High-performance Combb dot multiplication architecture based on low-delay window recoding algorithm

Abstract

The invention relates to a high-performance Combb point multiplication architecture based on a low-delay window recoding algorithm, which comprises an LLW recoding unit, an arithmetic logic unit (ALU), a memory array, a finite-state machine, a phase-locked loop (PLL) module and an instruction memory, and is characterized in that the LLW recoding unit, the ALU, the memory array, the finite-state machine, the PLL and the instruction memory are connected in sequence; the LLW recoding unit can remove all all-zero sequences from an input point product scalar k; the arithmetic logic unit is used for executing a high-performance Combb point multiplication algorithm; the memory array is used for storing a result pre-calculated by the arithmetic logic unit; the phase-locked loop module is used for providing a clock of a high-performance Combb point multiplication architecture; and the instruction memory is used for storing an operation instruction of the arithmetic logic unit. According to the method, the capability of resisting high-order energy analysis attacks can be ensured in a recoding mode.

Description

Technical Field

[0001] The present invention belongs to the technical field of digital integrated circuit design, and in particular to a high-performance Comb point multiplication architecture based on a low-latency window recoding algorithm. Background Art

[0002] For the traditional Comb point multiplication algorithm, given the Comb window length w, the Comb segment length is (The most significant bit is padded with 0 to ensure that the length of each segment is the same), so the scalar k in the dot product calculation can be segmented into a matrix, where the vertical direction is the Comb window of length w.

[0003]

[0004] All possible situations in the Comb window are pre-calculated (Pre-computation Stage) in a computational manner, and these pre-calculated results are stored. Then, during the process of calculating the dot product (Evaluation Stage), the Comb window can be scanned and the corresponding pre-calculated results can be retrieved from the memory, thereby accelerating the entire dot product settlement process.

[0005] The existing solution is designed based on the traditional Comb algorithm. First, a pre-calculation phase is performed. For the columns in the k matrix, all binary coding possibilities are traversed and all possibilities are stored in memory. Then, the evaluation phase begins. The columns of the k matrix are scanned column by column, and based on the binary code of the currently scanned column, the corresponding pre-calculated value is retrieved from the memory. First, the accumulated value is doubled once, and then the retrieved pre-calculated value and the current accumulated value are added once, until all columns are scanned. If a column with all zeros is encountered during the scan, the addition operation for the current column is skipped and the doubling operation is performed.

[0006] The existing Comb multiplication algorithm has two defects:

[0007] First, its most critical flaw is that its security is far inferior to that of the Montgomery Ladder dot multiplication algorithm. During the Montgomery Ladder dot multiplication algorithm, regardless of whether the current scanned scalar bit is 1 or 0, the current iteration of the algorithm always includes one dot addition and one dot doubling operation. This means that the Montgomery Ladder dot multiplication algorithm's execution mode is completely balanced. This balanced execution mode significantly improves the hardware circuit's resistance to energy analysis attacks, a common side-channel attack. In contrast, in the traditional Comb dot multiplication algorithm, when the Comb window is all zero, the current iteration of the algorithm skips one dot addition and retains only one dot doubling operation. Therefore, the execution mode of the traditional Comb dot multiplication algorithm is not completely balanced. As a result, the traditional Comb dot multiplication algorithm can easily reveal the location of the all-zero Comb window in energy analysis attacks, leading to side-channel information leakage and reduced security.

[0008] Secondly, the traditional Comb dot product algorithm merely proposes a framework for utilizing additional storage resources to speed up dot product calculations, but it does not provide a basis for selecting the window size. Predictably, as w increases, the pre-calculation process becomes more complex, storage resources become more expensive, and the number of dot product iterations decreases significantly. Summary of the Invention

[0009] The present invention provides a high-performance Comb point multiplication architecture based on a low-latency window recoding algorithm to address the defects in the prior art.

[0010] The present invention is achieved through the following technical solutions:

[0011] A high-performance Comb point multiplication architecture based on a low-latency window recoding algorithm includes an LLW recoding unit, an arithmetic logic unit (ALU), a memory array, a finite state machine, a phase-locked loop (PLL) module, and an instruction memory.

[0012] The LLW recoding unit can remove all all-zero sequences from the input point product scalar k;

[0013] The arithmetic logic unit executes a high-performance Comb point multiplication algorithm;

[0014] The memory array is used to store the results pre-calculated by the arithmetic logic unit;

[0015] The phase-locked loop module is used to provide a clock for a high-performance Comb point multiplication architecture;

[0016] The instruction memory is used to store the operation instructions of the arithmetic logic unit.

[0017] As described above, in a high-performance Comb multiplication architecture based on a low-latency window recoding algorithm, the LLW recoding unit can complete 1-bit recoding in parallel within one clock cycle.

[0018] As described above, a high-performance Comb point multiplication architecture based on a low-latency window recoding algorithm, the arithmetic logic unit includes three multipliers and two squarers, the input ports of the multipliers and squarers are cascaded to input registers, and a multiplexer is cascaded before the multipliers, squarers and input registers to control data selection.

[0019] As described above, a high-performance Comb point multiplication architecture based on a low-latency window recoding algorithm is described. The core content of the multiplier-adder is a modular multiplier with a parallel architecture. The logic corresponding to modular reduction and modular addition in the modular multiplier-adder can be constructed using pure combinational logic circuits. As long as the scale of the finite field is given, the circuit architecture corresponding to modular reduction and modular addition can be determined. As the most direct method, parallel polynomial multiplication can be implemented through classical multiplication, and its computational complexity is O(n 2 ), by adopting KOM architecture multiplication instead of classic multiplication, the computational complexity can be reduced from O(n 2 ) is reduced to

[0020] When m is an even number, an m-bit KOM architecture multiplier contains three (m / 2)-bit sub-multipliers; when m is an odd number, an m-bit KOM architecture multiplier contains one bit sub-multiplier and two As shown in the following formula, a multiplication of m bits can be split into a h b h , a l b l and (a h +a l )(b h +b l ), its expression is as follows;

[0021] A·B=(a h x n +a l )(b h x n +b l )

[0022] =a h b h x 2n +(al b h +a h hb l )x n +a l b l

[0023] =a h b h x 2n +[(a h +a l )(b h +b l )+a h b h +a l b l ]x n +a l b l

[0024] in, A=a h x n +a l , B=b h x n +b l ;

[0025] The KOM multiplication splitting strategy can also be applied to sub-multiplications to form a recursive calculation model. However, as the recursive depth level θ increases and the underlying classical multiplier bit width τ decreases ( Where m is the bit width of the KOM architecture multiplication), the total lookup table LUT depth of the modular multiplier-adder is D MAC It is also increasing. Therefore, for a KOM architecture multiplier with a given bit width m, there are area-delay optimal splitting strategies θ and τ;

[0026] Based on the optimal splitting strategy of KOM architecture multiplication, this chapter conducts a lookup table-level delay analysis on the critical path of KOM architecture multiplier. The multiplier part of the modular multiplier-adder in the logic unit adopts KOM architecture design. Inside the KOM architecture multiplier, there are four steps: splitting, classical multiplication, reconstruction and subtraction and addition, which correspond to D split , D CM , D align and D red&add There are four lookup table stages of delay, so the total delay of the multiplier-accumulator is as follows:

[0027] D MAC =D split +D CM +D align +D red&add

[0028] For the split step, the longest split chain consists of 2 θ Input is generated, so the maximum delay of the segmentation step is Where k is the number of input ports of the lookup table in the FPGA. For the classical multiplication step, the maximum lookup table delay of a τ-bit classical multiplier is The reconstruction phase requires a total of θ steps. When k ≥ 4, each step generates a level of lookup table delay, so D align =θ, the last subtraction and addition step in the multiplier-accumulator can be considered as a whole. In GF(2 163 ) based on the elliptic curve parameters and five-term reduction polynomials recommended by NIST, D red&add The maximum value of is 2, and for the entire critical path, the total lookup table delay is:

[0029] D tot. =D MAC +D add +D MUX

[0030] Among them, D add =1; and for an s-to-1 multiplexer, the required address width is So the multiplexer can be viewed as a Therefore, the lookup table delay of the s-to-1 multiplexer is

[0031] As described above, a high-performance Comb point multiplication architecture based on a low-latency window recoding algorithm, the adder and squarer are both constructed using pure combinational logic circuits based on XOR logic, and no additional pipelines are inserted therein; in the squarer, since the essence of the square logic and the modular reduction logic are both multi-bit XOR logic, the two can be integrated into one, and repeated XOR logic can be eliminated. In the 3rd, 7th, 10th and 11th clock cycles, the pre-calculated results are taken out of the memory array and sent to the arithmetic logic unit. If the corresponding numerical value is immediately taken out from the memory array in the current clock cycle when the pre-calculated result is required, the depth of the combinational logic will be increased, thereby forming a critical path. In order to avoid the generation of this critical path, the memory array in this design pre-reads the pre-calculated results that will be needed one clock cycle in advance. Thanks to this pre-reading method, the critical path of the arithmetic logic unit is further optimized, Figure 3 The red dashed line in the figure shows the critical path of the current arithmetic logic unit after the previous series of optimizations. This critical path includes a multiplier-accumulator, an adder, and a 5-to-1 multiplexer.

[0032] As described above, in a high-performance Comb point multiplication architecture based on a low-latency window recoding algorithm, the operating instructions of the arithmetic logic unit are the addresses of all multiplexers (MUX) in the arithmetic logic unit.

[0033] As described above, a high-performance Comb point multiplication architecture based on a low-latency window recoding algorithm, the instruction memory can make full use of the on-chip resources of the FPGA to save other on-chip reconfigurable hardware resources.

[0034] As described above, a high-performance Comb multiplication architecture based on a low-latency window recoding algorithm, the lightweight state machine controls the main state jumps, and a large number of other instructions are all stored in the instruction memory and are taken out in sequence and executed by the arithmetic logic unit.

[0035] The advantages of the present invention are:

[0036] The present invention can utilize a re-encoding method to ensure the ability of the design to resist high-order energy analysis attacks.

[0037] In the most unfavorable case (#ECSM=1), the computational load of the present invention does not increase significantly; while in the most ideal case (#ECSM=∞), the computational load is significantly reduced.

[0038] Based on data dependency analysis, the present invention proposes a compact scheduling scheme, which consumes only 13 clock cycles per iteration. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0040] Figure 1 It is a schematic diagram of the framework structure of the present invention;

[0041] Figure 2 Schematic diagram of the structure of the LLW re-encoding unit of the present invention;

[0042] Figure 3 It is a schematic diagram of the structure of the arithmetic logic unit of the present invention;

[0043] Figure 4 1. It is a critical path analysis diagram of the arithmetic logic unit of the present invention including a KOM architecture multiplier;

[0044] Figure 5is a schematic diagram of the re-encoding process of the present invention;

[0045] Figure 6 This is a schematic diagram of the high-performance Comb multiplication algorithm of the present invention;

[0046] Figure 7 The data dependency of the present invention is shown in (a) the doubling point operation in the Lopez-Dahab projection coordinate system and (b) the schematic diagram of the Lopez-Dahab projection coordinate system.

[0047] Figure 8 It is a simplified schematic diagram of the data dependency relationship of the present invention;

[0048] Figure 9 It is a register-level scheduling solution for the high-performance Comb point multiplication architecture of the present invention. DETAILED DESCRIPTION

[0049] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0050] like Figure 1 As shown, a high-performance Comb point multiplication architecture based on a low-latency window recoding algorithm includes an LLW recoding unit, an arithmetic logic unit (ALU), a memory array, a finite state machine, a phase-locked loop module (PLL), and an instruction memory;

[0051] The LLW recoding unit can remove all all-zero sequences from the input point product scalar k;

[0052] The arithmetic logic unit executes a high-performance Comb point multiplication algorithm;

[0053] The memory array is used to store the results pre-calculated by the arithmetic logic unit;

[0054] The phase-locked loop module is used to provide a clock for a high-performance Comb point multiplication architecture;

[0055] The instruction memory is used to store the operation instructions of the arithmetic logic unit.

[0056] like Figure 2As shown, specifically, the LLW recoding unit described in this embodiment can complete the recoding of 1 bit in parallel within one clock cycle.

[0057] like Figure 3 As shown, specifically, the arithmetic logic unit described in this embodiment includes three multipliers and two squarers. The input ports of the multipliers and squarers are all cascaded to input registers, and a multiplexer is cascaded before the multipliers, squarers and input registers to control data gating. In addition, this design sets up three additional registers R1, R2 and R3 to cache intermediate results during the calculation process. In this design, a multiplexer is cascaded before the input registers of the multipliers, squarers and additional registers to control data gating. The gating method of each cycle is determined by the scheduling scheme in Table 4.2. The "Modular Multiplier" column, "Modular Squarer" column and "Register" column in Table 4.2 respectively give detailed multiplexer gating methods. In order to optimize the critical path of the arithmetic logic unit architecture, each multiplexer is designed to have the same address bit width as much as possible to achieve timing balance.

[0058] More specifically, the multiplier and squarer described in this embodiment are both constructed using pure combinational logic circuits based on XOR logic, and no additional pipelines are inserted therein; in the squarer, since the essence of the square logic and modular reduction logic are both multi-bit XOR logic, the two can be integrated into one, and repeated XOR logic can be eliminated. In the 3rd, 7th, 10th and 11th clock cycles, the pre-calculated results are taken out of the memory array and sent to the arithmetic logic unit. If the corresponding numerical value is immediately taken out from the memory array in the current clock cycle in which the pre-calculated result is required, the depth of the combinational logic will be increased, thereby forming a critical path. In order to avoid the generation of this critical path, the memory array in this design pre-reads the pre-calculated results that will be needed one clock cycle in advance. Thanks to this pre-reading method, the critical path of the arithmetic logic unit is further optimized, Figure 3 The red dashed line in the figure shows the critical path of the current arithmetic logic unit after the previous series of optimizations. This critical path includes a multiplier-accumulator, an adder, and a 5-to-1 multiplexer.

[0059] Furthermore, the core content of the multiplier-adder described in this embodiment is a modular multiplier with a parallel architecture. The logic corresponding to modular reduction and modular addition in the modular multiplier-adder can be constructed using pure combinational logic circuits. As long as the scale of the finite field is given, the circuit architecture corresponding to modular reduction and modular addition can be determined. As the most direct method, parallel polynomial multiplication can be implemented using classical multiplication, and its computational complexity is O(n 2 ), by adopting KOM architecture multiplication instead of classic multiplication, the computational complexity can be reduced from O(n 2 ) is reduced to

[0060] When m is an even number, an m-bit KOM architecture multiplier contains three (m / 2)-bit sub-multipliers; when m is an odd number, an m-bit KOM architecture multiplier contains one bit sub-multiplier and two As shown in the following formula, a multiplication of m bits can be split into a h b h , a l b l and (a h +a l )(b h +b l ), its expression is as follows;

[0061] A·B=(a h x n +a l )(b h x n +b l )

[0062] =a h b h x 2n +(a l b h +a h b l )x n +a l b l

[0063] =a h b h x 2n +[(a h +a l )(b h +b l )+a h b h +a l b l ]x n +a l b l

[0064] in, A=a h x n +a l , B=b h x n +b l ;

[0065] The KOM multiplication splitting strategy can also be applied to sub-multiplications to form a recursive calculation model. However, as the recursive depth level θ increases and the underlying classical multiplier bit width τ decreases ( Where m is the bit width of the KOM architecture multiplication), the total lookup table LUT depth of the modular multiplier-adder is D MAC It is also increasing. Therefore, for a KOM architecture multiplier with a given bit width m, there are area-delay optimal splitting strategies θ and τ;

[0066] Based on the optimal splitting strategy of KOM architecture multiplication, this chapter performs a lookup table level delay analysis on the critical path of the KOM architecture multiplier. The multiplier part of the modular multiplier-adder in the logic unit adopts the KOM architecture design. The critical path including the KOM architecture multiplier is as follows Figure 4 Inside the KOM architecture multiplier, there are four steps: segmentation, classical multiplication, reconstruction, and reduction and addition, corresponding to D split , D CM , D align and D red&add There are four lookup table stages of delay, so the total delay of the multiplier-accumulator is as follows:

[0067] D MAC =D split +D CM +D align +D red&add

[0068] For the split step, the longest split chain consists of 2 θ Input is generated, so the maximum delay of the segmentation step is Where k is the number of input ports of the lookup table in the FPGA. For the classical multiplication step, the maximum lookup table delay of a τ-bit classical multiplier is The reconstruction phase requires a total of θ steps. When k ≥ 4, each step generates a level of lookup table delay, so D align =θ, the last subtraction and addition step in the multiplier-accumulator can be considered as a whole. In GF(2 163 ) based on the elliptic curve parameters and five-term reduction polynomials recommended by NIST, D red&add The maximum value of is 2, and for the entire critical path, the total lookup table delay is:

[0069] D tot. =D MAC +D add +D MUX

[0070] Among them, D add =1; and for an s-to-1 multiplexer, the required address width is So the multiplexer can be viewed as a Therefore, the lookup table delay of the s-to-1 multiplexer is

[0071] Furthermore, the operation instruction of the arithmetic logic unit described in this embodiment is the address of all multiplexers (MUX) in the arithmetic logic unit.

[0072] Furthermore, the instruction memory described in this embodiment can make full use of the on-chip resources of the FPGA, such as the block RAM of Xilinx FPGA or the embedded memory block of Altera FPGA, to save other on-chip reconfigurable hardware resources.

[0073] Furthermore, the lightweight state machine described in this embodiment controls the main state jumps, and the other large number of instructions are all stored in the instruction memory, and are sequentially retrieved and executed by the arithmetic logic unit.

[0074] Preferably, this embodiment can use the parallel computing strategy and the characteristics of the window initial value column K0≠0 to build a recoding window, and by introducing a sign bit, the all-zero sequence Replacing them with equivalent signed sequences significantly reduces the number of clock cycles required for the recoding process while also improving the security flaws of the traditional Comb point product algorithm. Furthermore, the computational form of each window in the proposed low-latency window recoding algorithm is identical. Therefore, only a single recoding window architecture is required, allowing the recoding of all scalars k to be achieved through hardware resource reuse. This improves the computational efficiency of the point product architecture while ensuring extremely high resource utilization.

[0075] When the window size w=4, the schematic diagram of the recoding process of this algorithm is as follows Figure 5 shown.

[0076] The initial scalar matrix K is vertically divided into multiple recoding windows of length l bits. Starting from the first recoding window of the least significant bit and moving towards the most significant bit, recoding is performed window by window. Since each recoding window depends on the initial condition, that is, the initial value column K0≠0, this algorithm introduces staggered bits in the recoding window. The first and last columns of each recoding window are staggered bits, that is, the column numbers of the staggered bits are l-1, 2l-2, and 3l-3, and so on. In the figure, the recoding window is a segment of length l, the staggered bits are gray, and the new scalar numerical matrix K generated after recoding is *, symbol matrix S. The interleaved bit is both the last column generated by the current recoding window and the first column referenced but not modified by the next recoding window. The interleaved bit is directly inherited between two adjacent windows. Furthermore, considering that the proposed low-latency window recoding algorithm does not generate a new all-zero sequence, as long as the initial condition of the first least significant bit encoding window is satisfied, the initial conditions of all subsequent recoding windows are also satisfied.

[0077] After the proposed low-delay window recoding algorithm, the new scalar numerical matrix K * Each column in are all non-all-zero sequences. A 0 in the sign matrix S indicates that the value of the current column is positive, which means a point addition operation is required; a 1 indicates that the value of the current column is negative, which corresponds to a point subtraction operation. For binary domain elliptic curves, the curve equation can be viewed as a quadratic function with respect to y. Considering the ordinates of any point P and its corresponding additive inverse -P, according to Vieta's theorem, the sum of their ordinates is x. That is, for any point P(x,y) on the binary domain elliptic curve, its corresponding additive inverse -P = (x,x+y). Since a point subtraction operation can be viewed as a point addition operation with the additive inverse, regardless of the sign of the current column indicated by the sign matrix S, this chapter handles it by performing a point addition operation to ensure the consistency of the computational data flow. Furthermore, considering that the addition x+y in the binary domain is an additional XOR operation, its computational cost is negligible, so point subtraction and point addition are equally efficient.

[0078] In the low-latency window recoding algorithm, the new scalar numerical matrix K in each recoding window is * The sum symbol matrix S is derived based on the scalar accumulation value f corresponding to each column. Therefore, each recoding window first calculates the scalar accumulation value f of each column in the window (steps 2 to 7). The calculation of the scalar accumulation value f is an iterative bitwise OR operation. Considering its low computational complexity and short path length, this chapter adopts a purely parallel approach and uses a w-input OR gate to complete the calculation of the scalar accumulation value f within one cycle. At the same time, in order to increase the degree of parallelism, l (w-1) input OR gates are placed in the recoding window to work simultaneously, so the results of all scalar accumulation values ​​f in the recoding window can be obtained within one clock cycle. Similarly, the new scalar numerical matrix K in the recoding window * The calculation process of (steps 8 to 15) and the symbol matrix S (steps 16 to 36) also adopts the hardware parallel design scheme, completing all new scalar value matrices K in this window within one cycle * and the computation of the symbolic matrix S. The new scalar numerical matrix K *The scalar value of the current column is determined by the scalar accumulation value f. The generation logic is: if the current column is an all-zero sequence, the scalar value corresponding to the current column will be rewritten as the scalar value of the previous column; on the contrary, if the current column is a non-all-zero sequence, the scalar value corresponding to the previous column will remain unchanged. The first column in each recoding window is the column where the interleaved bit is located, so the new scalar value matrix K * The generation of starts from the second column in the window, and the first column only provides the initial conditions of the window. Similarly, except for the first and last columns, which are the columns where the interleaving bits are located, the symbol matrix S is determined by the scalar accumulated values ​​f of the current column and the next column, so there are four combinations:

[00] ,

[01] ,

[10] , and

[11] (steps 21 to 31). The symbol matrix S of the first column in each window is determined only by the scalar accumulated value f of the second column, and the symbol matrix S of the last column is determined only by the scalar accumulated value f of the last column.

[0079] Preferably, this embodiment improves the traditional Comb multiplication algorithm based on the proposed low-delay window recoding algorithm and proposes a high-performance Comb multiplication algorithm such as Figure 6 shown.

[0080] The high-performance Comb multiplication algorithm includes a pre-computation stage (Pre-computation Stage), a recoding stage (Recoding Stage), a dot product accumulation stage (Accumulation Stage) and a post-processing stage (Post-processing Stage).

[0081] In the pre-calculation phase, based on the base point P, the coordinate values ​​of the points corresponding to all possible combinations in the Comb window are calculated and stored for use in the point multiplication and accumulation phase. In the pre-calculation phase, in steps 3 to 10, continuous doubling operations are first performed, which requires a total of (w-1)d doubling operations. Subsequently, in steps 11 to 16, multiple point addition operations are performed on the results of the specific doubling operations to obtain all possible combinations in the Comb window, which requires a total of (2 w -w-1) point addition operations. Considering that nearly half of the point addition operations can be performed in parallel with the doubling operation, only an additional (2 w -2 w-1 -1) point addition operations can complete all computational tasks in the pre-computation phase. In some elliptic curve cryptographic protocols where the base point P is fixed, such as the public key generation and signature generation phases in elliptic curve cryptographic digital signature protocols, the pre-computation of the high-performance Comb point multiplication algorithm can be completed in advance and the results stored, without occupying the time of the actual point multiplication operation. In this case, the computation speed of subsequent point multiplication operations based on the fixed base point P can be greatly improved.

[0082] Next, consider the window initial condition problem mentioned in the previous low-latency window recoding algorithm. The recoding window initial condition is to ensure that the scalar accumulation value f of the first column of each recoding window is t(l-1) =1. Since interleaved bits can be transferred between recoding windows, it is only necessary to ensure that f0 = 1 is always true regardless of the input scalar k of the high-performance Comb dot product and the selected Comb window size w. Since the input scalar k is external and uncontrollable, and the Comb window size w is determined by the designer according to design requirements, large-scale adjustments based on k and w to ensure f0 = 1 are complex and time-consuming. Therefore, the initial condition f0 = 1 is further simplified to ensure that k0 = 1 always holds for any k and w. In summary, the complex recoding window initial condition problem is transformed into a simple parity problem of the input scalar k. The algorithm provides a solution to this problem as follows: If the input scalar k is an even number, that is, k0 = 0, the dot product operation (k+1)P is calculated. After the dot product operation, a dot subtraction operation (k+1)PP is performed to obtain the correct dot product result kP; if the input scalar k is an odd number, that is, k0 = 1, the input scalar k theoretically meets the initial condition. However, this algorithm still constructs the same computational pattern as when the input scalar k is an even number, thereby improving the proposed high-performance Comb dot multiplication algorithm's resistance to side-channel attacks. In this case, an additional dot multiplication operation (k+2)P is still calculated, and after the dot multiplication, a dot subtraction operation (k+2)P-2P is performed to obtain the correct dot multiplication result kP. It is important to note that 2P is an intermediate result of the continuous dot multiplication process during the pre-computation phase, so no additional computation is required.

[0083] Thanks to the above solutions, the proposed high-performance Comb multiplication algorithm can fully guarantee the initial condition problem of the recoding window at the expense of only one additional point subtraction operation, while also ensuring the design's ability to resist side-channel attacks.

[0084] like Figure 7 As shown, preferably, in order to design a high-performance hardware architecture, this embodiment first needs to analyze the data dependency of the doubling point operation and the mixed point addition operation in the Lopez-Dahab projection coordinate system as shown in the figure to determine the scheduling scheme. In the accumulation phase of the proposed high-performance Comb point multiplication algorithm, each round includes one doubling point operation and one point addition operation, that is, the result of the doubling point operation (X3, Y3, Z3) in the figure is the input of the mixed point addition operation (X1, Y1, Z1). Due to the cascade relationship between the doubling point operation and the mixed point addition operation, the two can be analyzed as a whole. Each round of the accumulation phase includes 12M+10S+12A finite field operations, where M, S and A represent multiplication, square and addition on the finite field, respectively.

[0085] Considering the complexity of finite field multiplication, multiplication takes precedence over other finite field operations in the data dependency analysis process. Figure 7 All multiplications in the are numbered to distinguish them, and each multiplication is specified using representations such as PD_MUL1 and PA_MUL1. Considering the doubling point operation and mixed point addition operation as a whole, the data dependency of the multiplication is analyzed as follows: Figure 8 As shown. The doubling operation costs 4 multiplications, and the point addition operation costs 8 multiplications. The number of multiplications is the same as Figure 7 Keep consistent. It is not difficult to find that the data dependencies This is a critical dependency. Therefore, we prioritize compactly arranging the multiplications in the critical data dependency to ensure that the dependency is fulfilled in the shortest possible time. Furthermore, to improve multiplier utilization and reduce idle multipliers, based on the compact arrangement of the critical data dependency, we schedule the remaining multiplications at other available times.

[0086] For an i-stage pipeline multiplier-accumulator, a set of multipliers is input to the two multiplication ports A and B at the same time in the first clock cycle, and an addend is input to the addition port C in the i-th clock cycle. Then, in the (i+1)th clock cycle, the operation result M=A×B+C can be obtained. Considering the balance between area and speed, this chapter uses a two-stage pipeline architecture multiplier-accumulator and two squarers to achieve a compact implementation. Figure 8 The data dependency of the squarer is given. Since the critical path length of the squarer is short, it is built using pure combinational logic. Based on the above design considerations, a compact scheduling scheme is given as follows: Figure 9 As shown in the figure, in this scheduling scheme, the length of the hardware critical path is also optimized as much as possible. The design principle of this scheduling scheme is to keep the multiplier-accumulator in working state in each clock cycle as much as possible to avoid the occurrence of idle cycles. Finally, this scheduling scheme takes 13 clock cycles per iteration, of which there is only one idle cycle. The modular multiplication and modular square operations corresponding to the doubling point operation and mixed point addition operation enabled in each clock cycle are listed in Figure 9 In the "Finite Field Operations" column, below "MAC" and "SQR", the numbers of the operations are the same as Figure 7 and Figure 8 Stay consistent.

[0087] Key data dependencies Prioritized execution. PD_MUL1, PA_MUL1, PA_MUL2, and PA_MUL5 start computations on the 1st, 3rd, 5th, and 9th clock cycles, respectively, without waiting for any other operations. To avoid excessive idle cycles, the finite field operations corresponding to point doubling and mixed-point addition are interleaved from clock cycles 3 to 6 to ensure the multiplier-accumulator remains operational. Starting from clock cycle 13, operations in bold black font belong to the next round. To maintain a compact scheduling scheme, these operations, originally belonging to the next round, are brought forward to the current round, ensuring data dependencies are met. Furthermore, in Table 4.2, the bracketed values ​​for X3, Y3, and Z3 in clock cycles 8, 11, and 14 indicate that the data at that time is the coordinate value for the current round. It is important to note that the scheduling scheme for the first round differs slightly from that for subsequent rounds, so the first row, "Initialization," in Table 4.2, specifically describes the first round.

[0088] At the end of the dot product, the ITA modular inverse algorithm needs to be run once to complete the coordinate system transformation. In order to increase the utilization of hardware resources, the ITA modular inverse algorithm uses the existing hardware architecture for calculation. This chapter constructs an iterative sequence based on the Brauer addition chain on the binary field. The cost of completing a single modular inverse operation is (m-1) modular square operations and Modular multiplication operation, where H W (m-1) is the Hamming weight of (m-1).

[0089] Preferably, in this embodiment, considering that the hardware implementation platform of this design is Xilinx Virtex-7 series FPGA, k=6. Therefore, for GF(2 163 ) on the KOM architecture multiplier, the delay of each lookup table is D split =2,D CM =3,D align =3 and D MUX =2, so the final lookup table delay result is D tot. =2+3+3+2+1+2=13. Therefore, in order to divide the critical path of the arithmetic logic unit into equal parts, this design inserts a pipeline in the reconstruction step of the KOM architecture multiplier, specifically at the KOM 40 / KOM 41 and KOM 81 / KOM 82 middle.

[0090] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A high-performance Comb point multiplication architecture based on a low-latency window recoding algorithm, characterized by: It includes an LLW re-encoding unit, an arithmetic logic unit, a memory array, a finite state machine, a phase-locked loop module, and an instruction memory; The LLW recoding unit can remove all zero sequences from the input point product scalar k; The arithmetic logic unit executes a high-performance Comb point multiplication algorithm; The memory array is used to store the results pre-calculated by the arithmetic logic unit; The phase-locked loop module is used to provide a clock for a high-performance Comb point multiplication architecture; The instruction memory is used to store the operation instructions of the arithmetic logic unit.

2. The high-performance Comb point product architecture based on the low-latency window recoding algorithm according to claim 1, characterized in that: The LLW re-encoding unit can complete the re-encoding of 1 bit in parallel within one clock cycle.

3. The high-performance Comb point product architecture based on the low-latency window recoding algorithm according to claim 1, characterized in that: The arithmetic logic unit includes three multipliers and two squarers. The input ports of the multipliers and squarers are cascaded to input registers. A multiplexer is cascaded before the multipliers, squarers and input registers to control data selection.

4. The high-performance Comb point product architecture based on a low-latency window recoding algorithm according to claim 3, characterized in that: Both the multiplier-accumulator and squarer are constructed using pure combinational logic circuits based on XOR logic, eliminating the need for additional pipelines. In the squarer, since the squaring logic and modular reduction logic are essentially multi-bit XOR logic, they can be integrated into one, eliminating duplicate XOR logic. During the 3rd, 7th, 10th, and 11th clock cycles, the precalculated results are retrieved from the memory array and sent to the arithmetic logic unit (ALU). Retrieving the corresponding values ​​from the memory array immediately during the clock cycle in which the precalculated results are needed would increase the depth of the combinational logic and create a critical path. To avoid this critical path, the memory array in this design pre-reads the precalculated results one clock cycle in advance. This pre-reading method further optimizes the ALU's critical path. The red dashed line in Figure 4.6 represents the current ALU critical path after the previous series of optimizations. This critical path encompasses the multiplier-accumulator, an adder, and a 5-to-1 multiplexer.

5. The high-performance Comb point product architecture based on a low-latency window recoding algorithm according to claim 3, characterized in that: The core content of the multiplier-adder is a modular multiplier with a parallel architecture. The logic corresponding to modular reduction and modular addition in the modular multiplier-adder can be built using pure combinational logic circuits. As long as the scale of the finite field is given, the circuit architecture corresponding to modular reduction and modular addition can be determined. As the most direct method, parallel polynomial multiplication can be implemented using classical multiplication, and its computational complexity is O(n 2 ), by adopting KOM architecture multiplication instead of classic multiplication, the computational complexity can be reduced from O(n 2 ) is reduced to When m is an even number, an m-bit KOM architecture multiplier contains three (m / 2)-bit sub-multipliers; when m is an odd number, an m-bit KOM architecture multiplier contains one bit sub-multiplier and two As shown in the following formula, a multiplication of m bits can be split into a h b h , a l b l and (a h +a l )(b h +b l ), its expression is as follows; A·B=(a h x n +a l )(b h x n +b l ) =a h b h x 2n +(a l b h +a h b l )x n +a l b l =a h b h x 2n +[(a h +a l )(b h +b l )+a h b h +a l b l ]x n +a l b l Among them, A = a h x n +a l , B=b h x n +b l ; The KOM multiplication splitting strategy can also be applied to sub-multiplications to form a recursive calculation model. However, as the recursive depth level θ increases and the underlying classical multiplier bit width τ decreases ( Where m is the bit width of the KOM architecture multiplication), the total lookup table LUT depth of the modular multiplier-adder is D MAC It is also increasing. Therefore, for a KOM architecture multiplier with a given bit width m, there are area-delay optimal splitting strategies θ and τ; Based on the optimal splitting strategy of KOM architecture multiplication, this chapter conducts a lookup table-level delay analysis on the critical path of KOM architecture multiplier. The multiplier part of the modular multiplier-adder in the logic unit adopts KOM architecture design. Inside the KOM architecture multiplier, there are four steps: splitting, classical multiplication, reconstruction and subtraction and addition, which correspond to D split , D CM , D align and D red&add There are four lookup table stages of delay, so the total delay of the multiplier-accumulator is as follows: D MAC =D split +D CM +D align +D red&add For the split step, the longest split chain consists of 2 θ Input is generated, so the maximum delay of the segmentation step is Where k is the number of input ports of the lookup table in the FPGA. For the classical multiplication step, the maximum lookup table delay of a τ-bit classical multiplier is The reconstruction phase requires a total of θ steps. When k ≥ 4, each step generates a level of lookup table delay, so D align =θ, the last subtraction and addition step in the multiplier-accumulator can be considered as a whole. In GF(2 163 ) based on the elliptic curve parameters and five-term reduction polynomials recommended by NIST, D red&add The maximum value of is 2, and for the entire critical path, the total lookup table delay is: D tot. =D MAC +D add +D MUX Among them, D add =1; and for an s-to-1 multiplexer, the required address width is So the multiplexer can be viewed as a Therefore, the lookup table delay of the s-to-1 multiplexer is 6. The high-performance Comb point product architecture based on a low-latency window recoding algorithm according to claim 1, characterized in that: The operation instruction of the arithmetic logic unit is the address of all multiplexers in the arithmetic logic unit.

7. The high-performance Comb point product architecture based on a low-latency window recoding algorithm according to claim 1, characterized in that: The instruction memory can be built by fully utilizing the on-chip resources of the FPGA to save other on-chip reconfigurable hardware resources.

8. The high-performance Comb point product architecture based on a low-latency window recoding algorithm according to claim 1, characterized in that: The lightweight state machine controls the main state jumps, and other large amounts of instructions are all stored in the instruction memory, and are taken out in sequence and executed by the arithmetic logic unit.

Images