Curve25519-based lightweight elliptic curve point multiplication circuit

Abstract

The invention relates to a Curve25519-based lightweight elliptic curve point multiplication circuit, and relates to the technical field of digital integrated circuit design. The circuit comprises a coding unit, an instruction storage unit, a value decoding unit and a logical operation unit, according to the invention, the complex operation in the elliptic curve point multiplication operation is simplified into simpler arithmetic operation, so that the calculation complexity is reduced. The control instruction generated by the coding unit can accurately guide the whole point multiplication calculation process, so that unnecessary calculation steps are avoided, and the calculation speed is improved. By introducing a random scalar mask and a random coordinate mask, the safety of elliptic curve encryption is improved. The modular design among the units enables the circuit to be easy to expand and upgrade, and new functions can be added or existing functions can be optimized according to actual requirements. By optimizing a control flow and arithmetic operation, the consumption of hardware resources is reduced, so that the circuit can also realize efficient elliptic curve point multiplication operation on lightweight equipment.

Description

Technical Field

[0001] The present invention relates to the technical field of digital integrated circuit design, and in particular to a lightweight elliptic curve point multiplication circuit based on Curve25519. Background Art

[0002] With the rapid development of the Internet of Things (IoT), massive amounts of data are being transmitted end-to-end. Ensuring the security of this data is crucial. Elliptic curve cryptography, a public-key cryptography algorithm, has become a key area of development in public-key cryptography due to its high computational efficiency and minimal resource overhead while maintaining the same level of security.

[0003] Elliptic curve cryptography operations can be divided from top to bottom into the protocol layer, the group operation layer, and the finite field operation layer. By implementing the finite field operation unit of the underlying finite field operation layer and implementing group operation scheduling schemes based on different groups, elliptic curve cryptographic protocols can be implemented in different scenarios. Furthermore, elliptic curve cryptographic protocols require frequent scheduling of group operations, which are complex and computationally intensive. Therefore, implementing the finite field group operation unit and optimizing the scheduling scheme of the group operation layer are key factors in determining system performance. Elliptic curve multiplication (Scalar Multiplication), one of its core operations, is widely used in security protocols such as key exchange and digital signatures.

[0004] There are various existing hardware implementations for elliptic curve point multiplication, but most of them have the following shortcomings:

[0005] First, although some design schemes achieve efficient point multiplication operations, they consume a lot of hardware resources and are not suitable for deployment on lightweight devices.

[0006] Secondly, some designs perform poorly in terms of computing speed and latency, making it difficult to meet the real-time requirements of high-speed data transmission and security protocols.

[0007] Furthermore, some lightweight designs, while pursuing resource conservation, ignore security and are vulnerable to side-channel attacks (such as power analysis attacks).

[0008] Finally, many existing designs are optimized for specific application scenarios and lack versatility and flexibility. They are difficult to adapt to the requirements of different elliptic curve parameters and point product scalars, and are not convenient for subsequent functional expansion and upgrades. Summary of the Invention

[0009] In view of this, the present invention aims to propose a lightweight elliptic curve multiplication circuit based on Curve25519 to solve the problems of large hardware resource overhead, high computational latency, insufficient security, strong specialization and lack of scalability in the existing technology.

[0010] To achieve the above object, the technical solution of the present invention is achieved as follows:

[0011] A first aspect of the present invention provides a lightweight elliptic curve multiplication circuit based on Curve25519, comprising:

[0012] Encoding unit, instruction storage unit, value decoding unit, and logic operation unit;

[0013] The encoding unit is used to generate control instructions for the entire point multiplication calculation process based on the elliptic curve point multiplication scalar;

[0014] The instruction storage unit is used to store the control instructions generated by the encoding unit;

[0015] The value decoding unit is used to send an instruction read enable signal to the instruction storage unit;

[0016] The instruction storage unit sends the control instruction to the value decoding unit in response to the read enable signal;

[0017] The value decoding unit is used to decode the control instruction sent by the instruction storage unit and convert it into an arithmetic operation corresponding to the control instruction;

[0018] The logic operation unit is used to store elliptic curve parameters, point product scalars, random scalar masks, and random coordinate masks; and is also used to perform arithmetic operations to obtain and output point product results; the elliptic curve parameters include base point coordinates;

[0019] The control instructions include random scalar initialization control instructions, random photographic coordinate initialization control instructions, Montgomery ladder algorithm iteration control instructions, and coordinate conversion control instructions.

[0020] Furthermore, the logic operation unit includes a modular adder-subtractor, a modular multiplier, a modular invertor, and a register group;

[0021] The modular adder-subtractor is used to calculate addition and subtraction on the prime number field;

[0022] The modular multiplier is used to calculate multiplication on the prime number field;

[0023] The modular inverse is used to calculate the multiplicative inverse element on the prime number field;

[0024] Performing an arithmetic operation through the modular adder-subtractor, the modular multiplier, and the modular inverse to obtain a dot product result and storing the result in a register group;

[0025] The register group is used to store elliptic curve parameters, point product scalars, random scalar masks, and random coordinate masks, and is also used to output point product results.

[0026] Furthermore, the encoding unit, instruction storage unit, value decoding unit and logic operation unit share the same clock domain.

[0027] Furthermore, the scheduling strategy of the point multiplication of the logic operation unit adopts the Montgomery ladder algorithm.

[0028] Furthermore, the control instruction is a random scalar initialization control instruction;

[0029] The logic operation unit is used to calculate the value of the formula 1.

[0030]

[0031] Calculate the random scalar mask k′, where k is the point multiplication scalar, r is a random number, #E represents the group order of the elliptic curve Curve25519, and P is the base point of the point multiplication operation.

[0032] Furthermore, the control instruction is a random photography coordinate initialization control instruction;

[0033] The logic operation unit is used to convert the base point coordinates P(x,y) into the photographic coordinate system P′(X,Y,Z);

[0034] Get the random value γ and transform the camera coordinate system P'(X,Y,Z) into a random coordinate mask P"(γX,γY,γZ).

[0035] Furthermore, the control instruction is a coordinate transformation control instruction;

[0036] The logic operation unit is based on formula 2

[0037] {(x,y)~(X,Y,1);X=x,Y=y}

[0038]

[0039] Convert the base point P(x,y) on the affine coordinate system to the Jacobi projection coordinates P(X,Y,Z).

[0040] Further, the control instructions include Montgomery ladder algorithm iteration control instructions;

[0041] The modular multiplier of the logic operation unit is configured to perform multiplication using a serial multiplication-addition algorithm, wherein the multiplication operation is divided and conquered by the Karatsuba algorithm, simplifying two N-bit-wide multiplications into three N / 2-bit-wide multiplications, thereby reducing time complexity; and reducing the multiplication result using an improved Mersenne prime fast modular reduction algorithm. The improved Mersenne prime fast modular reduction algorithm includes: implicitly reducing the intermediate result generated by the Karatsuba algorithm using the Mersenne prime characteristics, reducing the original 512-bit width result of the multiplication to 390 bits, and obtaining the modular reduction result through the 390-bit Mersenne reduction.

[0042] Furthermore, the modular multiplier uses a 33-bit multiplier and a 66-bit adder to implement 132-bit bit-width multiplication;

[0043] The logic operation unit reduces the multiplication result using an improved Mersenne prime fast modular reduction algorithm, which includes using two 390-bit adders to perform Mersenne prime reduction and storing the input value of the multiplication operation, the iterative intermediate value of the serial multiplication-addition algorithm, and the calculated intermediate value of the improved Mersenne prime reduction through 24 33-bit registers.

[0044] Furthermore, the modular invertor adopts an extended Euclidean algorithm based on Radix-2.

[0045] Compared with the prior art, the present invention has the following advantages:

[0046] The present invention simplifies the complex operations in the elliptic curve point multiplication operation into simpler arithmetic operations, thereby reducing the computational complexity and improving the computational efficiency.

[0047] The control instructions generated by the encoding unit can accurately guide the entire dot multiplication calculation process, avoiding unnecessary calculation steps and thus improving the calculation speed.

[0048] By introducing random scalar masks and random coordinate masks, the concealment of point multiplication operations is increased, which can effectively resist side channel attacks such as power consumption analysis and improve the security of elliptic curve encryption.

[0049] Sensitive information such as elliptic curve parameters and point multiplication scalars is stored in the logical operation unit, and precise operations are performed through control instructions to prevent the risk of information leakage.

[0050] The control instructions generated by the coding unit of the circuit can flexibly adapt to different elliptic curve parameters and point multiplication scalars, and have strong versatility and flexibility.

[0051] The modular design between each unit makes the circuit easy to expand and upgrade, and new functions can be added or existing functions can be optimized according to actual needs.

[0052] By optimizing the control flow and arithmetic operations, the consumption of hardware resources is reduced, so that the circuit can also achieve efficient elliptic curve point multiplication operations on lightweight devices.

[0053] While ensuring computing efficiency and security, it reduces power consumption and costs and improves energy efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] The accompanying drawings, which constitute part of the present invention, are provided to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are provided to explain the present invention and do not constitute an undue limitation of the present invention. In the accompanying drawings:

[0055] Figure 1 This is a schematic diagram of the overall structure of the lightweight instruction architecture elliptic curve multiplication circuit of the present invention;

[0056] Figure 2 Flowchart of the working sequence of the dot multiplication circuit of the present invention;

[0057] Figure 3 A calculation flow chart of the basic operations of PAPDU in the modular multiplier and modular adder-subtractor structural units of the present invention;

[0058] Figure 4 Schematic diagram of the structure of the modular adder and subtractor of the present invention;

[0059] Figure 5 Schematic diagram of the structure of the modular multiplier of the present invention;

[0060] Figure 6 Schematic diagram of the structure of the modular inverter of the present invention. DETAILED DESCRIPTION

[0061] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features therein may be combined with each other.

[0062] In the description of the present invention, it should be noted that the terms "upper," "lower," "inner," and "back" and other terms indicating orientations or positional relationships are based on the orientations or positional relationships shown in the accompanying drawings and are intended solely to facilitate and simplify the description of the present invention. They are not intended to indicate or imply that the devices or components referred to must have, be constructed, or operate in a specific orientation, and therefore should not be construed as limitations on the present invention. Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0063] Furthermore, in the description of the present invention, unless otherwise expressly defined, the terms "mounted," "connected," "connect," and "connector" should be interpreted broadly. For example, these terms may refer to fixed, removable, or integral connections; mechanical or electrical connections; direct or indirect connections through an intermediary; or internal communication between two components. Those skilled in the art will appreciate the specific meanings of these terms in the present invention based on the specific circumstances.

[0064] The following will refer to the attached Figures 1 to 6 The present invention is described in detail with reference to the embodiments.

[0065] Overall, if Figure 1 As shown, the present invention provides a lightweight elliptic curve multiplication circuit based on Curve25519, including:

[0066] Encoding unit, instruction storage unit, value decoding unit, and logic operation unit;

[0067] The encoding unit is used to generate control instructions for the entire point multiplication calculation process based on the elliptic curve point multiplication scalar;

[0068] An instruction storage unit, used for storing control instructions generated by the encoding unit;

[0069] A value decoding unit, configured to send an instruction read enable signal to the instruction storage unit;

[0070] The instruction storage unit sends the control instruction to the value decoding unit in response to the read enable signal;

[0071] A value decoding unit, configured to decode the control instruction sent by the instruction storage unit and convert it into an arithmetic operation corresponding to the control instruction;

[0072] a logic operation unit, configured to store elliptic curve parameters, point product scalars, random scalar masks, and random coordinate masks; and to perform arithmetic operations to obtain and output point product results; the elliptic curve parameters include base point coordinates;

[0073] The control instructions include random scalar initialization control instructions, random photographic coordinate initialization control instructions, Montgomery ladder algorithm iteration control instructions, and coordinate transformation control instructions.

[0074] The present invention reduces computational complexity and improves computational efficiency by simplifying complex operations in elliptic curve point multiplication operations into simpler arithmetic operations.

[0075] The control instructions generated by the encoding unit can accurately guide the entire dot multiplication calculation process, avoiding unnecessary calculation steps and thus improving the calculation speed.

[0076] By introducing random scalar masks and random coordinate masks, the concealment of point multiplication operations is increased, which can effectively resist side channel attacks such as power consumption analysis and improve the security of elliptic curve encryption.

[0077] Sensitive information such as elliptic curve parameters and point multiplication scalars is stored in the logical operation unit, and precise operations are performed through control instructions to prevent the risk of information leakage.

[0078] The control instructions generated by the coding unit of the circuit can flexibly adapt to different elliptic curve parameters and point multiplication scalars, and have strong versatility and flexibility.

[0079] The modular design between each unit makes the circuit easy to expand and upgrade, and new functions can be added or existing functions can be optimized according to actual needs.

[0080] By optimizing the control flow and arithmetic operations, the consumption of hardware resources is reduced, so that the circuit can also achieve efficient elliptic curve point multiplication operations on lightweight devices.

[0081] While ensuring computing efficiency and security, it reduces power consumption and costs and improves energy efficiency.

[0082] In a possible embodiment, the logic operation unit includes a modular adder-subtractor, a modular multiplier, a modular invertor, and a register group;

[0083] Modular adder-subtractor, used to compute addition and subtraction over prime number fields;

[0084] Modular multiplier, used to calculate multiplication over prime number fields;

[0085] Modular inverse, used to compute multiplicative inverses over prime fields;

[0086] Performing arithmetic operations through a modular adder-subtractor, a modular multiplier, and a modular inverse to obtain a dot product result and storing it in a register group;

[0087] A register group is used to store elliptic curve parameters, point product scalars, random scalar masks, and random coordinate masks, and is also used to output point product results.

[0088] In a possible embodiment, the encoding unit, the instruction storage unit, the value decoding unit, and the logic operation unit share the same clock domain.

[0089] In this embodiment, all units share the same clock domain, so each unit works synchronously under the drive of the same clock signal, which simplifies the design complexity of the circuit and avoids signal synchronization problems that may occur between different clock domains; and this embodiment does not require the design of complex clock domain crossing interfaces for different units, reducing the difficulty of interface design and the possibility of errors.

[0090] In digital circuits, signal transmission between different clock domains can lead to metastability, which in turn affects system stability. Sharing the same clock domain effectively avoids this problem, improving system stability and reliability. Furthermore, all units operating under the same clock signal ensure consistent timing behavior, facilitating overall system performance optimization and debugging.

[0091] Sharing a clock domain reduces the delay required for signals to pass between different clock domains, helping to improve the overall response speed of the system; because each unit can work synchronously, the system can more effectively utilize computing resources and improve throughput and processing efficiency.

[0092] All units share the same clock domain, allowing debugging to be performed in a unified clock environment, simplifying the debugging process and process. The shared clock domain design makes system maintenance and upgrades more convenient because there is no need to consider compatibility issues between different clock domains.

[0093] In a possible embodiment, the scheduling strategy for the dot product of the logic operation unit adopts the Montgomery Ladder algorithm.

[0094] In this embodiment, the dot product scheduling strategy uses the Montgomery Ladder algorithm. Because the time and operations performed in each iteration of the Montgomery Ladder algorithm are exactly the same, it can resist timing analysis attacks and simple energy analysis attacks. Furthermore, since there are no invalid false operations during the iteration, it can resist Class C Safe-Error attacks, thereby enhancing circuit security.

[0095] In a possible embodiment, the control instruction is a random scalar initialization control instruction;

[0096] Logic operation unit, used to calculate the value of formula 1

[0097]

[0098] Calculates the random scalar mask k′, where k is the point multiplication scalar, r is a random number, #E represents the group order of the Curve25519 elliptic curve, and P is the base point of the point multiplication operation.

[0099] In this embodiment, Curve25519 is an example of an elliptic curve defined on the Montgomery curve, designed and proposed by the famous cryptographer Daniel J. Bernstein. The "25519" in its name comes from the prime number field p=2 defined by it. 255 -19.

[0100] In this embodiment, k′ is defined as a randomly masked scalar value used to replace the point multiplication scalar k in elliptic curve cryptography operations to enhance security. By introducing a random mask, k′ can change the input scalar while maintaining the same computational result, thereby affecting the iteration process in the Montgomery Ladder algorithm and effectively defending against differential power analysis (DPA) attacks.

[0101] r is a random number that is multiplied by the group order #E of the Curve25519 elliptic curve to generate a random mask. By introducing the random number r, the mask is different for each operation, making it more difficult for attackers to obtain useful information through differential power analysis.

[0102] #E represents the group order of the Curve25519 elliptic curve, that is, the total number of points on the elliptic curve. Group order #E is a key parameter in elliptic curve cryptography, possessing properties such as the existence of the identity element and the uniqueness of the inverse. In this embodiment, #E is used to generate a random mask, because any point multiplied by group order #E will result in the identity element (i.e., the point at infinity), thus ensuring that k′P = kP. #E plays a key role in generating the random mask, ensuring that the scalar value k1 after the random mask produces the same result as the original scalar k when performing a point multiplication operation.

[0103] P is a point on the Curve25519 elliptic curve. P is the base point for point multiplication, the point used when calculating kP or k1P. In elliptic curve cryptography, a fixed base point P is typically chosen, and other points on the elliptic curve are generated through scalar multiplication.

[0104] In this embodiment, a random mask for the scalar is introduced to protect the input scalar information of the point multiplication. Due to the finite field properties of elliptic curves, this design adds the random mask k′ = k + r × #E, where #E is the group order of the Curve25519 elliptic curve. The properties of the group order ensure that k′P = kP. This allows the input scalar and the iterative process in the Montgomery Ladder algorithm to be modified while ensuring the same computational result, effectively resisting differential power analysis.

[0105] In a possible embodiment, the control instruction is a random photography coordinate initialization control instruction;

[0106] A logic operation unit, used to convert the base point coordinates P(x,y) into the photographic coordinate system P'(X,Y,Z);

[0107] Get the random value γ and transform the camera coordinate system P'(X,Y,Z) into a random coordinate mask P"(γX,γY,γZ).

[0108] In this embodiment, in order to resist differential power analysis, a randomized Z coordinate is introduced during coordinate conversion. Due to the characteristics of the elliptic curve photographic coordinate system, this design converts the input P(x,y) into the photographic coordinate system P'(X,Y,Z) during the initialization phase. In low-security methods, the Z coordinate is initialized to 1, which increases the risk of being cracked by differential power analysis. By introducing a randomized γ value, P'(X,Y,Z) is converted to P" (γX,γY,γZ). The randomized initial coordinates reduce the regularity of power consumption under different scalar inputs and can effectively resist differential power analysis.

[0109] In a possible embodiment, the control instruction is a coordinate transformation control instruction;

[0110] The logic operation unit is based on formula 2

[0111] {(x,y)~(X,Y,1);X=x,Y=y}

[0112]

[0113] Convert the base point P(x,y) on the affine coordinate system to the Jacobi projection coordinates P(X,Y,Z).

[0114] To reduce computational complexity, we first convert the base point P(x,y) in the affine coordinate system into Jacobi projection coordinates P(X,Y,Z). After this conversion, the starting base point P and the intermediate results during the dot product calculation are all Jacobi projection coordinates. This avoids the need to calculate a modular inverse during each iteration of the dot product calculation. Through coordinate conversion, the modular inverse operation in each iteration is converted into a modular multiplication operation. Since modular multiplication is much less computationally intensive than modular inversion, this reduces computational complexity.

[0115] In a possible embodiment, the control instruction includes a Montgomery ladder algorithm iteration control instruction;

[0116] In one possible embodiment, the modular multiplier of the logic operation unit is configured to perform multiplication operations using a serial multiplication-addition algorithm, wherein the multiplication operation is divided and conquered by the Karatsuba algorithm, simplifying two N-bit-wide multiplications into three N / 2-bit-wide multiplications, thereby reducing time complexity; and reducing the multiplication result using an improved Mersenne prime fast modular reduction algorithm, the improved Mersenne prime fast modular reduction algorithm including: implicitly reducing the intermediate result generated by the Karatsuba algorithm using the Mersenne prime characteristics, reducing the original 512-bit width result of the multiplication to 390 bits, and obtaining the modular reduction result through the 390-bit Mersenne reduction.

[0117] Specifically, the modular multiplier uses a 33-bit multiplier and a 66-bit adder to implement 132-bit wide multiplication;

[0118] The logic operation unit reduces the multiplication result using an improved Mersenne prime fast modular reduction algorithm. The algorithm includes using two 390-bit adders for Mersenne prime reduction and storing the input values of the multiplication operation, the iterative intermediate values of the serial multiplication-addition algorithm, and the calculated intermediate values of the improved Mersenne prime reduction through 24 33-bit registers.

[0119] In a possible embodiment, the modular invertor adopts an extended Euclidean algorithm based on Radix-2.

[0120] Based on the reduction algorithm of Mersenne primes, the present invention improves the reduction algorithm for the Curve25519 elliptic curve and designs a lightweight prime field elliptic curve cryptographic modular multiplier. A more secure point multiplication unit is implemented through the Montgomery Ladder algorithm and random masking of scalars and base points.

[0121] The present invention is designed in the form of an instruction architecture, encapsulating the finite field budget unit into a logic operation unit, and there is room for subsequent instruction expansion to realize other functions.

[0122] In the modular multiplier of the key calculation of the point multiplication unit, the large area resources are strictly reused, so that the present invention has the characteristics of small area;

[0123] The midpoint multiplication circuit of the present invention adopts a balanced iterative operation process and adds a random mask to the input scalar and base point, so that the present invention can simultaneously resist time analysis attacks, simple energy analysis attacks, differential power consumption analysis and Class C Safe-Error attacks.

[0124] More specifically, the present invention provides the following embodiments:

[0125] In this embodiment, the Curve25519 elliptic curve is used. The hardware circuit design is as follows: The main function of the lightweight elliptic curve point multiplication circuit is to calculate the elliptic curve point multiplication with the addition of a random mask. The mathematical expression of the elliptic curve point multiplication with the addition of a random mask is Q = (k + r) * P, where k is the point multiplication scalar value, r is the random mask of the point multiplication scalar, P is the base point coordinate (the base point coordinate is one of the elliptic curve parameters), and Q is the point multiplication result.

[0126] The top-level hardware structure diagram of the lightweight instruction architecture dot multiplication circuit is as follows Figure 1 The lightweight instruction architecture dot multiplication circuit includes an encoding unit, an instruction storage unit, an instruction fetch and decode unit, a logic operation unit, and a register group. These parts share the same clock domain, that is, a common clock signal and a reset signal.

[0127] The responsibilities of the register group include:

[0128] Communicate with the outside world;

[0129] Receive the randomized Z coordinate of the point multiplication base point, the elliptic curve parameters, the random mask of the point multiplication scalar, the point multiplication scalar input value k and the external control signal;

[0130] Output the point multiplication result Q and the working status of the current lightweight elliptic curve point multiplication circuit.

[0131] The responsibilities of the coding unit include:

[0132] Generate instructions based on the scalar multiplication of the input elliptic curve

[0133] The encoding unit will generate all the instructions for the entire point multiplication calculation process based on the input elliptic curve point multiplication scalar. The instructions have three functions: random scalar initialization, random photographic coordinate initialization, MontgomeryLadder iteration, and coordinate transformation.

[0134] The working order of the dot product circuit is as follows Figure 2 As shown, after the circuit is reset, it operates in "State 1: Idle." If no start command is received, it remains in "State 1: Idle" waiting. Upon receiving a start command, it jumps to "State 2: Initialization." The workflow within "State 2: Initialization" is sequential, and upon completion, it automatically jumps to "State 3: Iteration." Each step in "State 3: Iteration" is iteratively executed until the final iteration is determined. The iteration process essentially scans the binary sequence of the dot product scalar value k, with the final iteration occurring when the last bit is scanned. After the final iteration, the state jumps to "State 4: Coordinate Transformation," which also executes sequentially. Upon completion, it outputs the dot product result and returns to "State 1: Idle."

[0135] Instruction storage unit:

[0136] The instruction encoded by the storage encoding unit is sent to the value decoding unit;

[0137] Wait for the value decoding unit to return to the instruction execution state, and send the instruction to the value decoding unit again after the instruction execution is completed.

[0138] Value decoding unit:

[0139] The function of the instruction fetch decoding unit is to send an instruction read enable signal instruction to the instruction storage unit, decode the instructions sent by the storage unit, and convert them into corresponding arithmetic operations and register read and write operations.

[0140] Logical operation unit:

[0141] The logic operation includes three different finite field arithmetic units: a modular adder and subtractor, a modular multiplier, and a modular inverse. These units also include registers for storing elliptic curve parameters, point product scalars, random scalar masks, random coordinate masks, and computing intermediate values. The modular adder and subtractor performs addition and subtraction over prime fields. The modular multiplier performs multiplication over prime fields. The modular inverse computes multiplicative inverses over prime fields.

[0142] In this design, to reduce the computational complexity of modular multiplication, the Karatsuba algorithm is first used to reduce the time complexity through a divide-and-conquer approach. This simplifies two N-bit-wide multiplications into three N / 2-bit-wide multiplications, enabling faster multiplication calculations.

[0143] The multiplication of two N-bit large numbers a and b is split as follows:

[0144]

[0145] Then transform the original calculation into

[0146]

[0147] The original 4 N / 2 bit multiplications are converted into 3 N / 2 bit multiplications, which reduces the amount of multiplication calculations. This design uses the characteristics of the Karastuba algorithm and the characteristics of Mersenne prime reduction to convert a1b1*2 in the above equation 256 The terms are reduced in advance to reduce the complexity of the final shift full adder. Algorithm 1 is given below, which is an improved reduction algorithm based on Mersenne primes. Please refer to Table 1.

[0148]

[0149] Algorithm 2 provides an improved algorithm using the Mersenne prime reduction algorithm to solve the a in the Karastuba algorithm. h a l *2 256 The term is implicitly reduced, and the 512-bit width result of the original multiplication is reduced to 390 bits through implicit reduction. Then, the final result of modular reduction is obtained through 390-bit Mersenne reduction. The specific process is shown in Table 2.

[0150]

[0151] Then, Algorithm 3 performs another 390-bit Mersenne reduction calculation on the final calculated R6+R3+R5 to obtain the final modular multiplication result. The specific process is shown in Table 3.

[0152]

[0153]

[0154] Algorithm 4 presents the computational process for the Montgomery Ladder dot product based on a random mask and a random Z coordinate. The algorithm first applies a mask to the scalar using the properties of the elliptic curve group order. Then, during the conversion to the photographic coordinate system, a random Z coordinate is introduced to randomize the photographic coordinates. Finally, the scalar is scanned bit by bit using the Montgomery Ladder algorithm, and different operations are performed based on the scan results. See Table 4 for the specific process.

[0155]

[0156] Algorithm 5 gives the point addition and doubling algorithm (PAPDU) on Curve25519 based on the photographic coordinate system. The basic operation steps of Algorithm 5 refer to Table 5:

[0157]

[0158] The overall process is as follows:

[0159] Step S1: System initialization, caching the input parameter group.

[0160] Step S2. Initialization of the dot product operation, corresponding to "State 2: Initialization," is the first and second steps in Algorithm 4. A mask is added to the scalar and base point to randomize the scalar value k' and the photographic coordinates, and the dot product scalar value k' is scanned.

[0161] Step S3. Scan the dot product scalar value k' from the most significant bit to the least significant bit in sequence. Enter "State 3: Iteration" at this time. According to Algorithm 4, give different iteration inputs to Algorithm 5 PAPDU according to the current scan value. The iteration process corresponds to Step 1 to Step 18 of Table 5.

[0162] Step S4: Scan the next bit of the dot product scalar value k and iterate until all bits of the dot product scalar value k are scanned.

[0163] Step S5. Switch to the coordinate conversion stage, ie, "State 4: Modular Inverse Calculation", to complete the conversion of the projective coordinate representation of the dot multiplication result to the affine coordinate representation.

[0164] Step S6: After the coordinate conversion is completed, the dot product operation result in the form of affine coordinate representation is output.

[0165] Step S7: The system state switches to the idle state, ie, "State 1: Idle", waiting for the next valid operation.

[0166] The following is a calculation flow based on the basic operation of PAPDU in a structural unit using a modular multiplier and modular adder-subtractor, such as Figure 3 As shown, this calculation process has strong reuse of logic units and can reduce the area of the calculation unit.

[0167] The structures of the three modular operation units in the logic operation unit are introduced below.

[0168] like Figure 4 As shown, the modular adder and subtractor of the present invention integrates traditional modular adders and subtractors, implementing both modular addition and subtraction functions by reusing the same adder path and controlling the corresponding functions through function flags. In the integrated modular adder and subtractor, a single-bit data selector is used to determine the highest bit value of the intermediate operation result, accurately comparing the numerical relationship between the intermediate operation result and the modulus p, ultimately achieving correct modular addition / subtraction functions.

[0169] like Figure 5 As shown, the modular multiplier uses a serial multiplication-addition algorithm and an improved Mersenne prime fast modular reduction algorithm. It implements 132-bit multiplication using a 33-bit multiplier and a 66-bit adder. The Mersenne prime reduction step is implemented using two 390-bit adders, and 24 33-bit registers are used to store the multiplication input values, the iterative intermediate values of the serial multiplication-addition algorithm, and the calculated intermediate values of the improved Mersenne prime reduction. The overall design fully reuses multipliers, adders, and registers, breaking down the larger-bit-width multiplication and modular reduction operations in conventional modular multiplication into smaller-bit-width multiplications and fixed-bit-width additions. This reduces the design's hardware resource overhead and creates a lightweight modular multiplier.

[0170] like Figure 6 As shown, the modular inverter uses the traditional Radix-2-based extended Euclidean algorithm. The hardware circuit of the binary (Radix-2) extended Euclidean algorithm consumes fewer resources and is suitable for lightweight applications. The algorithm flow is shown in Table 6.

[0171]

[0172] In summary, the present invention adopts the Montgomery Ladder algorithm to perform the scheduling design of the point multiplication operation, and realizes the randomization of the scalar and the base point coordinates and photographic coordinates by adding a randomized mask. Therefore, this design can resist time analysis attacks, simple energy analysis attacks and Class C Safe-Error attacks.

[0173] The reduction method based on the improved Mersenne prime number is adopted to reduce the algorithm complexity of modular reduction, reduce the computational complexity of the reduction process, and reduce the overhead of hardware resources.

[0174] It uses lightweight modular multipliers and modular addition and subtraction general units, and uses serial interleaved multiplication and addition units for iterative calculations. It implements large-bit-width multipliers by time-sharing multiplexing of small-bit-width multipliers, adders, and registers, thus reducing the hardware resource overhead of the calculation unit.

[0175] The point multiplication unit is implemented using an instruction architecture, and there is room for instruction expansion. Based on the existing logical operation unit, the instruction set can be expanded to implement other prime number field operation units, thereby improving the reuse of hardware resources (reducing hardware resource overhead).

[0176] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A lightweight elliptic curve multiplication circuit based on Curve25519, characterized in that: include: Encoding unit, instruction storage unit, value decoding unit, and logic operation unit; The encoding unit is used to generate control instructions for the entire point multiplication calculation process based on the elliptic curve point multiplication scalar; The instruction storage unit is used to store the control instructions generated by the encoding unit; The value decoding unit is used to send an instruction read enable signal to the instruction storage unit; The instruction storage unit sends the control instruction to the value decoding unit in response to the read enable signal; The value decoding unit is used to decode the control instruction sent by the instruction storage unit and convert it into an arithmetic operation corresponding to the control instruction; The logic operation unit is used to store elliptic curve parameters, point product scalars, random scalar masks, and random coordinate masks; and is also used to perform arithmetic operations to obtain and output point product results; the elliptic curve parameters include base point coordinates; The control instructions include random scalar initialization control instructions, random photographic coordinate initialization control instructions, Montgomery ladder algorithm iteration control instructions, and coordinate conversion control instructions.

2. The lightweight elliptic curve multiplication circuit according to claim 1, characterized in that: The logic operation unit includes a modular adder-subtractor, a modular multiplier, a modular invertor, and a register group; The modular adder-subtractor is used to calculate addition and subtraction on the prime number field; The modular multiplier is used to calculate multiplication on the prime number field; The modular inverse is used to calculate the multiplicative inverse element on the prime number field; Performing an arithmetic operation through the modular adder-subtractor, the modular multiplier, and the modular inverse to obtain a dot product result and storing the result in the register group; The register group is used to store elliptic curve parameters, point product scalars, random scalar masks, and random coordinate masks, and is also used to output point product results.

3. The lightweight elliptic curve multiplication circuit according to claim 1, characterized in that: The encoding unit, instruction storage unit, value decoding unit and logic operation unit share the same clock domain.

4. The lightweight elliptic curve multiplication circuit according to claim 1, characterized in that: The scheduling strategy of the point multiplication of the logic operation unit adopts the Montgomery ladder algorithm.

5. The lightweight elliptic curve multiplication circuit according to claim 2, characterized in that: The control instruction is a random scalar initialization control instruction; The logic operation unit is used to calculate the value of the formula 1. Calculate the random scalar mask k′, where k is the point multiplication scalar, r is a random number, #E is the group order of the elliptic curve Curve25519, and P is the base point of the point multiplication operation.

6. The lightweight elliptic curve multiplication circuit according to claim 1, characterized in that: The control instruction is a random photography coordinate initialization control instruction; The logic operation unit is used to convert the base point coordinates P(x,y) into the photographic coordinate system P′(X,Y,Z); Get the random value γ and transform the camera coordinate system P'(X,Y,Z) into a random coordinate mask P"(γX,γY,γZ).

7. The lightweight elliptic curve multiplication circuit according to claim 1, characterized in that: The control instruction is a coordinate transformation control instruction; The logic operation unit is based on formula 2 {(x,y)~(X,Y,1);X=x,Y=y} Convert the base point P(x,y) on the affine coordinate system to the Jacobi projection coordinates P(X,Y,Z).

8. The lightweight elliptic curve multiplication circuit according to claim 2, characterized in that: The control instructions include Montgomery ladder algorithm iteration control instructions; The modular multiplier of the logic operation unit is configured to perform multiplication using a serial multiplication-addition algorithm, wherein the multiplication operation is divided and conquered by the Karatsuba algorithm, simplifying two N-bit-wide multiplications into three N / 2-bit-wide multiplications, thereby reducing time complexity; and reducing the multiplication result using an improved Mersenne prime fast modular reduction algorithm. The improved Mersenne prime fast modular reduction algorithm includes: implicitly reducing the intermediate result generated by the Karatsuba algorithm using the Mersenne prime characteristics, reducing the original 512-bit width result of the multiplication to 390 bits, and obtaining the modular reduction result through the 390-bit Mersenne reduction.

9. The lightweight elliptic curve multiplication circuit according to claim 8, characterized in that: The modular multiplier uses a 33-bit multiplier and a 66-bit adder to implement 132-bit wide multiplication; The logic operation unit reduces the multiplication result using an improved Mersenne prime fast modular reduction algorithm, which includes using two 390-bit adders to perform Mersenne prime reduction and storing the input value of the multiplication operation, the iterative intermediate value of the serial multiplication-addition algorithm, and the calculated intermediate value of the improved Mersenne prime reduction through 24 33-bit registers.

10. The lightweight elliptic curve multiplication circuit according to claim 2, characterized in that: The modular invertor adopts an extended Euclidean algorithm based on Radix-2.

Images