a group of numbers under a special algorithm that replaces expensive multiplication operations with additions and small, cheap constant multipliers. Lei Li et al. proposed a method for special modulus m = 2 n -2 p ±1 partition reduction scheme. His idea is based on the basic model property |Am+B| m =|B| m To simplify the partition. Compared with any modular reduction design, Lei Li's design is better for the special modulus m=2 with small p. n -2 p ±1, reducing hardware area and improving power efficiency. However, this design has a significant limitation: it can only be implemented when p ≤ n / 2. The hardware area and power efficiency of modular multiplication remain major issues that need to be addressed. Summary of the Invention

[0004] The embodiments of the present application provide a method for modular multiplication, which can reduce hardware area and improve power efficiency.

[0005] According to a first aspect, there is provided a method for modular multiplication, comprising:

[0006] receiving two inputs, wherein the two inputs are remainders to be subjected to binary multiplication;

[0007] Obtaining a multiplication result by performing binary multiplication on the two inputs, wherein a bit width of the multiplication result is greater than n, where n is an integer;

[0008] By performing a reduction operation and a splitting operation based on the multiplication result, a set of compound expressions and a correction term (CT) are obtained, where the bit width of each compound expression in the set is equal to or less than n;

[0009] By concatenating the set of compound expressions with the CT, two partial sums with a bit width of n + w are obtained, where w is determined according to m, and m is the modulus of the modular multiplication;

[0010] By performing an arithmetic addition on the two partial sums with a bit width of n + w, an intermediate result is obtained, where the bit width of the intermediate result is greater than n;

[0011] By performing a reduction operation on the intermediate result, two parts are obtained, where the addition result of the two parts is less than 2m;

[0012] By comparing the addition result of the two parts with m, a reduction result is output.

[0013] The solution proposed in this application uses basic modular properties and does not explicitly handle carry bits. The reduction operation and the splitting operation are repeatedly performed on the intermediate result to reduce the complexity and size of the reduction steps in the prior art, and can reduce the hardware area and improve the power efficiency.

[0014] The solution proposed in this application extends the special modulus in the range (2, 256) to 1.5 times. After testing, compared with the existing solutions, the solution proposed in this application reduces the hardware area by 14% and reduces the power consumption by 20%.

[0015] In an embodiment of the first aspect, m = 2 n -2 p ±1, the bit widths of both inputs are n, n ≥ 3, and 2 ≤ p < n, where p is an integer; or,

[0016] m = 2 n +2 p ±1, the bit widths of both inputs are n + 1, n ≥ 4, and 3 ≤ p < n, where p is an integer.

[0017] In an embodiment of the first aspect, for m = 2 n -2 p ±1, the range of p is For m = 2 n +2 p ±1, the range of p is

[0018] The range of p proposed in this embodiment is more advantageous in terms of reducing the hardware area and improving the power efficiency.

[0019] In an embodiment of the first aspect, performing a reduction operation and a splitting operation based on the multiplication result to obtain a set of compound expressions and a CT includes:

[0020] Splitting the multiplication result into a low-order part and a high-order part;

[0021] Obtaining the set of the composite expression and the CT by performing t reduction operations and t-1 split operations based on the high-order part of the multiplication result, where t≥2 and t is an integer;

[0022] The first t-1 reduction operations correspond to the t-1 splitting operations one-to-one, each reduction operation in the first t-1 reduction operations generates a low-order part and a high-order part, the i-th splitting operation in the t-1 splitting operations is performed on the high-order part generated in the i-th reduction operation in the first t-1 reduction operations, the i-th splitting operation in the t-1 splitting operations generates a first part and a second part, the first part generated in the i-th splitting operation is used as an operand for the (i+1)-th reduction operation, the first part generated in the i-th splitting operation is a part obtained by excluding the low-order n-bit part of the high-order part generated in the i-th reduction operation from the high-order part generated in the i-th reduction operation, and the second part generated in the i-th splitting operation is the low-order n-bit part of the high-order part generated in the i-th reduction operation, wherein 1≤i≤t-1, and i is an integer.

[0023] wherein the operand of the first reduction operation in the first t-1 reduction operations is the high-order portion of the multiplication result;

[0024] The set of compound expressions is determined after the t-th reduction operation among the t reduction operations, wherein the set of compound expressions includes the low-order part of the multiplication result, one or more low-order parts generated in the first t-1 reduction operations, one or more second parts generated in the t-1 split operation, and the low-order part and high-order part generated in the t-th reduction operation among the t reduction operations.

[0025] In an embodiment of the first aspect, the bit width of the multiplication result is n+z, and the low-order portion of the multiplication result and the high-order portion of the multiplication result are determined as follows:

[0026] |P[n+z-1:0]| m =|P[n-1:0]+2n P[n+z-1:n]| m

[0027] Wherein, P[n+z-1:0] is the multiplication result, P[n-1:0] is the low-order part of the multiplication result, 2 n P[n+z-1:n] is the high-order part of the multiplication result, 2 n The bit width of P[n+z-1:n] is n+z, which is greater than n;

[0028] The low-order part and the high-order part are generated by performing the first reduction operation of the t-1 reduction operations on the high-order part of the multiplication result, as shown below:

[0029]

[0030] Among them, 2 n P[n+z-1:n] is the high-order portion of the multiplication result, P[n+z-1:n] is the low-order portion generated in the first reduction operation among the t-1 reduction operations, 2 p P[n+z-1:n] is the high-order portion generated in the first reduction operation among the t-1 reduction operations, 2 p The bit width of P[n+z-1:n] is p+z, and when p+z is greater than n, the first splitting operation in the t-1 splitting operations is performed on 2 p P[n+z-1:n] is carried out.

[0031] In one embodiment of the first aspect, for m=2 n -2 p ±1, the bit width of each of the two inputs is n, the bit width of the multiplication result is 2n, and the set of the composite formula is as follows:

[0032]

[0033] Among them, P0~P6 is the set of the composite formula, and the symbol # is used to connect bits.

[0034] In an embodiment of the first aspect, the intermediate result is as follows:

[0035]

[0036] Wherein, R is the intermediate result, It's P i The one's complement of .

[0037] In one embodiment of the first aspect, for m=2n +2 p ±1, the bit width of each of the two inputs is n+1, the bit width of the multiplication result is 2n+1, and the set of the composite formula is as follows:

[0038]

[0039] Among them, P0~P6 are the composite expressions in the set, and the symbol # is used to connect bits.

[0040] In an embodiment of the first aspect, the intermediate result is as follows:

[0041]

[0042] Wherein, R is the intermediate result, It's P i The one's complement of .

[0043] In an embodiment of the first aspect, w is determined according to m based on the following formula:

[0044]

[0045] In an embodiment of the first aspect, performing a reduction operation on the intermediate result to obtain two parts includes:

[0046] The two parts are obtained by performing the reduction operation on the intermediate result, as shown below:

[0047]

[0048] Here, R is the intermediate result, R1 and R2 are the two parts, and the symbol # is used to connect bits.

[0049] In an embodiment of the first aspect, outputting a reduction result by comparing the addition result of the two parts with m includes:

[0050]

[0051] Wherein, Y is the reduction result, and R1 and R2 are the two parts.

[0052] According to a second aspect, a chip (or chip system) is provided. The chip has the function of implementing the method of the first aspect and any embodiment of the first aspect. The function can be implemented by a hardware structure. Alternatively, the chip or chip system includes an interface and multiple circuits.

[0053] According to a third aspect, a chip (chip system) is provided. The chip includes a binary multiplier, one or more hardware units, multiple CSAs, an arithmetic adder, and a multiplexer. The chip has the function of implementing the method of the first aspect and any embodiment of the first aspect. This function can be implemented using the above-mentioned hardware structure.

[0054] According to a fourth aspect, a device is provided, which includes the chip or chip system described in the third aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] One or more embodiments are described exemplarily by corresponding drawings, and these exemplified drawings and drawings do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings are shown as similar elements, and the drawings are not limited to scale. In the drawings:

[0056] Figure 1 It is a regular scale multiplication structure.

[0057] Figure 2 It is a schematic diagram of the method for modular multiplication of the present application.

[0058] Figure 3 For m=2 n ±2 p ±1, advanced structure of modular multiplication.

[0059] Figure 4 For m=2 n -2 p ±1, example of compound generation.

[0060] Figure 5 For m=2 n +2 p ±1, example of compound generation.

[0061] Figure 6 It is a schematic block diagram of the chip or chip system provided in the embodiments of the present application.

[0062] Figure 7 It is a schematic block diagram of a chip or chip system provided in another embodiment of the present application. DETAILED DESCRIPTION

[0063] To better understand the features and technical content of the embodiments of the present invention, the implementation of the embodiments of the present invention will be described in detail below with reference to the accompanying drawings. The accompanying drawings are for reference and illustration only and are not intended to limit the embodiments of the present invention. In the following technical description, for ease of explanation, many details will be set forth to provide a thorough understanding of the disclosed embodiments. However, one or more embodiments may be implemented without these details. In other cases, known structures and devices may be simplified to simplify the drawings.

[0064] In order to better understand the technical solutions proposed in this application, relevant technologies and concepts are first introduced here.

[0065] The residual number system (RNS) is a set of k integers {m1, m2, ..., m k} is called a modular set. Any two integers in the modular set must be pairwise relatively prime, that is, GCD(m i , m j )=1,i,j∈[1,k],i≠j. Let M be all m i The product of: Then, in RNS, an integer x in the range [0, M-1] is represented by the remainder set x→{x1, x2, ..., x k} uniquely represents; that is, x i ≡x mod m i , for each i, 0≤x i <m i .

[0066] According to the Chinese remainder theorem (CRT), x can be reconstructed from RNS as:

[0067]

[0068] RNS has many advantages, such as being able to perform independent (parallel) addition, subtraction, and multiplication operations between corresponding remainders.

[0069]

[0070] One of the key features of RNS is that the addition and multiplication operations between corresponding remainder pairs are independent and can be performed in parallel, as there is no need to propagate carry bits between remainders. The area usage and power efficiency of modular multiplication depend heavily on the magnitude of the highest modulus in the set of moduli and the efficiency of each modular multiplication operation. A modular multiplication unit for arbitrary moduli is typically constructed using a conventional multiplication block followed by a modular reduction unit. Figure 1 shows the conventional multiplication structure. Figure 1 As shown, two n-bit wide remainders are multiplied with the regular binary multiplication block, and the bit width of the multiplication result is 2n. The multiplication result is processed in the reduction block and the subsequent binary multiplication block, and the reduction result |A·B|m is output, as shown in Figure 1 Almost all improvements to modular multiplication aim to reduce the complexity and size of the reduction step.

[0071] This application proposes a special modulus m=2 n-2 p ±1 (where n≥3, 2≤p<n) and m = 2 n +2 p A method of modular multiplication with ±1 (where n≥4, 3≤p<n), n and p are integers. The range of p that can achieve better technical effects is for m = 2 n -2 p ±1, For m = 2 n +2 p ±1, It can be seen that for m = 2 n -2 p ±1 and m = 2 n +2 p ±1, the lower limit of p is slightly different. The proposed method for modular multiplication in this application can reduce the hardware area and improve the power efficiency.

[0072] The proposed solution in this application utilizes the basic characteristics of modulus m = 2 n ±2 p ±1, without dealing with carry bits, which is contrary to other solutions. The proposed solution covers modulus m = 2 n ±2 p ±1, and is not restricted by the range of p. Specifically, p is less than n, p can be up to n - 1, and in the case, better technical effects can be achieved, as described above.

[0073] By switching all multiplication and accumulation operations to RNS, this application can be used in matrix multiplication hardware accelerators. Since matrix multiplication devices require the use of n 3 modular multipliers, a single improvement to a modular multiplier can reduce the hardware area and improve the power efficiency of the entire device.

[0074] The proposed solution in this application will be described in more detail below.

[0075] Figure 2 is a schematic diagram of the method (200) for modular multiplication in this application. The method (200) specifically includes the following steps:

[0076] Step 210: Receive two inputs, where the two inputs are two remainders that need to perform binary multiplication.

[0077] For example, the two inputs are A and B as Figure 1 shown. As described above, the modulus proposed in this application covers m = 2 n ±2 p ±1. For m = 2 n -2 p ±1, the bit width of the two inputs is n, for m = 2n +2 p ±1, the bit width is n+1.

[0078] Step 220: Obtain a multiplication result by performing binary multiplication on the two inputs, wherein the bit width of the multiplication result is greater than n.

[0079] When the bit width of the two inputs is n, the bit width of the multiplication result is 2n. When the bit width of the two inputs is n+1, the bit width of the multiplication result is 2n+2. It should be noted that for the generic A·B, where A<m, B<m, the bit width of the multiplication result is 2n+2. However, if p is used in this application Therefore, in this application, the wording "the bit width of the modular multiplication result is 2n+1" is used when m=2 n +2 p Used when ±1.

[0080] Step 230 : Obtain a set of compound expressions and a correction term (CT) by performing a reduction operation and a splitting operation based on the multiplication result, wherein the bit width of each compound expression in the set is equal to or less than n.

[0081] Specifically, the multiplication result is represented by a low-order portion and a high-order portion. If the bit width of the high-order portion of the multiplication result is greater than n, a reduction operation can be performed on the high-order portion of the multiplication result. The reduction operation performed on the high-order portion of the multiplication result is a first reduction operation, generating a low-order portion and a high-order portion. The bit width of the high-order portion generated in the first reduction operation is determined. If the bit width of the high-order portion generated in the first reduction operation is greater than n, a first splitting operation is performed on the high-order portion generated in the first reduction operation. The first splitting operation generates a first part and a second part, where the second part is the low-order n bits of the high-order portion generated in the first reduction operation, and the first part is the portion obtained by excluding the low-order n bits of the high-order portion generated in the first reduction operation from the high-order portion generated in the first reduction operation. A second reduction operation is performed on the first part generated in the first splitting operation, generating a low-order portion and a high-order portion. If the bit width of the high-order portion generated in the second reduction operation is greater than n, a second splitting operation is performed on the high-order portion generated in the second reduction operation. The second split operation generates a first part and a second part, wherein the first part generated in the second split operation is a part obtained by excluding the lower n-bit part of the high-order part generated in the second split operation from the high-order part generated in the second split operation, and the second part generated in the second split operation is the lower n-bit part of the high-order part generated in the second reduction.

[0082] Assuming t-1 split operations are performed, this can be understood as correspondingly performing t-1 reduce operations. Each split operation in t-1 split operations is performed after the corresponding reduce operation, and each split operation in t-1 split operations is performed when the bit width of the high-order part generated in the corresponding reduce operation is greater than n. The i-th split operation in t-1 split operations generates the first and second parts. The first part generated in the i-th split operation serves as the operand for the (i+1)-th reduce operation. The high-order part generated in the (i+1)-th reduce operation serves as the operand for the (i+1)-th split operation, where 1 ≤ i+1 ≤ t-1, and i is an integer, and so on. The t-th split operation does not exist until the bit width of the high-order part generated in the t-th reduce operation is equal to or less than n. The set of composite expressions is determined after the t-th reduce operation. That is, there is a one-to-one correspondence between the first t-1 reduce operations and the t-1 split operation. The set of composite expressions includes the low-order part of the multiplication result, one or more low-order parts generated in the first t-1 reduction operations, one or more second parts generated in the t-1 split operations, and the low-order part and high-order part generated in the t-th reduction operation.

[0083] In summary, the set of composite expressions is determined based on the high-order part of the multiplication result by performing t reduction operations and t-1 split operations, where t≥2 and t is an integer.

[0084] Alternatively, the reduction operation may also be called a shift operation, which is not limited in this application.

[0085] The determination of CT will be described below.

[0086] Step 240: Obtain two n+w bit wide partial sums by concatenating the composite set and CT, where w is determined based on m, and m is the modulus of the modular multiplication.

[0087] Specifically, w is determined from m based on the following formula:

[0088]

[0089] Step 250: Obtain an intermediate result by performing arithmetic addition on two partial sums of n+w bit widths, wherein the bit width of the intermediate result is greater than n.

[0090] Step 260: Perform a reduction operation on the intermediate result to obtain two parts, wherein the bit width of the addition result of the two parts is less than 2m.

[0091] If the bit width of the intermediate result exceeds n bits, a reduction operation is performed on the intermediate result. The intermediate result is represented by two parts, which are determined by performing the reduction operation on the intermediate result. It should be noted that the reduction operation in step 260 is similar to the reduction operation in step 230, except for the operands of the reduction operation. The reduction operation mentioned in step 230 is performed on the high-order portion of the multiplication result and the high-order portion generated in the split operation, and the reduction operation mentioned in step 260 is performed on the intermediate result.

[0092] Step 270: Output the reduction result by comparing the addition result of the two parts with m.

[0093] The solution proposed in this application uses a special module (m=2 n ±2 p ±1) and does not handle carry bits. Reduction and splitting operations are repeated on intermediate results to reduce the complexity and size of the reduction steps. This reduces hardware area and improves power efficiency.

[0094] Figure 3 This is the high-level structure of modular multiplication provided by this application. Figure 3 As shown, first, the two remainders (ie, A and B) are multiplied with a binary multiplication block (eg, a binary multiplier), and the binary multiplication block outputs the multiplication result, ie Figure 3 The multiplication result is split into a set of complex formulas and CT by reduction and split operations, wherein the set of complex formulas is represented by P1 to P6. In addition, Figure 3 Use m=2 n -2 p ±1 as an example, P2 is connected to P3, P5 is connected to P6, and they are respectively represented by P 23 and P 56 . In the first level of addition, the set of compound expressions and CT are added to obtain an intermediate result, namely R. In the second level of addition, the intermediate result R is split into two parts, such as R1 and R2, through a reduction operation, where R1+R2<2m. In the last level, the addition results of the two parts are compared with m to obtain the reduction result, namely Y. It should be noted that the CSA tree provides two parts, namely the sum bit and the carry bit. The bit width of the carry bit is n+w, and the bit width of the sum bit is n+w-1, but it is implicitly expanded to a bit width of n+w with leading zeros. Due to the number of compound expressions in the set, the bit width of the addition result of the sum bit and the carry bit is also n+w.

[0095] Two inputs (e.g. Figure 3 The multiplication result of A and B in the above equation can be represented by the low-order part and the high-order part. n -2 pTaking ±1 as an example, the bit widths of A and B in this case are both n, and the bit width of the multiplication result of the two inputs is 2n. P can be represented by the low-order part and the high-order part as follows:

[0096] |A[n-1:0]×B[n-1:0]| m =|P[2n-1:0]| m =|P[n-1:0]+2 n P[2n-1:n]| m

[0097] Among them, P[n-1:0] is the low-order part of P, 2 n P[2n-1:n] is the high-order part of P.

[0098] The basic model properties mentioned in this application are as follows:

[0099] [Am+B| m =|B| m

[0100] According to the model characteristics, if the following When adding or subtracting, the high-order part of the multiplication result is reduced:

[0101]

[0102] For m=2 n +2 p ±1, the multiplication result P can also be expressed by the low-order part and the high-order part, the high-order part is expressed by m=2 n -2 p The reduction of ±1 is performed in a similar way.

[0103] In this application, the above reduction process is referred to as a reduction operation. It can be seen that the multiplication result is split into the high-order part 2 by the reduction operation. p p[2n-1:n] and the lower part P[2n-1:n].

[0104] High part 2 p The bit width of P[2n-1:n] is n+p, which exceeds n, so the high-order part can be split into the first part and the second part by performing the splitting operation of the present application.

[0105] Therefore, based on the special modulus proposed in this application, the binary multiplication result can be split into a composite set and a constant correction term (CT). As long as the bit width of the current number is greater than n, taking the bit width of the current number as n+z as an example, the current number can be represented as a low-order part and a high-order part as follows:

[0106] |P[n+z-1:0]|m =|P[n-1:0]+2 n P[n+z-1:n]| m (1)

[0107] Through Addition and subtraction are performed to reduce the high-order part. Due to the model property |Am+B| m =|B| m , the first compound disappears:

[0108]

[0109] If P0=P[n-1:0], P1=P[n+z-1:n], P2=2 p P[n+z-1:n], then formula (1) can be described as:

[0110]

[0111] Formulas (1) to (3) have no restrictions on n or p. If the bit width of any of the new compound expressions P1 and P2 in formula (3) is greater than n, each new compound expression can be split into a first part and a second part by performing a split operation, wherein the first part of the new compound expression is the part obtained by excluding the low-order n-bit part of the new compound expression from the new compound expression, and the second part of the new compound expression is the low-order n-bit part of the new compound expression. Next, if the bit width of the first part of the new compound expression is greater than n, a reduction operation can be performed on the first part of the new compound expression, and so on. The reduction operation and split operation are repeated until all parts are equal to or less than n bits.

[0112] For m=2 n -2 p ±1, the bit widths of A and B are both n, and the bit width of the multiplication result P is 2n. Through the reduction operation and splitting operation proposed in this application, P is split into a set of compound expressions and correction terms. The compound expressions in the set can be expressed as:

[0113]

[0114] Obviously, for P with a bit width of 2n, the first split operation is required because the bit width of P2 is n+p, and new composites P3 and P4 are created. If P4 has an extra k bits, a second split operation is required to create P5, P6, and so on.

[0115] It should be understood that if k=0, then according to formulas (4) and (5), P5 and P6 do not exist.

[0116] Since the bit width of P3 is equal to p and the bit width of P6 is smaller than p, they can be connected with P2 and P5 respectively to reduce the number of final composites. Perform three reduction operations and two split operations until the bit width of each compound expression is equal to or less than n, generating 5 compound expressions.

[0117]

[0118] In formula (6), for m=2 n -2 p Some parts such as +1, -P1, -P3 or -P6 have negative signs. In order to avoid subtraction, the parts with negative signs can be converted to positive signs. n -2 p +1, you can use conversion: in, It's P i The one's complement of . i , all 0s should be replaced by 1s, which will affect the combination of the compound formulas in this application set. But it is more useful to just invert P i The valid bit and CT i Add an extra (2p-1) instead of right 0, add (2 n -2 p+k ) instead of Left 1. For example:

[0119]

[0120] CT is CT i The sum of: CT is a constant value that depends only on m.

[0121] Formula (6) is modified into formula (7) as follows:

[0122]

[0123] Among them, R is the intermediate result.

[0124]

[0125] The multi-input adder compresses the five / six compound sums CT to produce two n+w-bit-wide partial sums. The two-input adder then performs arithmetic addition on the two partial sums and outputs the intermediate result R, where w is determined as follows:

[0126]

[0127] The intermediate results can be divided into two parts, as follows:

[0128]

[0129] A simple modular addition using two adders and a multiplexer yields the final result, the reduced result Y.

[0130]

[0131] For m=2 n -2 p -1 and All compound connections in equation (7) will be positive and combine to meet the restriction of n-bit width of each part of the multiplication result:

[0132]

[0133] The reduction result is calculated by subtraction and comparison operations according to formula (11), which will not be described in detail here.

[0134] For m=2 n -2 p +1 and

[0135]

[0136] CT includes CT from all reduction split operations i , and will be:

[0137]

[0138] The same reduction and splitting operations can be applied to m=2 n +2 p ±1, no difference. The multiplication result can be split into a set of compound forms and CT, the compound forms are P0 to P6, as follows:

[0139]

[0140] For m=2 n +2 p ±1, the bit widths of the remainders A and B are both n+1, while the bit width of the modular multiplication result is 2n+2, so the multiplication result is not represented by two parts of equal bit width.

[0141] For m=2 n +2 p ±1, the reduction or splitting operation becomes more complex due to the combination of additional parts. Since the gap and part width do not match, parts P2 and P3 cannot be connected. However, P5 and P6 can be connected to a joint. Since the additional width of the adder is w ≥ 2 bits, there is no need to split P1. The intermediate result calculation formula contains 7 compound formulas, as follows:

[0142]

[0143] In order to avoid subtraction, formula (15) is transformed into formula (16) as follows:

[0144]

[0145] At m=2 n +2 p In the case of ±1, the main problem is to identify the correction term. For the shifted part, it is necessary to fill all the empty bits in the original value with 1 in CT. To do this, we can add 1 to CT. i Add(2 p -1) instead of right 0, add (2 n -2 p+x ) instead of the left 1. Since the one's complement variable is used, an additional 2 p ±1+1 to perform modular inversion operation. CT i This can be done by explicitly specifying m=2 n +2 p ±1 is reduced to simplify.

[0146] For m=2 n +2 p -1, CT passes the following CT i Sure:

[0147] CT2=(2 p -1)+(2 p -1)+1=2 p+1 -1

[0148]

[0149] CT=|CT2+CT3+CT 56 +CT R | m .

[0150] For m=2 n +2 p +1, because R1 < 4m, the conventional n-bit one's complement is incorrect. In fact, CT can be divided into four parts, each of which requires an additional 2 p +1 correction item:

[0151] CT1=2 p+2 +5

[0152] CT2=2 p+1 +1

[0153]

[0154] CT=|CT1+CT2+CT 56 +CT R | m .

[0155] In order to better understand this application, the following are respectively for m=2 n -2 p ±1 and m=2 n +2 p ±1 gives two detailed examples.

[0156] Figure 4 For m=2 n -2 p ±1, an example of compound generation. In this example, the bit widths of the two remainders A and B are n, and the bit width of the multiplication result P is 2n, where n = 7, p = 4, and 2n = 14. The multiplication result is represented by P, where P = [dcba9876543210] = P[b 13 :b0]. The bit width of P is 2n, which is larger than the bit width n. P can be represented by the low-order part and the high-order part. P[b 13 :b0]=P[b6:b0]+2 7 P[b 13 :b7]. That is, P[b 13 :b0] is P[b6:b0], that is, P0, P[b 13 :b0] The high-order part is 2 7 P[b 13 :b7]. The bit width of P0 is 7, 2 7 P[b 13 :b7] has a bit width of 14.2 7 P[b 13 :b7] is wider than 7 bits, and is reduced by performing the first reduction operation to obtain the high-order part and the low-order part, which are 2 4 P[b 13 :b7] and P[b 13 :b7], where P[b 13 :b7]=P1. Through the first split operation, 2 4 P[b 13 :b7] can be split into the first and second parts, 2 4 P[b 13 :b7] The first part is 2 7 P[b 13 :b 10 ], 2 4 P[b 13 :b7] is P[b9:b7], that is, P2,2 4 P[b13 :b7] the first part (ie 2 7 P[b 13 :b 10 ]) has a bit width of 11, which can be reduced by performing the second reduction operation to obtain the low-order part and the high-order part, which are P[b 13 :b 10 ] and 2 4 P[b 13 :b 10 ], where P[b 13 :b 10 ]=P3.2 4 P[b 13 :b 10 ] has a bit width of 8, which is wider than 7 bits. It can be split into the first part and the second part by performing the second split operation, where 2 4 P[b 13 :b 10 The first part of ] is 2 7 P[b 13 ], 2 4 P[b 13 :b 10 The second part of ] is P[b 12 :b 10 ], namely P4.2 4 P[b 13 :b 10 ] the first part (i.e. 2 7 P[b 13 ]) has a bit width of 8, which can be reduced by performing the third reduction operation and obtaining the low-order part and the high-order part, respectively, P[b 13 ] and 2 4 P[b 13 ], where P[b 13 ]=P6,2 4 P[b 13 ]=P5. High part 2 4 P[b 13 ] is 5, which is smaller than the bit width n (n=7). The set of compound expressions can be determined after the third reduction operation. In other words, the third reduction operation generates the high-order part 2 4 P[b 13 ](ie P5) and the lower part P[b 13], i.e., P6. Since the bit width of the high-order part generated in the third reduction operation is less than n, there is no third split operation. It can be seen that the set of composite expressions includes the low-order part of the multiplication result, i.e., P0, the low-order parts generated in the first and second reduction operations, i.e., P1 and P3, the second parts generated in the first and second split operations, i.e., P2 and P4, and the high-order part generated in the third reduction operation and the low-order part generated in the third reduction operation, i.e., P5 and P6. In addition, all empty cells are filled with 0. Obviously, in the case of k=0, only P0~P4 are created, because there is no explicit (bugled) bit after the second reduction operation, so P5 and P6 will not exist.

[0157] Figure 5 For m=2 n +2 p ±1, an example of compound generation. In this example, the bit widths of the two remainders A and B are n+1, and the bit width of the multiplication result P is 2n+1, where n=7 and n=4. P=[fedcba9876543210]=P[b 15 :b0]. P can be represented by the low-order part and the high-order part. 15 :b0]=P[b6:b0]+2 7 P[b 15 :b7]. P[b 15 :b0] is P[b6:b0]=P0, P[b 15 :b0] The high-order part is 2 7 P[b 15 :b7]. The bit width of P0 is 7, 2 7 P[b 15 :b7] has a bit width of 16.2 7 P[b 15 :b7] is wider than 7 bits, and is reduced by performing the first reduction operation to obtain the high-order part and the low-order part, which are 2 4 P[b 15 :b7] and P[b 15 :b7], where P[b 15 :b7]=P1.2 4 P[b 15 :b7] can be split into the first part and the second part by performing the first split operation, 2 4 P[b 15 :b7] The first part is 2 7 P[b 15 :b 10 ], 2 4 P[b 15 :b7] is P[b9:b7]=P2.24 P[b 15 :b7] the first part (ie 2 7 P[b 15 :b 10 ]) has a bit width of 13. The first part can be reduced by performing a second reduction operation, and the low-order part and the high-order part are obtained, which are P[b 15 :b 10 ] and 2 4 P[b 15 :b 10 ], where P[b 15 :b 10 ]=P3.2 4 P[b 15 :b 10 ] has a bit width of 10, which is wider than 7 bits. It can be split into the first part and the second part by performing the second split operation, where 2 4 P[b 15 :b 10 The first part of ] is 2 7 P[b 15 :b 13 ], 2 4 P[b 15 :b 10 The second part of ] is P[b 12 :b 10 ], namely P4.2 4 P[b 15 :b 10 ] the first part (i.e. 2 7 P[b 15 :b 13 ]) has a bit width of 10, and the first part can be reduced by performing a third reduction operation, and obtaining the low-order part and the high-order part, respectively, P[b 15 :b 13 ] and 2 4 P[b 15 :b 13 ], where P[b 15 :b 13 ] = P6 and 2 4 P[b 15 :b 13 ]=P5. High part 2 4 P[b 15 :b 13] has a bit width of 7. After the third reduction operation, the set of composite expressions is determined. Since the bit width of the high-order portion generated in the third reduction operation is equal to n, there is no third split operation. Similarly, the set of composite expressions includes the low-order portion of the multiplication result, namely P0, the low-order portions generated in the first and second reduction operations, namely P1 and P3, the second portions generated in the first and second split operations, namely P2 and P4, and the high-order portion generated in the third reduction operation and the low-order portion generated in the third reduction operation, namely P5 and P6. All empty cells are filled with 0.

[0158] As mentioned above, the reduction operation can also be called a shift operation. Alternatively, the operation of expressing the multiplication result as a high-order part and a low-order part can also be regarded as a split operation. The operation of expressing the multiplication result as a low-order part and a high-order part is the first split operation. The first reduction operation is the first shift operation. Figure 4 or Figure 5 The first split operation marked in becomes the second split operation. The second reduction operation is the second split operation, Figure 4 or Figure 5 The second split operation marked in becomes the third split operation. The third reduction operation is the third shift operation. Thus, Figure 4 The shift splitting process shown includes 3 splitting operations and 3 shifting operations. Figure 5 The shift splitting process shown also includes 3 splitting operations and 3 shifting operations, which can be understood by those skilled in the art and will not be described in detail here.

[0159] Figure 6 It is a schematic block diagram of the chip or chip system 10 of the present application.

[0160] like Figure 6 As shown, the chip (or chip system) may include an interface 11 and multiple circuits 12. Alternatively, the interface 11 is configured to receive two inputs and send the two inputs to the multiple circuits 12. The multiple circuits 12 execute the method 200 to output a reduction result based on the two inputs.

[0161] Alternatively, the interface 11 includes an input interface and an output interface, wherein the input interface is used to receive two inputs, and the output interface is used to output reduction results from the plurality of circuits 12. As an embodiment, the interface 11 is an interface circuit.

[0162] As an embodiment, the functions of the chip are implemented by hardware, such as multiple circuits 12, and the hardware includes one or more corresponding structures, such as a binary multiplier, one or more hardware units, an arithmetic adder, a CSA, a multiplexer, etc.

[0163] Figure 7FIG is a schematic block diagram of a chip (or chip system) 20 provided in another embodiment of the present application. Figure 7 As shown, the chip 20 includes:

[0164] A binary multiplier (21) for:

[0165] Receive two inputs and obtain a multiplication result by performing binary multiplication on the two inputs, wherein the bit width of the multiplication result is greater than n, where n is an integer;

[0166] A first hardware unit (22) for reduction and splitting operations, configured to:

[0167] Obtaining a set of compound expressions and a correction term (CT) by performing a reduction operation and a splitting operation based on the multiplication result, wherein a bit width of each compound expression in the set is equal to or less than n;

[0168] Multiple carry-save adders (CSA) (23) for:

[0169] Receive composite and CT in the collection;

[0170] By connecting the composite formula in the set with CT, two n+w-bit wide partial sums are output, where w is determined based on m, and m is the modulus of the modular multiplication;

[0171] Arithmetic adder (24) for:

[0172] receiving the two n+w bit-width partial sums and outputting an intermediate result by performing arithmetic addition on the two n+w bit-width partial sums, wherein the bit width of the intermediate result is greater than n;

[0173] A second hardware unit (25) for reduction operation, configured to:

[0174] Performing a reduction operation on the intermediate result to obtain two parts, wherein a sum of the two parts is less than 2m;

[0175] A multiplexer (26) for:

[0176] By comparing the addition result of the two parts with m, the reduction result is output.

[0177] Alternatively, the first hardware unit (22) and the second hardware unit (25) are the same hardware unit or different hardware units.

[0178] For descriptions of corresponding operations in the device embodiment, reference can be made to the relevant contents of each step in the above method embodiment.

[0179] Through the above description of the implementation, those skilled in the art will clearly understand that for the sake of convenience and brevity, the division into the above-mentioned functional modules is used as an example for explanation. In actual applications, the above-mentioned functions can be assigned to different modules as needed, that is, the internal structure of the device can be divided into different functional modules to achieve all or part of the functions described above. The specific working process of the above-mentioned devices and units can refer to the corresponding process in the above-mentioned method embodiment, and will not be repeated here.

[0180] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, unit division is merely a logical function division, and other division methods can be used in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not performed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be implemented through some interfaces. The indirect coupling or communication connection between devices or units can be implemented through electronic, mechanical or other forms.

[0181] The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected based on actual needs to achieve the purpose of the solution of this embodiment. In addition, the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0182] The above descriptions are merely some specific implementations of the present application and are not intended to limit the scope of protection of the present application. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A chip or chip system, characterized in that: include: Binary multiplier for: Receive two inputs and obtain a multiplication result by performing binary multiplication on the two inputs, wherein the bit width of the multiplication result is greater than n, where n is an integer; A first hardware unit for reduction and splitting operations, configured to: Obtaining a set of compound expressions and a correction term (CT) by performing a reduction operation and a splitting operation based on the multiplication result, wherein a bit width of each compound expression in the set is equal to or less than n; Multiple carry-save adders (CSA) for: receiving the set of the composite formula and the CT; Outputting two n+w bit wide partial sums by connecting the set of the composite formula and the CT, where w is determined based on m, and m is the modulus of modular multiplication; Arithmetic adder for: receiving the two n+w bit-width partial sums and outputting an intermediate result by performing arithmetic addition on the two n+w bit-width partial sums, wherein the bit width of the intermediate result is greater than n; A second hardware unit for reduction operation, configured to: Performing a reduction operation on the intermediate result to obtain two parts, wherein a sum of the two parts is less than 2m; Multiplexers for: According to the addition result of the two parts and m, the reduction result is output.

2. The chip or chip system according to claim 1, characterized in that m = 2 n –2 p ±1, and the bit widths of the two inputs are both n, where n ≥ 3, and 2 ≤ p < n, and p is an integer; or, m = 2 n + 2 p ±1, the bit widths of the two inputs are both n + 1, where n ≥ 4, and 3 ≤ p < n, and p is an integer.

3. The chip or chip system according to claim 2, characterized in that: For m=2 n –2 p ±1, the range of p is For m=2 n +2 p ±1, the range of p is 4. The chip or chip system according to any one of claims 1 to 3, characterized in that: The first hardware unit is used for: Splitting the multiplication result into a low-order part and a high-order part; Obtaining the set of the composite expression and the CT by performing t reduction operations and t-1 split operations based on the high-order part of the multiplication result, where t≥2 and t is an integer; wherein the first t-1 reduction operations correspond to the t-1 splitting operations one-to-one, each reduction operation in the first t-1 reduction operations generates a low-order part and a high-order part, the i-th splitting operation in the t-1 splitting operations is performed on the high-order part generated in the i-th reduction operation in the first t-1 reduction operations, the i-th splitting operation in the t-1 splitting operations generates a first part and a second part, the first part generated in the i-th splitting operation is used as an operand for the (i+1)-th reduction operation, the first part generated in the i-th splitting operation is a part obtained by excluding the low-order n-bit part of the high-order part generated in the i-th reduction operation from the high-order part generated in the i-th reduction operation, and the second part generated in the i-th splitting operation is the low-order n-bit part of the high-order part generated in the i-th reduction operation, wherein 1≤i≤t-1, and i is an integer, wherein the operand of the first reduction operation in the first t-1 reduction operations is the high-order portion of the multiplication result; The set of compound expressions is determined after the t-th reduction operation among the t reduction operations, wherein the set of compound expressions includes the low-order part of the multiplication result, one or more low-order parts generated in the first t-1 reduction operations, one or more second parts generated in the t-1 split operations, and the low-order part and high-order part generated in the t-th reduction operation among the t reduction operations.

5. The chip or chip system according to claim 4, characterized in that: The bit width of the multiplication result is n+z, and the low-order portion of the multiplication result and the high-order portion of the multiplication result are determined as follows: |P[n+z–1:0]| m =|P[n–1:0]+2 n P[n+z–1:n]| m Wherein, P[n+z–1:0] is the multiplication result, P[n–1:0] is the low-order part of the multiplication result, 2 n P[n+z–1:n] is the high-order portion of the multiplication result, 2 n The bit width of P[n+z–1:n] is n+z, which is greater than n. The low-order part and the high-order part are generated by performing the first reduction operation of the t-1 reduction operations on the high-order part of the multiplication result, as shown below: Among them, 2 n P[n+z–1:n] is the high-order portion of the multiplication result, P[n+z–1:n] is the low-order portion generated in the first reduction operation among the t–1 reduction operations, 2 p P[n+z–1:n] is the high-order portion generated in the first reduction operation among the t–1 reduction operations, 2 p The bit width of P[n+z-1:n] is p+z, and when p+z is greater than n, the first splitting operation in the t-1 splitting operations is performed on 2 p P[n+z–1:n] is carried out.

6. The chip or chip system according to claim 5, characterized in that: For m=2 n –2 p ±1, the bit width of each of the two inputs is n, the bit width of the multiplication result is 2n, and the set of the composite formula is as follows: Among them, P0~P6 is the set of the composite formula, and the symbol # is used to connect bits.

7. The chip or chip system according to claim 6, characterized in that: The intermediate results are as follows: Wherein, R is the intermediate result, It's P i The one's complement of .

8. The chip or chip system according to claim 5, characterized in that: For m=2 n +2 p ±1, the bit width of each of the two inputs is n+1, the bit width of the multiplication result is 2n+1, and the set of the composite formula is as follows: Among them, P0~P6 are the composite expressions in the set, and the symbol # is used to connect bits.

9. The chip or chip system according to claim 8, characterized in that: The intermediate results are as follows: Wherein, R is the intermediate result, It's P i The one's complement of .

10. The chip or chip system according to any one of claims 1 to 9, characterized in that: w is determined from m based on the following formula:

11. The chip or chip system according to any one of claims 1 to 10, characterized in that: The second hardware unit is used for: The two parts are obtained by performing the reduction operation on the intermediate result, as shown below: Here, R is the intermediate result, R1 and R2 are the two parts, and the symbol # is used to connect bits.

12. The chip or chip system according to claim 11, characterized in that: The multiplexer is used to: By comparing the addition result of the two parts with m, the reduction result is output as follows: Wherein, Y is the reduction result.

13. A chip or a chip system, characterized in that: include: Input interface for: receiving two inputs, wherein the two inputs are remainders to be subjected to binary multiplication; Multiple circuits for: Obtaining a multiplication result by performing the binary multiplication on the two inputs, wherein a bit width of the multiplication result is greater than n, where n is an integer; Obtaining a set of compound expressions and a correction term (CT) by performing a reduction operation and a splitting operation based on the multiplication result, wherein a bit width of each compound expression in the set is equal to or less than n; Obtain two n+w bit-wide partial sums by concatenating all composite expressions in the set with the CT, where w is determined based on m, and m is the modulus of the modular multiplication; Obtaining an intermediate result by performing binary addition on the two n+w bit-width partial sums, wherein the bit width of the intermediate result is greater than n; Performing a reduction operation on the intermediate result to obtain two parts, wherein a sum of the two parts is less than 2m; Output interface for: By comparing the addition result of the two parts with m, a reduction result is output.

14. A method for modular multiplication, characterized in that include: receiving two inputs, wherein the two inputs are remainders to be subjected to binary multiplication; Obtaining a multiplication result by performing the binary multiplication on the two inputs, wherein a bit width of the multiplication result is greater than n, where n is an integer; By performing reduction operations and splitting operations based on the multiplication result, a set of compound expressions and a correction term (CT) are obtained, where the bit width of each compound expression in the set is equal to or less than n; By concatenating all the compound expressions in the set with the CT, two partial sums with a bit width of n + w are obtained, where w is determined according to m, and m is the modulus of the modular multiplication; By performing arithmetic addition on the two partial sums with a bit width of n + w, an intermediate result is obtained, where the bit width of the intermediate result is greater than n; By performing reduction operations on the intermediate result, two parts are obtained, where the bit width of the addition result of the two parts is less than 2m; By comparing the addition result of the two parts with m, a reduction result is output.

15. The method according to claim 14, characterized in that m=2 n –2 p ±1, the bit width of the two inputs is n, where n ≥ 3, and 2 ≤ p < n, where p is an integer; or, m = 2 n + 2 p ±1, and the bit widths of the two inputs are both n + 1, where n ≥ 4, and 3 ≤ p < n, and p is an integer.

16. The method according to claim 15, characterized in that For m=2 n –2 p ±1, the range of p is For m=2 n +2 p ±1, the range of p is 17. The method according to any one of claims 14 to 16, characterized in that For m=2 n –2 p ±1, the bit width of each of the two inputs is n, the bit width of the multiplication result is 2n, and the set of the composite formula is as follows: where P0 to P6 are the compound expressions in the set, and the symbol # is used to connect bits.

18. The method according to claim 17, characterized in that The intermediate result is as follows: Wherein, R is the intermediate result, It's P i The one's complement of .

19. The method according to any one of claims 14 to 16, characterized in that For m=2 n +2 p ±1, the bit width of each of the two inputs is n+1, the bit width of the multiplication result is 2n+1, and the set of the composite formula is as follows: where P0 to P6 are the compound expressions in the set, and the symbol # is used to connect bits.

20. The method according to claim 19, characterized in that The intermediate result is as follows: Wherein, R is the intermediate result, It's P i The one's complement of .

21. The method according to any one of claims 14 to 20, characterized in that w is determined from m based on the following formula:

22. The method according to any one of claims 14 to 21, characterized in that The obtaining of the two parts by performing reduction operations on the intermediate result includes: The obtaining of the two parts by performing the reduction operations on the intermediate result is as follows: where R is the intermediate result, R1 and R2 are the two parts, and the symbol # is used to connect bits.

23. The method according to claim 22, characterized in that The outputting of the reduction result by comparing the addition result of the two parts with m includes: where Y is the reduction result.

24. A device for modular multiplication, characterized in that Comprising a chip or a chip system according to any one of claims 1 to 12 or 13.

Images