Data processing method and device based on montgomery algorithm and computer device

Abstract

The method comprises: calculating an arithmetic product of a first multiplier Aa and a second multiplier Bb, a first round reduction step and a second round reduction step, wherein: in the arithmetic product step, the multiplication instruction is used to calculate a*b, A*b and a*B, the addition instruction is used to calculate a first accumulated result of the three product results, and the first accumulated result is saved in registers R3, R2, R1 and R0 in the order from the high bit to the low bit; after the first round reduction step is executed, the multiplication instruction is used to calculate the product of A*B, and then the second round reduction step is executed.

Description

Technical Field

[0001] This disclosure relates to, but is not limited to, large number arithmetic techniques in the field of data processing technology, and particularly to a data processing method, apparatus, and computer device based on the Montgomery algorithm. Background Technology

[0002] Zero-knowledge proofs were proposed by S. Goldwasser, S. Micali, and C. Rackoff in the early 1980s. As a highly secure encryption technique, zero-knowledge proofs have broad application prospects in the future field of information transmission. Zero-knowledge proofs involve a large number of finite field calculations, namely addition, subtraction, and multiplication operations bounded by a very large prime number. To simplify the calculation process and eliminate the most complex division and modulo operations, the values ​​are typically transformed from the finite field to the Montgomery field, and the corresponding addition, subtraction, multiplication, and squaring operations are performed within the Montgomery field. Finally, the results are transformed back from the Montgomery field to the corresponding finite field.

[0003] The prime number P in the finite field upon which 384-bit Montgomery modular multiplication (or Montgomery reduction, Montgomery computation) is based cannot exceed half the maximum value of a 384-bit unsigned integer, i.e., P < 0x7FFF...FF (95 Fs). The two multipliers Aa and Bb in the modular multiplication are usually less than P to avoid the result of the modular multiplication going out of bounds and exceeding the register range.

[0004] Montgomery modular multiplication is widely used in elliptic curve point addition calculations, and some fast algorithms exist that allow multipliers exceeding P to continuously participate in modular multiplication calculations. However, if the result of a Montgomery modular multiplication does not exceed 1.5P, but after two consecutive modular multiplications, the result may exceed the register range, leading to an error. This characteristic limits the use of these fast algorithms. Summary of the Invention

[0005] The following is an overview of the subject matter described in detail herein. This overview is not intended to limit the scope of the claims.

[0006] This disclosure provides a data processing method, apparatus, and computer device based on the Montgomery algorithm, which can improve computing performance.

[0007] On one hand, this disclosure provides a data processing method for Montgomery modular multiplication, including: an arithmetic product calculation step for calculating the arithmetic product of a first multiplier and a second multiplier, a first round of reduction steps, and a second round of reduction steps, wherein:

[0008] In the arithmetic product calculation step, the product of the first multiplier and the second multiplier is calculated using multiplication instructions, including: calculating the product of the low-order bits of the first multiplier and the low-order bits of the second multiplier, the product of the high-order bits of the first multiplier and the low-order bits of the second multiplier, and the product of the low-order bits of the first multiplier and the high-order bits of the second multiplier; calculating the first cumulative result of the three product results using addition instructions; and saving the first cumulative result in order from high-order bits to low-order bits into registers R3, R2, R1, and R0.

[0009] After executing the first round of reduction steps, the product of the high-order bits of the first multiplier and the high-order bits of the second multiplier is calculated using a multiplication instruction, and then the second round of reduction steps is executed. The first round of reduction steps is used to reduce the value located in register R0 in the result, and the second round of reduction steps is used to reduce the value located in register R1 in the result.

[0010] The data processing method of this embodiment ensures the continuity of the multiplication pipeline and saves several instruction cycles by delaying the high-order product of the first and second multipliers to be executed before the second round of reduction steps, since the result of the high-order product of the first and second multipliers will not be used immediately. This improves computational performance and efficiency.

[0011] In an exemplary embodiment, the method further includes: after calculating the product of the high-order digits of the first multiplier and the high-order digits of the second multiplier using a multiplication instruction, adding the result of the product to the first accumulated result using an addition instruction, and then performing the second round of reduction steps; or, after calculating the product of the high-order digits of the first multiplier and the high-order digits of the second multiplier using a multiplication instruction, adding the result of the product to the first accumulated result using an addition instruction during the execution of the second round of reduction steps.

[0012] In an exemplary embodiment, the bit length of both the first multiplier and the second multiplier is 384.

[0013] In an exemplary embodiment, the second round of reduction steps includes a step of finding a first intermediate value, wherein a 256-bit multiplication instruction is used to calculate the product of the value in register R1 and the constant Inv as the first intermediate value, wherein the value in register R1 and the constant Inv both have a bit length of 256.

[0014] In an exemplary embodiment, prior to the arithmetic product step, the method further includes mapping the first multiplier and the second multiplier from a finite field to a Montgomery field, wherein the mapping relationship is: multiplying or dividing by 2 to the power of 512.

[0015] On the other hand, this disclosure also provides a data processing method for Montgomery modular multiplication, including: an arithmetic product calculation step for calculating the arithmetic product of a first multiplier and a second multiplier, a first round of reduction steps, and a second round of reduction steps, wherein:

[0016] In the arithmetic product step, the product of the first multiplier and the second multiplier is calculated using multiplication instructions, and the product result is stored in registers R3, R2, R1, and R0 in order from the most significant bit to the least significant bit.

[0017] The first round of reduction steps is performed to reduce the value located in register R0 in the product result;

[0018] The second round of reduction steps is performed to reduce the value in register R1. The second round of reduction steps includes a step of finding a first intermediate value. In the step of finding the first intermediate value, a 256-bit multiplication instruction is used to calculate the product of the value in register R1 and the constant Inv as the first intermediate value. The value in register R1 and the constant Inv both have a bit length of 256.

[0019] The data processing method of this embodiment, by multiplying 256-bit R1 with 256-bit Inv, can narrow the range of the result, making it less prone to overflow in elliptic curve algorithms. Furthermore, it allows the subsequent Montgomery result to be stored in the same way as the input multiplier, eliminating the need for additional shifting operations and improving computational performance.

[0020] In an exemplary embodiment, the second round of reduction steps further includes a step of finding a second intermediate value, which includes calculating the product of the first intermediate value and the prime number P using a 256-bit multiplication instruction to obtain a 640-bit second intermediate value.

[0021] In an exemplary embodiment, the second round of reduction steps further includes an accumulation step, which includes using an addition instruction to calculate the sum of the second intermediate value and the values ​​in registers R3, R2, and R1, so as to reduce the value in register R1.

[0022] In an exemplary embodiment, the bit length of both the first multiplier and the second multiplier is 384.

[0023] In an exemplary embodiment, the process of calculating the higher-order product of the first multiplier and the second multiplier in the arithmetic product step is delayed until before the second round of reduction steps.

[0024] In an exemplary embodiment, the step of calculating the arithmetic product, which involves using multiplication instructions to calculate the product of the first multiplier and the second multiplier, and storing the result in registers R3, R2, R1, and R0, includes:

[0025] The multiplication instruction is used to calculate the product of the low-order bits of the first multiplier and the low-order bits of the second multiplier, the product of the high-order bits of the first multiplier and the low-order bits of the second multiplier, and the product of the low-order bits of the first multiplier and the high-order bits of the second multiplier. The addition instruction is used to calculate the first cumulative result of the three product results. The first cumulative result is saved into registers R3, R2, R1, and R0 in order from the high-order bits to the low-order bits.

[0026] In an exemplary embodiment, the method further includes: after calculating the product of the high-order digits of the first multiplier and the high-order digits of the second multiplier using a multiplication instruction, adding the result of the product to the first accumulated result using an addition instruction, and then performing the second round of reduction steps; or, after calculating the product of the high-order digits of the first multiplier and the high-order digits of the second multiplier using a multiplication instruction, adding the result of the product to the first accumulated result using an addition instruction during the execution of the second round of reduction steps.

[0027] Furthermore, this disclosure also provides a data processing apparatus for Montgomery modular multiplication calculation, used to implement the Montgomery modular multiplication calculation described in any of the foregoing embodiments. The data processing apparatus includes: an instruction register, an instruction decoder, a register file, and an arithmetic logic unit, wherein:

[0028] The instruction register is configured to store instruction sets to be executed. The instruction sets include a first instruction set for calculating the arithmetic product of the first multiplier and the second multiplier, a second instruction set for performing a first round of reduction, and a third instruction set for performing a second round of reduction.

[0029] The instruction decoder is configured to read instructions from the instruction register and decode them, generate corresponding control signals to control the data in the register file to be connected to the arithmetic logic unit through the data path for arithmetic operations, and store the results of the arithmetic logic unit operations into the corresponding registers through the data path.

[0030] The register file includes multiple registers configured to store the results of arithmetic calculations.

[0031] The arithmetic logic unit is configured to perform arithmetic operations, including multiplication and addition.

[0032] In an exemplary embodiment, the data processing apparatus further includes: an instruction cache, a data cache, a static random access memory (SRAM), and a dynamic random access memory (DRAM), wherein:

[0033] The instruction cache is configured to cache instructions that are about to be executed in order to improve the access speed of instructions;

[0034] The data cache is configured to cache frequently used data in order to improve data access speed;

[0035] The static random access memory is configured to store and access intermediate data.

[0036] The dynamic random access memory is configured to store the data to be calculated.

[0037] In another aspect, embodiments of this disclosure also provide a computer device, including a processor and a memory storing a computer program executable on the processor, wherein the processor executes the program to implement the steps of the data processing method based on Montgomery modular multiplication calculation of any of the foregoing embodiments.

[0038] After reading and understanding the accompanying diagrams and detailed descriptions, the other aspects can be understood. Attached Figure Description

[0039] The accompanying drawings are provided to further understand the technical solutions of this disclosure and constitute a part of the specification. They are used together with the embodiments of this disclosure to explain the technical solutions of this disclosure and do not constitute a limitation on the technical solutions of this disclosure.

[0040] Figure 1 This is a Montgomery calculation flowchart;

[0041] Figure 2 This is a flowchart of the Montgomery calculation process according to an embodiment of this disclosure;

[0042] Figure 3 for Figure 2 A diagram illustrating the process of finding the arithmetic product using Chinese arithmetic multiplication.

[0043] Figure 4 for Figure 2 A flowchart illustrating the process of the first round of reductions in China;

[0044] Figure 5 for Figure 2 A diagram illustrating the process of the second round of reduction;

[0045] Figure 6 for Figure 1 The calculations shown by Montgomery and Figure 2 The diagram shows a comparison of instruction cycles calculated by Montgomery.

[0046] Figure 7 for Figure 1 The calculations shown by Montgomery and Figure 2 The diagram shows a comparison of instruction dependency paths in Montgomery's computation.

[0047] Figure 8A This is a schematic diagram of an apparatus for executing the Montgomery algorithm of this embodiment;

[0048] Figure 8B This is a schematic diagram of another device for executing the Montgomery algorithm of this embodiment. Detailed Implementation

[0049] This disclosure describes several embodiments, but these descriptions are exemplary and not limiting, and it will be apparent to those skilled in the art that many more embodiments and implementations are possible within the scope of the embodiments described herein. Although many possible combinations of features are shown in the drawings and discussed in detail, many other combinations of the disclosed features are also possible. Unless specifically limited, any feature or element of any embodiment may be used in combination with, or may replace, any feature or element of any other embodiment.

[0050] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0051] The terms "first" and "second," etc., used in this disclosure and its accompanying drawings are intended to distinguish different objects or different treatments of the same object, and not to describe a particular order of objects. It should be understood that such use of data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein.

[0052] Before performing a Montgomery calculation, the numbers to be calculated are first mapped to a Montgomery field through an additional transformation, which can help improve computational efficiency. In a 384-bit Montgomery calculation, the multiplier to be calculated is typically multiplied or divided by 2 to the power of 256 (a Montgomery field). This Montgomery calculation includes at least arithmetic multiplication to find the arithmetic product, an initial calculation, and a subsequent calculation, such as... Figure 1 As shown, the two multipliers are Aa and Bb. The first multiplier Aa consists of the lower 256 bits of 'a' and the higher 128 bits of 'A', totaling 384 bits. The second multiplier Bb consists of the lower 256 bits of 'b' and the higher 128 bits of 'B', also totaling 384 bits. After calculating the arithmetic product of Aa and Bb, a 768-bit integer is obtained and stored in registers R2R1R0, each register being 256 bits. R2 stores the higher 256 bits, R1 stores the middle 256 bits, and R0 stores the lower 256 bits. The 768-bit result is represented by R2R1R0. After completing the above arithmetic multiplication, the subsequent Montgomery multiplication generally includes a first round of reduction (or initial reduction) and a second round of reduction (or secondary reduction).

[0053] The first round of reduction involves multiplying the lower 256 bits of R0 in the 768-bit array by a fixed parameter Inv. Inv represents the modulo inverse, i.e., the reciprocal of the modulus p. This parameter is related to the mapping between the real number field and the Montgomery field. In this example, this parameter is 2 to the power of 256, which was used in the aforementioned conversion to the Montgomery field. The result of the multiplication is stored as Tt, where T stores the high 256 bits and t stores the low 256 bits, where T can be ignored. Figure 1 Chinese (The filled box indicates that it can be ignored). Multiply the 512-bit prime number P corresponding to the finite field by the lower 256 bits of t. Since the 384th to 511th bits of P are 0, the P involved in the calculation includes P_H and P_L, where P_L is the lower 256 bits of P and P_H is the higher 128 bits of P. The intermediate process is the sum of a 512-bit n_Hn_L and a 384-bit number N_HN_L with a 256-bit error, and the result is a 640-bit N_n. Next, add the newly obtained 640-bit N_n to the previously obtained 768-bit R2R1R0. The result is represented as R2'R1'R0' (still stored in R2R1R0), where R2' represents the high 256 bits, R1' represents the middle 256 bits, and R0' represents the low 256 bits. Based on the Montgomery algorithm, the low 256 bits of R0' must be 0. Therefore, the result of the first round of reduction is 512-bit R2'R1'. The first round of reduction is now complete, reducing 768-bit R2R1R0 to 512-bit R2'R1'. The second round of reduction is then performed, with the ultimate goal of obtaining a 384-bit number.

[0054] In the second round of reduction, the lower 128 bits of the 512-bit number R2'R1'—R1'_L—are multiplied by the lower 128 bits of the parameter Inv—Inv_L, resulting in a 256-bit result T't'. T' is then ignored, and only the lower 128 bits of t' are used in subsequent calculations. The 128-bit t' is multiplied by the 384-bit prime number P corresponding to the finite field, where P_L is the lower 256 bits of P and P_H is the higher 128 bits of P. The intermediate process involves the sum of a 384-bit number n_H'n_L' and a 256-bit number N_H'N_L', with a 256-bit difference, resulting in the 512-bit number N_n'. Finally, add the 512-bit N_n' obtained earlier to the result of the first round of reduction, which is 512-bit R2' R1', resulting in R2''R1''. Based on the Montgomery algorithm, the lower 128 bits of the result, i.e., the lower 128 bits of R1'', must be 0. Therefore, the result of the second round of reduction is 256-bit R2'' and the higher 128 bits of R1''—R1''_H, for a total of 384 bits.

[0055] As can be seen from the algorithm above, the initial result of the arithmetic multiplication is a 768-bit R2R1R0, with a maximum value not exceeding 0x3FFF..F (95 F's). Then, in the first round of reduction, the arithmetic product is added to a 640-bit number N_n, resulting in R2'R1'R0'. Since R0' is 0, only R2'R1' is taken, so after the first round of reduction, the value changes from 768 bits to 512 bits. Next, in the second round of reduction, the 512-bit R2'R1' is added to a 512-bit N_n', resulting in R2''R1''. Since the lower 128 bits of R1'' are 0, this is equivalent to shrinking R2''R1'' by 128 bits, becoming R2'R1''_H, which is a 384-bit result. N-n' is P multiplied by a 128-bit number. The result will not exceed P, i.e., it will not exceed 0x7FFF...FF (95 F's). The maximum value of the sum of the two will not exceed 1.5 times P. However, after two consecutive modular multiplications, the result of the modular multiplication may go out of bounds, leading to an error that exceeds the register range.

[0056] Furthermore, when calculating Montgomery multiplication of 384-bit numbers, as we know from the previous calculation process, although the calculation involves 384-bit integers, it uses 256-bit registers. Therefore, two 256-bit registers are typically used to represent a 384-bit number, with the lower 256 bits occupying one 256-bit register and the higher 128 bits occupying the lower 128 bits of the other 256-bit register. However, in subsequent calculations, a consecutive 768-bit number may appear (such as R2R1R0 in the previous example), which occupies three 256-bit registers. After Montgomery reduction, the lower 384 bits of the 768-bit number are reduced to 0, leaving the higher 384 bits (i.e., R2''R1''_H in the previous example) as the result. At this point, the higher 256 bits of this higher 384 bits occupy one 256-bit register, while the lower 128 bits occupy the higher 128 bits of the other 256-bit register. At this point, a shift operation is needed to adjust the storage format of the 384-bit number to match that of the input multiplier. The shift operation includes: shifting the lower 128 bits of the 384-bit number right by 128 bits, storing it in the lower 128 bits of a 256-bit register; shifting the middle 128 bits of the 384-bit number left by 128 bits, storing it in the upper 128 bits of the 256-bit register, and then combining it with the lower 128 bits of the 384-bit number to form a complete 256-bit number; finally, shifting the upper 128 bits of the 384-bit number right by 128 bits, storing it in the lower 128 bits of the 256-bit register, and using this as the upper 128 bits of the new 384-bit number. It can be seen that this shift operation requires four assembly instructions, resulting in a performance penalty of approximately 10% for a single Montgomery modular multiplication.

[0057] Furthermore, the inventors discovered that, since the second round of reduction to find t' requires waiting for the result of the first round of reduction and accumulation, if the following method is used... Figure 1 The calculation process shown results in a waste of at least three instruction cycles. For example... Figure 6The instruction cycle flow on the left shows the instruction cycles. The numbers in the diagram represent instruction cycles. The left side of the instruction cycle displays multiplication instructions, and the right side displays addition instructions. When there is no dependency, these instructions can be executed in parallel to improve computational efficiency. In the diagram, the gfmul multiplication instruction in instruction cycles 37-42 is used to calculate n=t*P_L (meaning multiplying t by P_L and storing the result in n). The gfADD addition instruction in instruction cycles 43-45 is used to calculate R1R0+=n (meaning adding R1R0 to n and storing the result in R1R0). The gfmul multiplication instruction in instruction cycles 46-51 is used to calculate t= R1*Inv (meaning multiplying R1 by Inv and storing the result in t). It can be seen that the gfADD addition instruction depends on the calculation result of the preceding gfmul multiplication instruction, and the subsequent gfmul multiplication instructions depend on this gfADD addition instruction. As a result, instruction cycles 43-45 only perform addition calculations, interrupting the multiplication pipeline and causing a decrease in multiplication performance.

[0058] To address this, the inventors devised two solutions. First, all 384-bit numbers can be directly treated as 512-bit numbers, using a 256-bit architecture for Montgomery modular multiplication of 512-bit numbers. The theoretical computational cost remains unchanged, yet the result range is smaller, preventing it from exceeding register limits. This is more beneficial for subsequent elliptic calculations and avoids subsequent shift operations, resulting in better performance. Second, the calculation of the high-order product of the first and second multipliers in the arithmetic product step can be delayed until the instruction cycle interrupted by the multiplication pipeline. This ensures the continuity of the multiplication pipeline, improving the speed and efficiency of multiplication operations. These will be described in detail below.

[0059] On the one hand, the data processing method for Montgomery modular multiplication provided in this embodiment includes: an arithmetic product calculation step for calculating the arithmetic product of the first multiplier and the second multiplier, a first round of reduction steps, and a second round of reduction steps, wherein:

[0060] In the arithmetic product calculation step, the product of the first multiplier and the second multiplier is calculated using multiplication instructions, including: calculating the product of the low-order bits of the first multiplier and the low-order bits of the second multiplier, the product of the high-order bits of the first multiplier and the low-order bits of the second multiplier, and the product of the low-order bits of the first multiplier and the high-order bits of the second multiplier; calculating the first cumulative result of the three product results using addition instructions; and saving the first cumulative result in order from high-order bits to low-order bits into registers R3, R2, R1, and R0.

[0061] After executing the first round of reduction steps, the product of the high-order bits of the first multiplier and the high-order bits of the second multiplier is calculated using a multiplication instruction, and then the second round of reduction steps is executed. The first round of reduction steps is used to reduce the value located in register R0 in the result, and the second round of reduction steps is used to reduce the value located in register R1 in the result.

[0062] Since the result of the high-order product of the first and second multipliers is not used immediately, by delaying this process until before the second round of reduction steps, the continuity of the multiplication pipeline can be guaranteed, and several instruction cycles can be saved, thereby improving computational performance and efficiency.

[0063] The "value in the register in the reduction result" mentioned above refers to a series of intermediate calculations that make the lower-order value (the value in the register) 0, so that it can be ignored.

[0064] For example, the first multiplier is Aa, where A is the high-order digit and a is the low-order digit; the second multiplier is Bb, where B is the high-order digit and b is the low-order digit. In the arithmetic product step, the multiplication instruction is used to calculate the result of a*b, the result of A*b, and the result of a*B. However, at this time, the high-order product A*B of the first multiplier Aa and the second multiplier Bb is not calculated, and the process of calculating the high-order product of A*B is delayed until before the second round of reduction steps.

[0065] In the arithmetic product calculation step, after the multiplication instruction is used to calculate the result of a*b, the result of A*b and the result of a*B, the addition instruction is used to calculate the first cumulative result of the result of a*b, the result of A*b and the result of a*B. The first cumulative result is stored in registers R3, R2, R1 and R0 in order from the most significant bit to the least significant bit, where R3 stores the most significant bit and R0 stores the least significant bit. Then, the first round of reduction steps is executed to reduce the value in register R0 in the result; after calculating the product of the high-order A of the first multiplier and the high-order B of the second multiplier using a multiplication instruction, the result of the product is added to the aforementioned first accumulation result using an addition instruction, and then the second round of reduction steps is executed; or, during the execution of the second round of reduction steps, the result of the product is added to the aforementioned first accumulation result using an addition instruction. Since the value in register R0 has been reduced after the first round of reduction, the accumulation result is stored in registers R3, R2, and R1; the second round of reduction is used to reduce the value in register R1 in the result.

[0066] In the above embodiment, the bit length of both the first and second multipliers is 384, that is, the bit lengths of A and B are both 128, and the bit lengths of a and b are both 256. This means the above method can achieve Montgomery calculations using two 384-bit multipliers. The high-order bits of the first and second multipliers refer to the high 128 bits.

[0067] In an exemplary embodiment, the second round of reduction steps includes a step of calculating a first intermediate value. In this step, a 256-bit multiplication instruction is used to calculate the product of the value in register R1 and the constant Inv as the first intermediate value. Both the value in register R1 and the constant Inv have a bit length of 256. By using 256 bits of R1 and 256 bits of Inv for multiplication, the subsequent Montgomery result can be stored in the same way as the input multiplier, eliminating the need for additional shift operations and improving computational performance.

[0068] To implement the above method, before the arithmetic product step, the method further includes: mapping the multiplier to be calculated from a finite field to a Montgomery field, with the mapping relationship being: multiplying or dividing by 2 to the power of 512.

[0069] On the other hand, this disclosure also provides a data processing method for Montgomery modular multiplication, including: an arithmetic product calculation step for calculating the arithmetic product of a first multiplier and a second multiplier, a first round of reduction steps, and a second round of reduction steps, wherein:

[0070] In the arithmetic product step, the product of the first multiplier and the second multiplier is calculated using a multiplication instruction, and the result is stored in registers R3, R2, R1, and R0 in order from the most significant bit to the least significant bit, where R3 stores the most significant bit and R0 stores the least significant bit.

[0071] The first round of reduction steps is performed to reduce the value located in register R0 in the product result;

[0072] The second round of reduction steps is performed to reduce the value in register R1 in the product result. The second round of reduction steps includes a step of finding a first intermediate value. In the step of finding the first intermediate value, a 256-bit multiplication instruction is used to calculate the product of the value in register R1 and the constant Inv as the first intermediate value. The value in register R1 and the constant Inv both have a bit length of 256.

[0073] By multiplying the 256-bit R1 with the 256-bit Inv, the range of the result can be narrowed, which is less likely to overflow in elliptic curve algorithms. Furthermore, the subsequent Montgomery result can be stored in the same way as the input multiplier, without the need for additional shifting operations, thus improving computational performance.

[0074] In an exemplary embodiment, the second round of reduction steps further includes a step of finding a second intermediate value, which includes using a 256-bit multiplication instruction to calculate the product of the first intermediate value t and the prime number P to obtain a 640-bit second intermediate value.

[0075] In an exemplary embodiment, the second round of reduction further includes an accumulation step, which involves using addition instructions to calculate the sum of the second intermediate value and the values ​​in registers R3, R2, and R1, thereby reducing the value in register R1. After the first round of reduction, the value in R0 is reduced, and the value in R1 becomes the low-order bit. After the second round of reduction, the value in R1 is reduced, the 256-bit value in R2 is the lower 256 bits of the 384-bit result, and the lower 128 bits in R3 are the higher 128 bits of the 384-bit result. This storage method is the same as the storage method of the multiplier, eliminating the need for additional shift operations and improving computational performance.

[0076] For example, the bit length of both the first multiplier and the second multiplier is 384, that is, the first multiplier is Aa, where A is the high bit and a is the low bit, and the second multiplier is Bb, where B is the high bit and b is the low bit. The bit length of A and B is 128, and the bit length of a and b is 256.

[0077] In an exemplary embodiment, the calculation of the higher-order product of the first and second multipliers in the arithmetic product step can be delayed until before the second round of reduction steps. This ensures the continuity of the multiplication pipeline and improves the speed and efficiency of multiplication operations.

[0078] For example, in the step of calculating the arithmetic product, multiplication instructions are used to calculate the product of the lower digit of the first multiplier and the lower digit of the second multiplier a*b, the product of the higher digit of the first multiplier and the lower digit of the second multiplier A*b, and the product of the lower digit of the first multiplier and the higher digit of the second multiplier a*B. Addition instructions are used to calculate the first accumulated value of the three product results: a*b, A*b, and a*B. The first accumulated value is stored in registers R3, R2, R1, and R0 in order from the higher digit to the lower digit, where R3 is used to store the highest digit and R0 is used to store the lowest digit.

[0079] In an exemplary embodiment, after calculating the product of the high-order digits of the first multiplier and the high-order digits of the second multiplier using a multiplication instruction, the result of the product is added to the first accumulated result using an addition instruction, and then the second round of reduction steps is executed; or, after calculating the product of the high-order digits of the first multiplier and the high-order digits of the second multiplier using a multiplication instruction, during the execution of the second round of reduction steps, the result of the product is added to the first accumulated result using an addition instruction.

[0080] In this embodiment, the mapping relationship used when performing Montgomery domain mapping is: multiplying or dividing by 2 to the power of 512.

[0081] The method described in this disclosure can perform Montgomery modular multiplication not only for 384-bit numbers, but also for other binary numbers such as 128-bit or 512-bit numbers. Multiple reductions can be performed, as long as the total number of bits reduced reaches or exceeds the number of bits in the multiplier. In this example, two rounds of reduction are performed, each reducing 256 bits. In other examples, two rounds of reduction can be performed, one reducing 256 bits and the other 128 bits, or three rounds of reduction can be performed, each reducing 128 bits.

[0082] As can be seen, the two data processing methods for Montgomery modular multiplication described above can be combined. The following application example will illustrate these methods in detail. (See [link to relevant documentation]). Figure 2 The two multipliers are Aa and Bb. The first multiplier Aa consists of the lower 256 bits of 'a' and the higher 128 bits of 'A', totaling 384 bits. The second multiplier Bb consists of the lower 256 bits of 'b' and the higher 128 bits of 'B', also totaling 384 bits. The entire modular multiplication operation includes:

[0083] First, the numbers to be calculated (Aa and Bb) are mapped to a Montgomery field through an additional transformation. In this example, the multiplier to be calculated is multiplied or divided by 2 to the power of 512.

[0084] Montgomery's calculations at least include arithmetic multiplication to find the arithmetic product, first round of reduction, and second round of reduction, such as Figure 2 As shown, after calculating the arithmetic product of Aa and Bb using arithmetic multiplication, a 768-bit integer is obtained and stored in registers R2R1R0. Each register is 256 bits, where R2 is used to store the high 256 bits of the 768 bits, R1 is used to store the middle 256 bits of the 768 bits, and R0 is used to store the low 256 bits of the 768 bits. The 768-bit result is represented by R2R1R0.

[0085] The first round of reduction includes two intermediate value calculations and one accumulation. The first intermediate value calculation is used to calculate t, and the second intermediate value calculation is used to calculate N_n. In the process of calculating t, the lower 256 bits of R0 in the 768-bit array are multiplied by a fixed parameter Inv. Inv represents the modulo inverse, i.e., the reciprocal of the modulus p. This parameter is related to the mapping relationship between the real number field and the Montgomery field. In this example, this parameter is 2 to the power of 512 used in the aforementioned Montgomery field conversion. The result of multiplying R0 and Inv is stored as Tt, where T stores the higher 256 bits (which can be ignored, used in the diagram). The lower 256 bits of t are stored. In calculating N_n, the lower 256 bits of t are multiplied by the 512-bit prime number P (P_HP_L) corresponding to the finite field. Since bits 384-511 of P are 0, the P involved in subsequent calculations includes the lower 256 bits of P_L and the higher 128 bits of P_H, totaling 384 bits. The result of multiplying t by P_L is 512 bits of n_Hn_L, where n_H represents the higher 256 bits and n_L represents the lower 256 bits. The result of multiplying t by P_H is 512 bits of N_HN_L, where N_H represents the higher 256 bits and N_L represents the lower 256 bits. Since the higher 128 bits of the 256-bit N_H are 0, the lower 256 bits of N_L and the higher 128 bits of N_H are involved in subsequent calculations, totaling 384 bits. The 512-bit n_Hn_L and the 384-bit N_HN_L are added together with a 256-bit increment, resulting in a 768-bit N_n. Since the high 128 bits of N_n are 0, the N_n used in subsequent calculations is 640 bits. The obtained 640-bit N_n is added to the previously obtained 768-bit R2R1R0, and the result is represented as R2'R1'R0' (still stored in R2R1R0), where R2' represents the high 256 bits, R1' represents the middle 256 bits, and R0' represents the low 256 bits. Based on the Montgomery algorithm, the low 256 bits of R0' must be 0. Therefore, the result of the first round of reduction is 512-bit R2'R1'. Thus, the first round of reduction is completed, reducing the 768-bit R2R1R0 to 512-bit R2'R1'. The next step is to perform a second round of reduction, with the ultimate goal of obtaining a 384-bit number.

[0086] The second round of reduction includes two intermediate value calculations and one accumulation. The first intermediate value calculation is used to calculate t', and the second intermediate value calculation is used to calculate N_n'. In calculating t', the entire 256 bits of R1' are multiplied by the 256-bit parameter Inv to obtain a 768-bit T't'. T' is ignored, and only the lower 256 bits of the result are used as t' for subsequent calculations. In calculating N_n', the 256-bit t' is multiplied by the 512-bit prime number P. Since bits 384-511 of P are 0, the P involved in the calculation includes the lower 256 bits P_L and the higher 128 bits P_H, totaling 384 bits. Multiplying the 256-bit t' by the 256-bit P_L yields the 512-bit n_H'n_L', where n_H' represents the high 256 bits and n_L' represents the low 256 bits. Multiplying the 256-bit t' by the 128-bit P_H yields the 512-bit N_H'N_L', where N_H' represents the high 256 bits and N_L' represents the low 256 bits. Since the high 128 bits of the 256-bit N_H' are 0, the low 256 bits of N_L' and the high 128 bits of N_H' are used in subsequent calculations, totaling 384 bits. The 512-bit n_H'n_L' and the 384-bit N_H'N_L' are added with a 256-bit offset, resulting in the 768-bit N_n'. Since the high 128 bits of N_n' are 0, the 640-bit N_n' is used in subsequent calculations. Add the obtained 640-bit N_n' to the result of the first round of reduction, which is 512-bit R2'R1', to get R3R2''R1''. Based on the Montgomery algorithm, the lower 128 bits of R1'' must be 0 at this time. Therefore, the result of the second round of reduction is 128-bit R3 and 256-bit R2'', totaling 384 bits of data, which is used as the result of this calculation.

[0087] In this example, during the second round of reducing t', multiplying the entire 256 bits of R1' by the 256 bits of the parameter Inv makes the result more regularized, improving computational performance. Figure 1 As can be seen, in Montgomery's calculation result R2''R1''_H, the high 256 bits R'' are stored in the 256-bit high register R2, and the low 128 bits R1''_H are stored in the high 128 bits of the low register R1. This result requires the aforementioned shift operation to adjust this storage method. In contrast, from Figure 2As can be seen, in the Montgomery calculation result R3R2'' obtained by adjusting in this embodiment, the high 128 bits of R3 are stored in the low 128 bits of register R3, and the low 256 bits are stored in register R2, which is the same as the storage method of the input multiplier. No shifting operation is required, which can improve the performance by about 10%.

[0088] In this example, during the second round of reducing t', multiplying the entire 256 bits of R1' by the 256 bits of the parameter Inv narrows the range of the result, preventing overflow in elliptic curve algorithms. Figure 1 In the algorithm, the result ranges from [0, 1.5P). According to the 512-bit Montgomery algorithm in this embodiment, the final result of the second round of calculation is also obtained by adding the high half of the initial arithmetic multiplication and the final calculated N_n'. The difference is that the high 128 bits of the final result are all composed of N_n', which is obtained by multiplying P by a 256-bit number (t'). Therefore, the maximum value of N_n' will not exceed 0x7FFF...FF (95 Fs). The maximum value provided at R2'R1' will not exceed 1 / 2^128 of P, so the range of the summed result is between [0, (1+2^(-128))P). This range is very friendly to continuous modular multiplication and can well support the fast algorithm of elliptic curve point addition, avoiding continuous modular multiplication overflow.

[0089] The detailed explanation is as follows: If only the theoretical maximum value is considered, Aa and Bb are both 0x7FF...FF (95 Fs). Then, in the arithmetic product R2R1R0, R2 is 0x3FF...FF, R1 is 0xFF...FF, and R0 is 0xFF...FF. In the initial round of summation and subtraction, in the R2'R1' obtained by adding with N_n, the maximum value of R2' is 0x3FF...FF, and the maximum value of N_n is 0x7FF...FF. Figure 1 The method shown adds the 512-bit R2'R1' to the 512-bit N_n, and the maximum value of the result is 0x3FF...FF + 0x7FF...FF, which is more than 50% outside the acceptable range. Figure 2 The method shown adds the 512-bit R2'R1' to the 640-bit N_n', and the maximum value of the result is 0x7FF...FF+0x00003FF...FF, which only exceeds the range of 0x00003FF...FF. Therefore, when using the Montgomery algorithm in this embodiment for calculation, the probability of exceeding the range is very small.

[0090] Based on the above, the Montgomery algorithm will be explained step by step. The method includes four steps.

[0091] In the following text, gfmul is a 256-bit multiplication instruction, gfadd is a 256-bit addition instruction, gfADD is a 512-bit addition instruction, gfadc is a 256-bit addition instruction with carry, gfADC is a 512-bit addition instruction with carry, and gfadci represents a 256-bit immediate addition instruction with carry, indicating the addition of the addend in the register and the immediate value in the instruction. In the addition instructions, uppercase letters represent 512-bit addition, and lowercase letters represent 256-bit addition. gf is an abbreviation for "Galois Fields," and adc is an abbreviation for "add with Carry."

[0092] Step 1: Calculate the arithmetic multiplication of 384-bit multipliers Aa and Bb to obtain a 640-bit product R2R1R0 (temporarily skip the high-order bits A * B).

[0093] Figure 3 for Figure 2 The diagram illustrates the process of calculating the arithmetic product using arithmetic multiplication. The left side of the diagram shows the multiplication or addition expression, the right side represents registers, and the arrows indicate the corresponding computer instructions. The parameters R0, R1, R2, R3, R1', R2', R1'', and R2'' represent the calculation result. However, R1, R1', and R1'' use the same register R1, and similarly, R2, R2', and R2'' use the same register R2.

[0094] Step 1.1: Multiplying multipliers Aa and Bb requires calculating a*b, A*b, a*B, and A*B. In this example, A*B is calculated later; only a*b, A*b, and a*B are calculated here. Figure 3 It is evident that three multiplication operations (three multiplication instructions gfmul) are required to obtain three products. The lower 256 bits of the result of a*b are R0, and the higher 256 bits are represented as a*b_H; the lower 256 bits of the result of A*b are represented as A*b_L, and the higher 256 bits are represented as A*b_H; the lower 256 bits of the result of a*B are represented as a*B_L, and the higher 256 bits are represented as a*B_H.

[0095] The three product results obtained in steps 1.2 and 1.1 are summed sequentially, as follows: Figure 3As shown, two addition calculations are required (two addition instructions `gfADD`), where `gfADD` represents a 512-bit addition. The first addition instruction adds R3R2R1R0 to the result of A*b. Since the result of A*b is located in bits 256-767, only the 512-bit addition instruction `gfADD` is needed to add R2R1 to A*b_HA*b_L, resulting in R3R2'R1'R0, meaning only registers R2 and R1 are updated. Similarly, adding R3R2'R1'R0 to the result of a*B can also be done using the 512-bit `gfADD` instruction, resulting in R3R2''R1''R0. Numerically, the sum of the three product results is 640 bits; in terms of register usage, it occupies 768 bits, with R3 being 0 at this point. The `reset` instruction in the diagram represents initializing the registers used by R2 and R3 to 0.

[0096] Step 2, the first round of reduction: calculate R0 * Inv * P (stored in Modulus), obtain the accumulated values ​​N and n, accumulate them to R1 and R0, and then reduce to R0 (meaning that after the first round of reduction, the lower 256 bits of R0 are all 0, which can be ignored), and during this period, calculate the value of A*B in the high bits of the original multiplier.

[0097] Figure 4 for Figure 2 The process of the first round of reductions in China, in Figure 4 In the diagram, the left side represents multiplication or addition equations, and the right side indicates registers. The arrows point to the corresponding computer instructions. R0 and R0' use register R0, R1'', R1''', and R1'''' use the same register R1, and R2'' and R2''' use the same register R2. The registers simply store different values ​​at different times. Modulus is the register used to store the prime number P. Low and High are temporary registers. This first round of reduction involves four multiplication operations (four multiplication instructions `gfmul`) and three addition operations (four addition instructions).

[0098] Step 2.1, first round of reduction to find t. The first multiplication operation is used to calculate the result of multiplying R0 and parameter Inv. Ignore the high-order T in the result and store the low-order t in register Low.

[0099] Step 2.2: In the first round of reduction, calculate N_n by multiplying t by the prime number P. The prime number P is stored in the Modulus register. The value of P includes the high-order byte P_H and the low-order byte P_L. Therefore, two multiplication instructions gfmul are needed to calculate t*P_L and t*P_H respectively. The result n of t*P_L (including n_H and n_L) is stored in the Low register, and the result N of t*P_H (including N_H and N_L) is stored in the High register.

[0100] Step 2.3, the first round of reduction and accumulation, is achieved through two additions. The first addition adds the result obtained in step one (R3R2''R1''R0) to the value in register High, resulting in R3R2'''R1'''R0, implemented using a 512-bit addition instruction gfADD. The second addition adds R3R2'''R1'''R0 to the value in register Low, resulting in R3R2'''R1''''R0'. In this example, it is implemented using a 512-bit addition instruction gfADD and a 256-bit carry addition instruction gfadci. The addition instruction gfadci is used to add the result of gfADD to an immediate value (e.g., 0), so as to add the carry generated in the previous addition to the current result.

[0101] Step 2.4: After completing the first round of reduction and accumulation, calculate A*B using a multiplication instruction gfmul. Since the high-order bit A*B_H of A*B is 0, only the 256-bit result A*B_L needs to be stored in a temporary register (represented by A*B in the figure).

[0102] In this example, the high-order byte calculation A*B of Aa and Bb is not performed in step 1.1, but is instead placed in step 2. This ensures the continuity of the multiplication pipeline. Multiplication and addition instructions can be executed in parallel when there is no dependency, but since the subsequent round of subtraction to calculate t' requires waiting for the result of the initial subtraction and accumulation, if... Figure 1 The calculation process shown results in a waste of 3 instruction cycles, while using... Figure 2 The illustrated process ensures the continuity of multiplication and saves at least 3 instruction cycles. See details. Figure 6 On the other hand, it can reduce the carry-over during the accumulation process. Normally, when calculating the addition of 768-bit numbers, the carry-over generated after the calculation of the lower bits needs to be passed to the higher bits through the addition instruction each time. However, in this example, as mentioned earlier, the probability of the higher bits being out of range is very small. Therefore, the carry-over of the lower bits can be passed up when the higher bits are being added, thereby saving the addition instructions.

[0103] In other exemplary embodiments, the above-described step of calculating A*B can also be performed at the beginning of step three below, i.e., before step 3.1.

[0104] Step 3, the second round of reduction: calculate R1*Inv*P, obtain the accumulated values ​​N and n, accumulate them to R2 and R1, and thus reduce to R1. During this period, the value of A*B in the high bits of the original multiplier is accumulated to R2 and R3.

[0105] Figure 5 for Figure 2 The process of the second round of reduction, in Figure 5 In the diagram, the left side represents the multiplication or addition equation, and the right side indicates the registers. The arrows point to the corresponding computer instructions. The usage of registers R1, R2, and R3 is the same as before and will not be repeated here. This round of reduction includes three multiplication operations (three multiplication instructions gfmul) and three addition operations (four addition instructions).

[0106] Step 3.1: After obtaining the result of A*B in step two, a 256-bit addition instruction gfadc is used to add the result of A*B to the values ​​in registers R1, R2, and R3 (R3R2'''R1'''', R0' is 0 and ignored). The gfadc addition instruction can add the carry generated in the previous addition to the current result. In this step, since A*B_L is aligned to R2''', a 256-bit gfadc addition instruction is sufficient, eliminating the need for a 512-bit addition instruction, thus reducing the operation time by one clock cycle. The result obtained is R3R2''''R1''''.

[0107] Step 3.2, in the second round of reduction to obtain t', calculate the product of R1'''' and parameter Inv, which requires a multiplication instruction gfmul, and the result is T't'. Ignore the high-order bits and store the low-order bits t' in the temporary register Low.

[0108] Step 3.3: In the second round, reduce N_n' and calculate the product of t' and the prime number P. The prime number P is stored in the Modulus register. The value of P includes the high-order byte P_H and the low-order byte P_L. Two multiplication instructions gfmul are required to calculate t'*P_L and t'*P_H respectively. The result n' of t'*P_L (including n_H' and n_L') is stored in the Low register, and the result N' of t'*P_H (including N_H' and N_L') is stored in the High register.

[0109] Step 3.4, the second round of reduction and accumulation is achieved through two additions. The first addition is used to add the result R3R2''''R1'''' obtained in step 3.1 to the value (N') in register High. N_H'N_L' is aligned with R3R2'''', so it can be implemented using a 512-bit addition instruction gfADD, and the result is R3'R2'''''R1''''. The second addition is used to add the result of the previous addition, R3'R2'''''R1'''', to the value (n') in the Low register. n_H'n_L' is aligned with R2'''''R1'''', so it can be implemented using a 512-bit addition instruction gfADD. To display the carry, a 256-bit carry addition instruction gfadci is used. The result of gfADD is added to an immediate value (e.g., 0), and the carry is displayed in the high-order bit, R3. The final result is R3''R2''''''R1'''''.

[0110] In other embodiments, step 3.1 above can be the last step of step two, or step 3.1 above can be performed after step 3.3, because when reducing t' in the second round of step 3.2, the value in R1 used is not affected by the result of step 3.1.

[0111] Step four: Perform the final arithmetic reduction to determine if there is an overflow. The process includes: in steps one and two, the result range is 0-2P-1. Determine if the result is greater than P-1. If it is greater than P-1, subtract P from the result; otherwise, the result remains unchanged.

[0112] Figure 6 for Figure 1 The calculations shown by Montgomery and Figure 2 The diagram shows a comparison of instruction cycles calculated by Montgomery. Figure 7 for Figure 1 The calculations shown by Montgomery and Figure 2 The diagram shows a comparison of instruction dependency paths in Montgomery's calculations.

[0113] Figure 6 The middle left side is Figure 1 The instruction cycle of the Montgomery algorithm is shown. Figure 6 The middle right side is Figure 2The diagram illustrates the instruction cycles of the Montgomery algorithm. Numbers 1-68 in the diagram represent cycles. Due to the dual-issue approach, two instructions can be issued per cycle, allowing parallel execution as long as the two instructions do not use the same logical operation unit. In the Montgomery algorithm, `gfmul` is a 256-bit multiplication instruction, requiring 6 cycles in this example. For instance, cycles 1-6 on the right side of the diagram represent the execution cycles of the multiplication instruction `gfmul` for calculating `a*b`. `gfADD` is a 512-bit addition instruction, requiring 3 cycles in this example. For instance, cycles 13-15 on the right side of the diagram represent the execution cycles of the addition instruction `gfADD` for calculating `R2R1+=Tt`. `gfadc` is a 256-bit addition instruction, requiring 2 cycles in this example. For instance, cycles 43-45 on the right side of the diagram represent the execution cycles of the addition instruction `gfadc` for calculating `R3R2+=Tt`. gfadci is a 256-bit addition instruction. In this example, it requires two cycles. For example, cycles 64-65 on the right side of the figure are the execution cycles of the addition instruction gfadci that calculates R3+=0.

[0114] like Figure 6 As shown in the Montgomery algorithm instruction cycle on the left, in the first round of reducing to find N_n, the multiplication of t and P requires calculating N=t*P_H and n=t*P_L, and then the calculated results are accumulated. Therefore, the accumulation needs to wait for the result of the multiplication calculation, as shown below. Figure 6 The gfmul instruction in cycles 31-36 is used to calculate t*P_H=N. The calculated N can only be added to R2R1 in cycles 37-39. The gfmul instruction in cycles 37-42 is used to calculate t*P_L=n. The calculated n can only be added to R1R0 in cycles 43-45. Since the value of R1 is needed in the subsequent round of reducing t, the multiplication operation can only continue after the addition instruction in cycles 43-45 is completed. As a result, after the multiplication instruction in cycles 37-42 is completed, the multiplication instruction for reducing t can only start in cycle 46. On the one hand, three cycles (cycles 43-45) are wasted in each calculation. On the other hand, the multiplication performance is reduced due to the interruption of the multiplication instruction pipeline.

[0115] Combination Figure 6 and Figure 7 In this embodiment, the high-order multiplication calculation (A*B) in the multiplication product algorithm is delayed until after the first round of reduction and accumulation and before the second round of reduction and calculation t. Since the result of the high-order calculation is not used in the previous calculation process, the delay of this step will not affect the final result. In addition, the multiplication calculation is delayed until after the first round of reduction and accumulation and before the second round of reduction and calculation t, that is... Figure 7Positions 37-42 in the middle ensure the continuity of the multiplication pipeline and allow the entire process to be completed in just 65 cycles, saving 3 cycles and improving the speed and efficiency of multiplication operations.

[0116] Figure 7 The middle left column is Figure 1 The instruction dependency path of the Montgomery algorithm shown in the figure is such that the addition instruction in the first round of reduction and accumulation (the position shown by the solid arrow in the figure) will cause the pipeline of multiplication instructions to be interrupted, thus resulting in a decrease in the performance of multiplication operations. Figure 7 The middle right column is Figure 2 The diagram shows the instruction dependency path of the Montgomery algorithm in this embodiment. By delaying A*B until after the first round of reduction and accumulation is completed (as shown by the dashed arrow in the diagram), the continuity of the multiplication pipeline can be guaranteed, and the speed and efficiency of multiplication operations can be improved.

[0117] As mentioned above, the Montgomery calculation method of this disclosure can save 3 cycles for each Montgomery modular multiplication, which is very friendly to continuous modular multiplication and can well support the fast algorithm for elliptic curve point addition. Furthermore, based on the foregoing analysis, since the 256-bit R1 is used to multiply with the parameter Inv in the process of reducing and subtracting to find t in the second round, the probability of out-of-range is lower, which is convenient for multiple consecutive modular multiplications.

[0118] Figure 8A A schematic diagram of a device for executing the Montgomery algorithm described above includes an instruction register, an instruction decoder, a register file, and an arithmetic logic unit (ALU), wherein:

[0119] The instruction register is configured to store instruction sets to be executed. The instruction sets include a first instruction set for calculating the arithmetic product of the first multiplier and the second multiplier, a second instruction set for performing a first round of reduction, and a third instruction set for performing a second round of reduction.

[0120] The instruction decoder is configured to read instructions from the instruction register and decode them, generate corresponding control signals to control the data in the register file to be connected to the arithmetic logic unit through the data path for arithmetic operations, and store the results of the arithmetic logic unit operations into the corresponding registers through the data path.

[0121] The register file includes multiple registers configured to store the results of arithmetic calculations.

[0122] The arithmetic logic unit is configured to perform arithmetic operations, including but not limited to multiplication and addition.

[0123] pass Figure 8AThe apparatus shown can implement the data processing method for Montgomery modular multiplication as described in any of the foregoing embodiments. For example, when storing the instruction group, the multiplication instructions for calculating the product of the first multiplier's high bits and the second multiplier's high bits can be arranged before the third instruction group for performing the second round of reduction; and / or, when storing the third instruction group, a 256-bit multiplication instruction can be used to calculate the product of the value in register R1 and the constant Inv.

[0124] Figure 8B This is a schematic diagram of another device that performs the Montgomery algorithm described above. Figure 8A Based on the existing device, it also includes an instruction cache, a data cache, a static random access memory (SRAM), and a dynamic random access memory (DRAM), wherein:

[0125] The instruction cache (I-cache) is configured to cache instructions that are about to be executed in order to improve the access speed of instructions;

[0126] The data cache is configured to cache frequently used data to improve data access speed;

[0127] The static random access memory (SRAM) is configured to store and access intermediate data.

[0128] The dynamic random access memory (DRAM) is configured to store data to be computed.

[0129] Figure 8A and Figure 8B This is merely an example; in other embodiments, it may be... Figure 8A or Figure 8B The device structure shown can be modified as long as it can perform the computational function. For example, it can omit the data cache and establish a data path directly between memory and SRAM.

[0130] It will be understood by those skilled in the art that all or some of the steps, systems, or apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all components may be implemented as software executed by a processor, such as a digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

Claims

1. A data processing method for Montgomery modular multiplication calculation, characterized in that, include: The steps for calculating the arithmetic product of the first and second multipliers include: a first round of reduction steps and a second round of reduction steps, wherein: In the arithmetic product calculation step, the product of the first multiplier and the second multiplier is calculated using multiplication instructions, including: calculating the product of the low-order bits of the first multiplier and the low-order bits of the second multiplier, the product of the high-order bits of the first multiplier and the low-order bits of the second multiplier, and the product of the low-order bits of the first multiplier and the high-order bits of the second multiplier; calculating the first cumulative result of the three product results using addition instructions; and saving the first cumulative result in order from high-order bits to low-order bits into registers R3, R2, R1, and R0. After executing the first round of reduction steps, the multiplication instruction is used to calculate the product of the high-order bits of the first multiplier and the high-order bits of the second multiplier, and then the second round of reduction steps is executed. The first round of reduction steps is used to reduce the value located in register R0 in the result, and the second round of reduction steps is used to reduce the value located in register R1 in the result. The value located in the register in the result refers to the value of the low-order bits being 0 through a series of intermediate calculations.

2. The method according to claim 1, characterized in that, Also includes: After using the multiplication instruction to calculate the product of the high-order bits of the first multiplier and the high-order bits of the second multiplier, the addition instruction is used to add the result of the product to the first accumulated result, and then the second round of reduction steps is executed; or After calculating the product of the high-order bits of the first multiplier and the high-order bits of the second multiplier using the multiplication instruction, during the second round of reduction steps, the result of the product is added to the first accumulated result using the addition instruction.

3. The method according to claim 1, characterized in that, The first and second multipliers both have a bit length of 384.

4. The method according to claim 1, characterized in that, The second round of reduction steps includes a step of finding a first intermediate value. In the step of finding the first intermediate value, a 256-bit multiplication instruction is used to calculate the product of the value in register R1 and the constant Inv as the first intermediate value. The value in register R1 and the constant Inv both have a bit length of 256.

5. The method according to claim 1, characterized in that, Before the arithmetic product step, the method further includes mapping the first multiplier and the second multiplier from a finite field to a Montgomery field, with the mapping relationship being: multiplying or dividing by 2 to the power of 512.

6. A data processing method for Montgomery modular multiplication calculation, characterized in that, include: The steps for calculating the arithmetic product of the first and second multipliers include: a first round of reduction steps and a second round of reduction steps, wherein: In the arithmetic product step, the product of the first multiplier and the second multiplier is calculated using multiplication instructions, and the product result is stored in registers R3, R2, R1, and R0 in order from the most significant bit to the least significant bit. The first round of reduction steps is performed to reduce the value located in register R0 in the product result; The second round of reduction steps is performed to reduce the value in register R1. The second round of reduction steps includes a step of finding a first intermediate value. In the step of finding the first intermediate value, a 256-bit multiplication instruction is used to calculate the product of the value in register R1 and the constant Inv as the first intermediate value. The value in register R1 and the constant Inv both have a bit length of 256. The value in the register in the reduction result refers to the value of the lower bits being 0 through a series of intermediate calculations.

7. The method according to claim 6, characterized in that, The second round of reduction steps also includes a step of finding a second intermediate value, which involves using a 256-bit multiplication instruction to calculate the product of the first intermediate value and the prime number P to obtain a 640-bit second intermediate value.

8. The method according to claim 7, characterized in that, The second round of reduction steps also includes an accumulation step, which includes using an addition instruction to calculate the sum of the second intermediate value and the values ​​in registers R3, R2, and R1, so as to reduce the value in register R1.

9. The method according to claim 6, characterized in that, The first and second multipliers both have a bit length of 384.

10. The method according to claim 6, characterized in that, The process of calculating the higher-order product of the first multiplier and the second multiplier in the arithmetic product step is delayed until before the second round of reduction steps.

11. The method according to claim 6, characterized in that, In the step of calculating the arithmetic product, the product of the first multiplier and the second multiplier is calculated using multiplication instructions, and the result is stored in registers R3, R2, R1, and R0, including: The multiplication instruction is used to calculate the product of the low-order bits of the first multiplier and the low-order bits of the second multiplier, the product of the high-order bits of the first multiplier and the low-order bits of the second multiplier, and the product of the low-order bits of the first multiplier and the high-order bits of the second multiplier. The addition instruction is used to calculate the first cumulative result of the three product results. The first cumulative result is saved into registers R3, R2, R1, and R0 in order from the high-order bits to the low-order bits.

12. The method according to claim 11, characterized in that, Also includes: After using the multiplication instruction to calculate the product of the high-order bits of the first multiplier and the high-order bits of the second multiplier, the addition instruction is used to add the result of the product to the first accumulated result, and then the second round of reduction steps is executed; or After calculating the product of the high-order bits of the first multiplier and the high-order bits of the second multiplier using the multiplication instruction, during the second round of reduction steps, the result of the product is added to the first accumulated result using the addition instruction.

13. A data processing device for Montgomery modular multiplication calculation, characterized in that, For implementing the Montgomery modular multiplication calculation as described in any one of claims 1-5, or for implementing the Montgomery modular multiplication calculation as described in any one of claims 6-12, the data processing apparatus comprises: an instruction register, an instruction decoder, a register file, and an arithmetic logic unit, wherein: The instruction register is configured to store instruction sets to be executed. The instruction sets include a first instruction set for calculating the arithmetic product of the first multiplier and the second multiplier, a second instruction set for performing a first round of reduction, and a third instruction set for performing a second round of reduction. The instruction decoder is configured to read instructions from the instruction register and decode them, generate corresponding control signals to control the data in the register file to be connected to the arithmetic logic unit through the data path for arithmetic operations, and store the results of the arithmetic logic unit operations into the corresponding registers through the data path. The register file includes multiple registers configured to store the results of arithmetic calculations. The arithmetic logic unit is configured to perform arithmetic operations, including multiplication and addition.

14. A computer device, characterized in that, It includes a processor and a memory storing a computer program that can run on the processor, wherein the processor executes the program to implement the steps of the method as described in any one of claims 1-5 or 6-12.

Images