Data processing method and device, processor, computer equipment, medium and program

Abstract

The embodiment of the invention provides a data processing method and device, a processor, computer equipment, a medium and a program, and the processor comprises a decoder which responds to a microcode of an elliptic curve cryptographic algorithm and decodes a plurality of instructions, and at least one part of the instructions are basic instructions; the logical operation unit comprises a basic instruction operation subunit used for operating the basic instruction; wherein part or all of the basic instruction is a modular operation instruction obtained by taking a prime number p as a modulus. According to the embodiment of the invention, the complexity and deployment cost of hardware operation can be remarkably reduced.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically to a data processing method, apparatus, processor, computer device, medium, and program. Background Technology

[0002] Elliptic curve cryptography is a type of public-key cryptography algorithm based on the elliptic curve discrete logarithm problem. It has wide applications in data encryption and decryption, digital signatures, and other data processing scenarios. Typical elliptic curve cryptography algorithms include Shangmi 2 (SM2) and Elliptic Curve Digital Signature (ECDSA).

[0003] Taking the SM2 algorithm as an example, the SM2 algorithm is a public-key cryptography algorithm based on elliptic curves, released by the State Cryptography Administration of China. The SM2 cryptographic algorithm includes three sub-algorithms: digital signature, encryption / decryption, and key exchange. The elliptic curves defined in the SM2 standard are based on the prime field, and involve modulo operations with prime numbers in the prime field GF(p). The prime field GF(p) is also known as the Galois field based on p.

[0004] In the existing SM2 algorithm, the entire process of the algorithm (such as SM2 key exchange / encryption) is encapsulated into CPU instructions. For example, the SM2 key exchange algorithm is encapsulated into one instruction, and the SM2 encryption algorithm is encapsulated into one instruction, which is then directly executed by dedicated hardware circuits. This results in complex hardware design of the SM2 instruction set and extremely high hardware deployment costs.

[0005] There is an urgent need for a processor that can reduce hardware design complexity, thereby reducing hardware deployment costs. Summary of the Invention

[0006] In view of this, embodiments of this application provide a data processing method, apparatus, processor, computer device, medium, and program that can significantly reduce the complexity of hardware operations and deployment costs.

[0007] To achieve the above objectives, the embodiments of this application provide the following technical solutions.

[0008] In a first aspect, embodiments of this application provide a processor, including: a decoder, responsive to microcode of an elliptic curve cryptography algorithm, decoding multiple instructions, at least a portion of which are basic instructions; and a logic operation unit, including: a basic instruction operation subunit, used to perform operations on the basic instructions; wherein, some or all of the basic instructions are modulo operation instructions obtained by using a prime number p as the modulus.

[0009] Optionally, the prime number p is embedded in the basic instruction operation subunit in a fixed value manner to support hard coding.

[0010] Optionally, the basic instructions include one or more of the following: a modular subtraction instruction, used to perform a modular subtraction operation on the first and second modular subtraction operands using the prime number p as the modulus, and output the modular subtraction result; a modular addition instruction, used to perform a modular addition operation on the first and second modular addition operands using the prime number p as the modulus, and output the modular addition result; a modular multiplication instruction, used to perform a modular multiplication operation on the first and second modular multiplication operands using the prime number p as the modulus, and output the modular multiplication result; wherein, the prime number p = 2. 256 -2 224 -2 96 +2 64 -1.

[0011] Optionally, the basic instructions also satisfy one or more of the following: the modular subtraction instruction converts the first and second modular subtraction operands to an intermediate field, outputs the difference, converts the difference back to a normal value, and then uses the prime number p as the modulus; the modular addition instruction converts the first and second modular addition operands to the intermediate field, outputs the sum, converts the sum back to a normal value, and then uses the prime number p as the modulus; the modular multiplication instruction converts the first and second modular multiplication operands to the intermediate field, outputs the product value, converts the product value back to a normal value, and then uses the prime number p as the modulus; the intermediate field is the Montgomery field.

[0012] Optionally, the basic instruction further satisfies one or more of the following: the first modulo-subtraction operand and the second modulo-subtraction operand are N bits, and both are less than the value of the prime number p; the first modulo-subtraction operand is greater than the second modulo-subtraction operand; the first modulo-addition operand and the second modulo-addition operand are N bits, and both are less than the value of the prime number p; the first modulo-multiplication operand and the second modulo-multiplication operand are N bits, and both are less than the value of the prime number p; N is a positive integer, and N = 256.

[0013] Optionally, the basic instruction operation subunit supports N-bit operations; the basic instruction further includes: a comparison instruction, used to compare the size of a first comparison operand and a second comparison operand, and output the comparison result; wherein, both the first comparison operand and the second comparison operand are N bits.

[0014] Optionally, the basic instruction operation subunit supports N-bit operations; the basic instruction further includes one or more of the following: a right shift instruction, which performs a right shift operation on a first right shift operand using a second right shift operand as the number of bits to shift, wherein the first right shift operand is N bits; a left shift instruction, which performs a left shift operation on a first left shift operand using a second left shift operand as the number of bits to shift, wherein the first left shift operand is N bits.

[0015] Optionally, the basic instruction further satisfies one or more of the following: the result of the right shift operation on the first right shift operand is stored in the storage address of the first right shift operand; the result of the right shift operation on the first right shift operand is N bits; the result of the left shift operation on the first left shift operand is stored in the storage address of the first left shift operand; the result of the left shift operation on the first left shift operand is N bits.

[0016] Optionally, the basic instruction operation subunit supports N-bit operations; the basic instruction further includes one or more of the following: a subtraction instruction, which performs a subtraction operation on the first subtraction operand and the second subtraction operand, and outputs the subtraction result; an addition instruction, which performs an addition operation on the first addition operand and the second addition operand, and outputs the addition result.

[0017] Optionally, the basic instruction further satisfies one or more of the following: the first subtraction operand and the second subtraction operand are N bits, and both are less than the value of the prime number p; the first subtraction operand is greater than the second subtraction operand; the result of the subtraction operation is stored in the storage address of the first subtraction operand; the result of the subtraction operation is N bits; the first addition operand and the second addition operand are less than N bits, and both are less than the value of the prime number p; the result of the addition operation is stored in the storage address of the first addition operand; the result of the addition operation is an integer less than or equal to N bits.

[0018] Optionally, the basic instructions can be added to the instruction set architecture executed by the processor.

[0019] Secondly, embodiments of this application provide a data processing method, comprising: acquiring data to be processed; decomposing some or all of the dot multiplication operations of an elliptic curve cryptography algorithm into dot addition operations and dot multiplication operations, further decomposing the dot addition operations into a first set of basic operations, and further decomposing the dot multiplication operations into a second set of basic operations, to obtain a decomposed elliptic curve cryptography algorithm; determining the data processing result of the data to be processed based on the decomposed elliptic curve cryptography algorithm; wherein, some or all of the operations in the first set of basic operations can be performed using basic instructions, and some or all of the operations in the second set of basic operations can be performed using basic instructions; some or all of the basic instructions are modulo operation instructions obtained by using a prime number p as the modulus.

[0020] Optionally, the elliptic curve cryptography algorithm is used in a processor, the processor including a basic instruction operation subunit for performing operations on the basic instructions, the basic instructions including modular subtraction instructions, modular addition instructions, modular multiplication instructions, and comparison instructions; decomposing the dot addition operation into a first basic operation set includes: decomposing the dot addition operation into a first basic operation set containing only modular subtraction operations, modular addition operations, modular multiplication operations, and comparison operations; wherein, the modular subtraction operation can call the basic instruction operation subunit to perform operations on the modular subtraction instructions, the modular addition operation can call the basic instruction operation subunit to perform operations on the modular addition instructions, the modular multiplication operation can call the basic instruction operation subunit to perform operations on the modular multiplication instructions, and the comparison operation can call the basic instruction operation subunit to perform operations on the comparison instructions.

[0021] Optionally, the elliptic curve cryptography algorithm is used in a processor, the processor including a basic instruction operation subunit for performing operations on the basic instructions, the basic instructions including modular subtraction, modular addition, modular multiplication, comparison, and right shift instructions; decomposing the doubling operation into a second set of basic operations includes: decomposing the doubling operation into a second set of basic operations containing only modular subtraction, modular addition, modular multiplication, comparison, and right shift operations; wherein the modular subtraction operation can call the basic instruction operation subunit to perform the modular subtraction operation, the modular addition operation can call the basic instruction operation subunit to perform the modular addition operation, the modular multiplication operation can call the basic instruction operation subunit to perform the modular multiplication operation, the comparison operation can call the basic instruction operation subunit to perform the comparison operation, and the right shift operation can call the basic instruction operation subunit to perform the right shift operation.

[0022] Optionally, the elliptic curve cryptography algorithm includes the SM2 encryption algorithm; the operation steps of the SM2 encryption algorithm include one or more of the following: inputting plaintext M and public key P. BGenerate a random number k; invoke the basic instructions in the first and second basic operation sets to perform a first dot multiplication operation, which is used to determine the first elliptic curve C1 = k·G = (x1, y1), where G represents the base point of the elliptic curve; invoke the basic instructions in the first and second basic operation sets to perform a second dot multiplication operation, which is used to determine the second elliptic curve k·P B = (x2, y2); the elliptic curve point coordinates (x2, y2) are converted into a key t with a length matching the plaintext M using the key derivation function KDF; in response to the key t being a non-all-zero bit string, a bit-by-bit XOR operation is performed on the plaintext M and the key t to generate ciphertext C2; the hash value C3 is calculated after concatenating the elliptic curve point coordinates (x2, y2) and the plaintext M; the ciphertext C = C1||C3||C2 is then assembled.

[0023] Optionally, determining the first elliptic curve C1 = k·G = (x1, y1) further includes: after the first dot product operation, calling the basic instructions in the first and second basic operation sets to output the affine coordinates k·G; and / or, determining the second elliptic curve k·P. B =(x2,y2), and also includes: after the second dot product operation, calling the basic instructions in the first and second basic operation sets to output the k·P of the affine coordinates. B .

[0024] Optionally, the elliptic curve cryptography algorithm includes the SM2 decryption algorithm; the operation steps of the SM2 decryption algorithm include one or more of the following: extracting the bit string C1 from the ciphertext C as a temporary public key; calling the basic instructions in the first and second basic operation sets to determine the recipient's private key d. B Performing a third dot product with the temporary public key C1 yields the shared point C1·d. B = (x2, y2); Generate the key t using (x2, y2) through the key derivation function KDF; In response to the key t being a non-all-zero bit string, extract the bit string C2 from the ciphertext C, perform a bitwise XOR operation on the plaintext C2 and the key t to obtain the decrypted plaintext M'; Recalculate the hash value u of (x2, M', y2), extract the bit string C3 from the ciphertext C, and compare the C3 with the hash value u; In response to C3 = u, output the decrypted plaintext M.

[0025] Thirdly, embodiments of this application provide a data processing apparatus, comprising: an acquisition module for acquiring data to be processed; a decomposition module for decomposing some or all of the dot multiplication operations of an elliptic curve cryptography algorithm into dot addition operations and dot multiplication operations, further decomposing the dot addition operations into a first set of basic operations, and further decomposing the dot multiplication operations into a second set of basic operations, to obtain a decomposed elliptic curve cryptography algorithm; and a determination module for determining the data processing result of the data to be processed based on the decomposed elliptic curve cryptography algorithm; wherein some or all of the operations in the first set of basic operations can be performed using basic instructions, and some or all of the operations in the second set of basic operations can be performed using basic instructions; and some or all of the basic instructions are modulo operation instructions obtained by using a prime number p as the modulus.

[0026] Fourthly, embodiments of this application provide a computer device including the processor described above.

[0027] Fifthly, embodiments of this application provide a computer device, including a memory and a processor; the memory stores a computer program executable on the processor, and the processor executes the data processing method provided in the second aspect when running the computer program.

[0028] In a sixth aspect, embodiments of this application also provide a storage medium having a computer program stored thereon, wherein the computer program, when run by a processor, causes the data processing method provided in the second aspect to be executed.

[0029] In a seventh aspect, embodiments of this application provide a computer program product, the computer program product including a computer program, which, when run on a computer, causes the computer to perform the data processing method provided in the second aspect.

[0030] Eighthly, embodiments of this application provide a chip (or data processing device) storing a computer program, which, when executed by the chip, causes the data processing method provided in the second aspect to be executed.

[0031] Ninthly, embodiments of this application provide a chip module on which a computer program is stored, such that when the computer program is executed by the chip module, the data processing method provided in the second aspect is executed.

[0032] In a tenth aspect, embodiments of this application provide a data processing system, the data processing system including means for performing the data processing method provided in the second aspect.

[0033] Compared with the prior art, the technical solution of the embodiments of the present invention has the following beneficial effects:

[0034] In this embodiment of the invention, by configuring the processor to include a decoder and a logic operation unit, the decoder can decode basic instructions. Some or all of the basic instructions are modulo operation instructions obtained by using a prime number p as the modulus. Compared to encapsulating the complete process of algorithms such as SM2 key exchange / encryption into CPU instructions and then having them directly executed by dedicated hardware circuits, which leads to complex hardware design and extremely high hardware deployment costs for the SM2 instruction set, the solution of this embodiment of the invention can use the basic instruction operation subunit in the logic operation unit to perform operations on the modulo operation instructions. The hardware design only needs to meet the basic operations of the basic commonality, thereby significantly reducing the complexity of hardware operations and deployment costs in elliptic curve cryptography algorithms.

[0035] Furthermore, the prime number p is embedded in the basic instruction operation subunit in a fixed value manner to support hard coding. Compared with storing the prime number p in memory or register and loading it dynamically at runtime, the solution of this embodiment can save parameter loading and dynamic calculation steps and effectively improve the operation efficiency.

[0036] Furthermore, the basic instructions include using a prime number p = 2. 256 -2 224 -2 96 +2 64 Modular subtraction, modular addition, and modular multiplication instructions using -1 as the modulus are performed because the prime number p used is a parameter in the national cryptographic standard, and 2 256 ≡2 224 +2 96 -2 64 Adding 1 (mod p) allows modulo operations to be performed using bitwise shifting and addition / subtraction operations, eliminating the need for traditional division operations, thus significantly reducing computational complexity and improving computational performance.

[0037] Furthermore, by adding the basic instructions to the instruction set architecture executed by the processor, and by setting eight major instructions including modular subtraction, modular addition, modular multiplication, comparison, shifting, and addition / subtraction instructions, a complete set of basic instructions can be constructed for low-level finite field operations. This is particularly suitable for the SM2 cryptographic algorithm. Through algorithm decomposition, all operations in the entire SM2 algorithm can be transformed into operations containing only basic instructions. Since modular operations can be implemented using the basic instruction operation subunit in the logic unit, hardware design complexity is effectively reduced, hardware area is reduced, and the efficiency and performance of the SM2 cryptographic algorithm are significantly improved. This has significant implications for practical business scenarios such as TLCP / IPSec. In addition, for other elliptic curve cryptographic algorithms, dot product operations often account for the majority of the time consumption. Therefore, by decomposing dot product operations into operations containing only basic instructions and then implementing them using the basic instruction operation subunit, the efficiency and performance of the cryptographic algorithm can be significantly improved while reducing hardware design complexity.

[0038] Furthermore, in the data processing method disclosed in this embodiment of the invention, by decomposing some or all of the dot multiplication operations of the elliptic curve cryptography algorithm into dot addition operations and dot multiplication operations, and decomposing the dot addition operations into a first basic operation set and the dot multiplication operations into a second basic operation set, the decomposed elliptic curve cryptography algorithm can perform a large number of operations using basic instructions, and then complete the operation using basic instruction operation subunits. This can effectively improve the efficiency of data processing while reducing the complexity of hardware design. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0040] Figure 1 This is a schematic diagram of the structure of a processor according to an embodiment of the present invention;

[0041] Figure 2 This is a schematic diagram of the instruction architecture of an elliptic curve cryptography algorithm according to an embodiment of the present invention;

[0042] Figure 3 This is a schematic diagram of the instruction architecture of another elliptic curve cryptography algorithm in an embodiment of the present invention;

[0043] Figure 4 This is a flowchart of a data processing method according to an embodiment of the present invention;

[0044] Figure 5 This is a flowchart illustrating an SM2 encryption algorithm according to an embodiment of the present invention;

[0045] Figure 6 This is a flowchart illustrating an SM2 decryption algorithm according to an embodiment of the present invention;

[0046] Figure 7 This is a schematic diagram of the structure of a data processing device according to an embodiment of the present invention. Detailed Implementation

[0047] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0048] Elliptic curve cryptography algorithms such as SM2 and ECDSA mainly utilize points on elliptic curves for data encryption, decryption, digital signatures, and other data processing, enabling the application of elliptic curve cryptography algorithms in data encryption, decryption, digital signature, and other data processing scenarios.

[0049] In the existing SM2 algorithm, the entire process of the algorithm (such as SM2 key exchange / encryption) is encapsulated into CPU instructions. For example, the SM2 key exchange algorithm is encapsulated into one instruction, and the SM2 encryption algorithm is encapsulated into one instruction. Then, a dedicated hardware circuit is configured for each instruction to be executed directly.

[0050] Taking a non-restrictive SM2 cryptographic algorithm instruction as an example, a single SM2 cryptographic algorithm instruction triggers the first procedure of key exchange. Dedicated hardware circuitry executes the SM2 cryptographic algorithm instruction, generating a random number as a temporary private key r. A A hardware operation control word is input into the SM2 engine, and a point multiplication hardware is used to calculate the point R of an elliptic curve. A =[r A G = (x1, y1). A R is a random number, used as the initiator's temporary private key. A This is the first temporary public key. Then check two conditions: x1∈[1,p] - 1], and y1∈[1,p - 1], where p is an N-bit prime number. If any condition is not met, return to update the key pair (r) with the new random number. A ,R A If both conditions are met, check the first temporary public key R. ADoes it satisfy the elliptic curve equation? If so, based on the output key pair (r) stored in the input register EDI... A ,R A The pointer will hold the key pair (r) A ,R A Load into memory. End the first program operation of key exchange for the SM2 cryptographic algorithm.

[0051] Research has revealed that the complete algorithm process is often quite complex, resulting in complex hardware design and extremely high hardware deployment costs for the SM2 instruction set.

[0052] In this embodiment of the invention, by setting the processor to include a decoder and a logic operation unit, the decoder can decode basic instructions. Some or all of the basic instructions are modulo operation instructions obtained by using a prime number p as the modulus. Compared with encapsulating the complete process of algorithms such as SM2 key exchange / encryption into CPU instructions and then executing them directly by dedicated hardware circuits, which leads to the complexity of SM2 instruction set hardware design, the solution of this embodiment of the invention can use the basic instruction operation subunit in the logic operation unit to perform operations on the modulo operation instructions. The hardware design only needs to meet the basic operations of the basic commonality, thereby significantly reducing the complexity and cost of hardware operations in elliptic curve cryptography algorithms.

[0053] To make the above-mentioned objectives, features and beneficial effects of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0054] Reference Figure 1 , Figure 1 This is a schematic diagram of the structure of a processor according to an embodiment of the present invention. The processor may include a decoder 101 and a logic operation unit 103.

[0055] The decoder 101 can respond to the microcode of the elliptic curve cryptography algorithm to decode multiple instructions, at least a portion of which are basic instructions.

[0056] Microcode, also known as microinstructions, can be low-level instructions within the CPU used to decode complex machine instructions (such as instructions for elliptic curve cryptography) into instructions that can be directly executed by the hardware.

[0057] The instructions decoded by the decoder 101 can enter the instruction queue 102, enter the arithmetic logical unit (ALU) 103, and then the operation results can be read and written through the memory 104.

[0058] In some embodiments, operands may be read from memory 104.

[0059] In a specific implementation, the logic operation unit 103 may include: a basic instruction operation subunit 1031, used to perform operations on the basic instructions; wherein, some or all of the basic instructions are modulo operation instructions obtained by using a prime number p as the modulus.

[0060] It should be noted that in some embodiments, the basic instruction operation subunit 1031 may also be referred to as the SM2 basic instruction operation subunit.

[0061] In this embodiment of the invention, by setting the processor to include a decoder and a logic operation unit, the decoder can decode basic instructions. Some or all of the basic instructions are modulo operation instructions obtained by using a prime number p as the modulus. Compared with encapsulating the complete process of algorithms such as SM2 key exchange / encryption into CPU instructions and then executing them directly by dedicated hardware circuits, which leads to complex hardware design and extremely high hardware deployment costs for the SM2 instruction set, the solution of this embodiment of the invention can use the basic instruction operation subunit in the logic operation unit to perform operations on the modulo operation instructions. The hardware design only needs to meet the basic operations of the basic commonality, thereby significantly reducing the complexity and cost of hardware operations in elliptic curve cryptography algorithms.

[0062] In some embodiments, the instructions can be loaded into the instruction cache 105 according to the translation result of the instruction translation lookaside buffer (ITLB) 106 based on the branch predictor 107, cached in the instruction buffer (XIB) 108, and then pushed into the format instruction queue (FIQ) 109 for delivery to the decoder 101.

[0063] In some embodiments, the prime number p is embedded in the basic instruction operation subunit in a fixed value manner to support hard coding.

[0064] The prime number p is a fixed value chosen in the cryptographic operation. This fixed value is a natural number greater than 1 and has only two positive factors: 1 and itself. Based on this prime number, a prime field is constructed. The elliptic curve discrete logarithm problem over this prime field is computationally difficult, providing sufficient security for elliptic curve cryptography algorithms.

[0065] In one specific embodiment, the elliptic curve cryptography algorithm is the SM2 algorithm, and the prime number p can be an N-bit prime, for example, prime number p = 2.256 -2 224 -2 96 +2 64 -1, for example, the prime number p = 2 256 -2 224 +2 192 +2 96 -1.

[0066] Where, the prime number p = 2 256 -2 224 -2 96 +2 64 -1 is a fixed parameter in the national cryptographic standard, with a bit length of 256, and 2 256 ≡2 224 +2 96 -2 64 +1 (mod p).

[0067] Therefore, the basic instruction operation subunit in this invention can be hardware that supports 256-bit operations.

[0068] It should be noted that the number of bits of the prime number p and the operations supported by the basic instruction operation subunit in the embodiments of the present invention are not limited to this. For example, 64-bit, 128-bit, etc. can also be supported based on the actual needs of the algorithm.

[0069] In this embodiment of the invention, the prime number p is embedded in the basic instruction operation subunit in a fixed value manner to support hard coding. Compared with storing the prime number p in memory or register and loading it dynamically at runtime, the solution of this embodiment of the invention can save parameter loading and dynamic calculation steps and effectively improve the operation efficiency.

[0070] In some embodiments, the basic instructions may be added to the instruction set architecture (ISA) executed by the processor so that the basic instruction arithmetic subunit 1031 can perform operations.

[0071] Reference Figure 2 , Figure 2 This is a schematic diagram of the instruction architecture of an elliptic curve cryptography algorithm according to an embodiment of the present invention.

[0072] Figure 2 The elliptic curve cryptography algorithm described here is SM2, but it is not limited to this; for example, SM3 can also be used.

[0073] The SM2 cryptographic algorithm was released by the China Cryptography Administration in 2012, and its specific description is in the standard "GMT 0003-2012 SM2 Elliptic Curve Public Key Cryptography Algorithm".

[0074] The SM2 cryptographic algorithm can include encryption algorithms, decryption algorithms, signature algorithms, signature verification algorithms, and key exchange algorithms.

[0075] The above algorithm mainly involves dot addition, dot multiplication, and dot multiplication. Among them, dot multiplication includes fixed dot multiplication and random dot multiplication, which accounts for the majority of the time consumption.

[0076] In this embodiment of the invention, at the hardware level, only the customized operations in the underlying SM2 domain need to be implemented. In other words, the SM2 cryptographic algorithm can be partially or even entirely implemented by relying solely on the basic instruction operation subunit to perform operations on the basic instructions.

[0077] In some embodiments, the basic instructions may include one or more of the following: a modular subtraction instruction, used to perform a modular subtraction operation on a first modular subtraction operand and a second modular subtraction operand using the prime number p as the modulus, and output the modular subtraction result; a modular addition instruction, used to perform a modular addition operation on a first modular addition operand and a second modular addition operand using the prime number p as the modulus, and output the modular addition result; a modular multiplication instruction, used to perform a modular multiplication operation on a first modular multiplication operand and a second modular multiplication operand using the prime number p as the modulus, and output the modular multiplication result; wherein, the prime number p = 2. 256 -2 224 -2 96 +2 64 -1.

[0078] In some embodiments, the basic instruction further satisfies one or more of the following: the first modulo-subtraction operand and the second modulo-subtraction operand are N bits, and both are less than the value of the prime number p; the first modulo-subtraction operand is greater than the second modulo-subtraction operand.

[0079] Where N is a positive integer.

[0080] In some specific embodiments, N = 256.

[0081] By setting a deep binding between the prime number p and 256 bits, 256-bit operations can be supported, achieving a better balance between computational efficiency and hardware complexity. Correspondingly, the basic instruction operation subunit in this invention can be hardware that supports 256-bit operations.

[0082] The specific embodiments described below use N=256 as an example, but are not limited to this.

[0083] In a specific embodiment of the modulo-sub instruction msub, the modulo-sub operation on the first modulo-sub operand A and the second modulo-sub operand B may include: inputting N-bit data A, where A < prime number p, inputting N-bit data B, where B < prime number p, satisfying A > B.

[0084] Table 1

[0085] opcode Operand 1 Operand 2 Operand 3 msub Integer A Integer B Output C

[0086] As shown in Table 1, the output result is C = (AB)·2. -256 mod p.

[0087] In some embodiments, the modulo subtraction instruction involves converting the first and second modulo subtraction operands to an intermediate field, outputting the difference, converting the difference back to a normal value, and then using the prime number p as the modulus.

[0088] In one specific embodiment, the intermediate domain may be the Montgomery domain.

[0089] As a non-limiting embodiment, the following can be entered:

[0090] A=0x7708b74db021d3dc2eac18d486f4027ad0d92c060bf4be0f56de1f6072c8bffd,

[0091] enter:

[0092] B=0xe4693451b5f6e81edb2d0e7e54c409dfcfbae2b525579796af240bac0077ad4,

[0093] The expected output is:

[0094] C=0x7585476e3451738a37ca1a8c407b9770eaebaa60e9d32af94b39e15c8f0b4bf7.

[0095] In some embodiments, the basic instruction further satisfies one or more of the following: the first modular addition operand and the second modular addition operand are N bits, and both are less than the value of the prime number p; the first modular multiplication operand and the second modular multiplication operand are N bits, and both are less than the value of the prime number p.

[0096] In a specific embodiment of the modulo addition instruction madd, the modulo addition operation on the first modulo addition operand A and the second modulo addition operand B may include: inputting N-bit data A, where A < prime number p, and inputting N-bit data B, where B < prime number p.

[0097] Table 2

[0098] opcode Operand 1 Operand 2 Operand 3 madd Integer A Integer B Output C

[0099] As shown in Table 2, the output result is C = (A + B)·2.-256 mod p.

[0100] In some embodiments, the modulo addition instruction converts the first and second modulo addition operands to the intermediate field, outputs the sum, converts the sum back to a normal value, and then uses the prime number p as the modulus.

[0101] In one specific embodiment, the intermediate domain may be the Montgomery domain.

[0102] As a non-limiting embodiment, the following can be entered:

[0103] A=0xfa3048efa2a350174fc334a8b3b2f6746eac798725a7a3ed359b535b280a75c3,

[0104] enter:

[0105] B=0x1bcab52db2659469c83761cd291e5c36ba0f4ad19061a8954403bb30cbb46499

[0106] The expected output is:

[0107] C=0x321020e38157361269671129f02c02dda1a18d8ac91c0d724e7fb19b10b8baa7

[0108] In a specific embodiment of the modular multiplication instruction mmul, the modular multiplication operation on the first modular multiplication operand A and the second modular multiplication operand B may include: inputting N-bit data A, where A < prime number p, and inputting N-bit data B, where B < prime number p.

[0109] Table 3

[0110] opcode Operand 1 Operand 2 Operand 3 mmul Integer A Integer B Output C

[0111] As shown in Table 3, the output result is C = (A·B)·2. -256 mod p.

[0112] In some embodiments, the modular multiplication instruction converts the first and second modular multiplication operands to the intermediate domain, outputs the product value, converts the product value back to a normal value, and then uses the prime number p as the modulus.

[0113] In one specific embodiment, the intermediate domain may be the Montgomery domain.

[0114] As a non-limiting embodiment, the following can be entered:

[0115] A = 0xe6fecd0b07d7c6076e68322bbed2facb0082d1915398ab67144a48e7a7d75712

[0116] Input:

[0117] B = 0x743f7e161b435b82c742f9eead35a1f377bb6fff35e07efcf2c00380903c2a53

[0118] Then the expected output is:

[0119] C = 0x30214fb7641b8d7c1a80b0ad3bd8507ee094f88f18711018939efb932342d30c

[0120] In the embodiments of the present invention, the modular subtraction, modular addition, and modular multiplication instructions may be performed by converting the input operands to an intermediate domain, outputting an intermediate value, and then converting the intermediate value back to a normal numerical value, and using a prime number p as the modulus. Thus, the modular subtraction, modular addition, and modular multiplication operations can be completed only through displacement and addition and subtraction.

[0121] In the embodiments of the present invention, the basic instructions include modular subtraction, modular addition, and modular multiplication instructions using a prime number p = 2 256 -2 224 -2 96 +2 64 -1 as the modulus. Since the prime number p used is a parameter in the national cryptographic standard, and 2 256 ≡2 224 +2 96 -2 64 +1 (mod p), there is a chance that the modular operation can be completed through shift operations and addition and subtraction operations, without traditional division, significantly reducing the operation complexity and improving the operation performance.

[0122] In some embodiments, the basic instruction operation sub-unit supports N-bit operations; the basic instructions further include: a comparison instruction for comparing the magnitudes of a first comparison operand and a second comparison operand and outputting a comparison result; wherein, both the first comparison operand and the second comparison operand are N bits.

[0123] In a specific embodiment of a comparison instruction pcmpqq, the comparison operation of the first comparison operand A and the second comparison operand B may include: when A = B, output 0; when A > B, output 1; when A < B, output -1.

[0124] The instruction format can be as follows: from memory 104 (refer to...) Figure 1 Read A and B, and input them into the basic instruction operation subunit 1031 (refer to...). Figure 1 Then the basic instruction operation subunit 1031 outputs the result C to the memory 104.

[0125] Table 4

[0126] opcode Operand 1 Operand 2 Operand 3 pcmpqq Integer A Integer B Output C

[0127] As shown in Table 4, the output result is C.

[0128] It should be noted that this instruction can compare 256-bit large integers, and its computational efficiency is higher than that of a 64-bit comparison instruction in a central processing unit (CPU).

[0129] As a non-limiting example of a 256-bit comparison instruction, the input could be: A = 0xbe3632e13443d69b006729ec9562aa026e7c2d6ecdca80b419c3d6e28cb67a58

[0130] enter:

[0131] B=0xa67d18bbef54fb93395d054040b3c8a5024d1ca3ad539176ddbf6c5ee9e9472a

[0132] The expected output is:

[0133] C = 1.

[0134] In some embodiments, the basic instruction operation subunit supports N-bit operations; the basic instruction further includes one or more of the following: a right shift instruction, which performs a right shift operation on a first right shift operand using a second right shift operand as the number of bits to shift, wherein the first right shift operand is N bits; and a left shift instruction, which performs a left shift operation on a first left shift operand using a second left shift operand as the number of bits to shift, wherein the first left shift operand is N bits.

[0135] In a specific embodiment of the right shift instruction psrlqq, the right shift operation may include: a first right shift operand of N bits u, and a second right shift operand of 8 bits c.

[0136] In some embodiments, the basic instruction further satisfies one or more of the following: the result of the right shift operation on the first right shift operand is stored in the storage address of the first right shift operand; the result of the right shift operation on the first right shift operand is N bits.

[0137] Table 5

[0138] opcode Operand 1 Operand 2 Operand 3 psrlqq Integer u Integer c Output result u

[0139] As shown in Table 5, the output result u can be N bits, and the condition u←u>>c can be satisfied.

[0140] In one specific embodiment, the output result is still stored at the address in the first right shift operand (i.e., operand 1), for example, still in memory 104 (refer to...). Figure 1 The original address in ).

[0141] As a non-limiting example of a 256-bit right shift instruction, the input could be: u = 0x43410d831e2128c1a9e862a621cfb6c29fe247d2ad0e7d4d1e6406142babe69a

[0142] Input: c = 0x6a

[0143] The expected output is:

[0144] u=0x0000000000000000000000000010d04360c7884a306a7a18a98873edb0a7f891

[0145] In a specific embodiment of the left shift instruction psllqq, the left shift operation may include: a first left shift operand of N bits s and a second left shift operand of 8 bits c.

[0146] In some embodiments, the basic instruction further satisfies one or more of the following: the result of the left shift operation on the first left shift operand is stored in the storage address of the first left shift operand; the result of the left shift operation on the first left shift operand is N bits.

[0147] Table 6

[0148] opcode Operand 1 Operand 2 Operand 3 psllqq Integer s Integer c Output result s

[0149] As shown in Table 6, the output result s can be N bits, and s←s<<c can be satisfied.

[0150] In one specific embodiment, the output result is still stored at the address in the first left shift operand (i.e., operand 1), for example, still in memory 104 (refer to...). Figure 1 The original address in ).

[0151] As a non-limiting example of a 256-bit left shift instruction, the input could be: s = 0xec09ff86ba3e06b937c97d846e932840dda54f54703ca586fd21093920f77d57

[0152] Input: c = 0x16

[0153] The expected output is:

[0154] s=0xe1ae8f81ae4df25f611ba4ca10376953d51c0f2961bf48424e483ddf55c00000

[0155] In some embodiments, the basic instruction operation subunit supports N-bit operations; the basic instruction further includes one or more of the following: a subtraction instruction, which performs a subtraction operation on a first subtraction operand and a second subtraction operand, and outputs the subtraction result; and an addition instruction, which performs an addition operation on a first addition operand and a second addition operand, and outputs the addition result.

[0156] In a specific embodiment of the subtraction instruction psubqq, the subtraction operation may include: inputting N-bit data u, inputting N-bit data v, and u > v.

[0157] In some embodiments, the basic instruction further satisfies one or more of the following: the first subtraction operand and the second subtraction operand are N bits, and both are less than the value of the prime number p; the first subtraction operand is greater than the second subtraction operand; the result obtained by performing the subtraction operation is stored in the storage address of the first subtraction operand; the result obtained by performing the subtraction operation is N bits.

[0158] Table 7

[0159] opcode Operand 1 Operand 2 Operand 3 psubqq Integer u Integer v Output result u

[0160] As shown in Table 7, the output result u can be N bits, and the condition u←uv can be satisfied.

[0161] In one specific embodiment, the output result is still stored at the address in the first subtraction operand (i.e., operand 1), for example, still in memory 104 (refer to...). Figure 1 The original address in ).

[0162] As a non-limiting example of a 256-bit subtraction instruction, the input could be: u = 0xe893cdff17c05fc76a37a78ed3a5dc510e258fcb08688e6e658cc37f0a61ccc1

[0163] enter:

[0164] v=0xb5a520137e76cb8be662bd8bbc76184c26fd25d484e79a55a26ef71053b52bbc

[0165] The expected output is:

[0166] u=0x32eeadeb9949943b83d4ea03172fc404e72869f68380f418c31dcc6eb6aca105

[0167] In a specific embodiment of the addition instruction paddqq, the addition operation may include: inputting data r less than N bits, and inputting data s less than N bits.

[0168] In some embodiments, the basic instruction further satisfies one or more of the following: the first addition operand and the second addition operand are less than N bits and both are less than the value of the prime number p; the result of the addition operation is stored in the storage address of the first addition operand; the result of the addition operation is an integer less than or equal to N bits.

[0169] Table 8

[0170] opcode Operand 1 Operand 2 Operand 3 paddqq Integer r Integer s Output result r

[0171] As shown in Table 8, given input integers r and s less than 256 bits, the output should be an integer r less than or equal to 256 bits, satisfying r←r+s. In other words, the output can be a result r less than or equal to N bits, satisfying r←r+s.

[0172] In one specific embodiment, the output result is still stored at the address in the first addition operand (i.e., operand 1), for example, still in memory 104 (refer to...). Figure 1 The original address in ).

[0173] As a non-limiting example of a 256-bit addition instruction, the input could be: r = 0xc09aa0142bcc82a308fa5cad5dd74e20263984394f6181a337f76cc2b7fbe5

[0174] enter:

[0175] s=0x66446ee606e7e5465f87fa720221f99a83588070d645aa8606021b4beca61f00

[0176] The expected output is:

[0177] r=0x670509861b13b1c90290f4ceaf7fd0e8a37eb9f50f950c07a93a12b8af5e1ae5

[0178] Reference Figure 3 , Figure 3 This is a schematic diagram of the instruction architecture of another elliptic curve cryptography algorithm in an embodiment of the present invention.

[0179] and Figure 2 In contrast, the SM2 custom operation of another elliptic curve cryptography algorithm can include comparison operations, modular subtraction, modular addition, modular multiplication, and approximate analog operations. Among them, approximate analog operations can be implemented through comparison operations, right shift operations, left shift operations, subtraction operations, and addition operations.

[0180] In addition, the SM2 instruction architecture of another elliptic curve cryptography algorithm can contain the same algorithms, such as encryption algorithms, decryption algorithms, signature algorithms, signature verification algorithms, and key exchange algorithms.

[0181] Elliptic curve operations can include the same operations, such as point addition, point multiplication, and point multiplication.

[0182] In this embodiment of the invention, by adding the basic instructions to the instruction set architecture executed by the processor, and setting eight major instructions including modular subtraction, modular addition, modular multiplication, comparison, shift, and addition / subtraction instructions, a complete set of basic instructions can be constructed for underlying finite field operations. This is particularly suitable for the SM2 cryptographic algorithm. Through algorithm decomposition, all operations in the entire SM2 algorithm can be transformed into operations containing only basic instructions. Since modular operations can be implemented using the basic instruction operation subunit in the logic unit, hardware design complexity is effectively reduced, hardware area is reduced, and the efficiency and performance of the SM2 cryptographic algorithm are significantly improved. This has significant implications for practical business scenarios such as TLCP / IPSec. Furthermore, for other elliptic curve cryptographic algorithms, dot product operations often account for the majority of the time consumption. Therefore, by decomposing the dot product operation into operations containing only basic instructions and then using the basic instruction operation subunit, the efficiency and performance of the cryptographic algorithm can be significantly improved while reducing hardware design complexity.

[0183] Reference Figure 4 , Figure 4 This is a flowchart of a data processing method according to an embodiment of the present invention. The data processing method may include steps S41 to S43:

[0184] Step S41: Obtain the data to be processed;

[0185] Step S42: Decompose some or all of the dot multiplication operations of the elliptic curve cryptography algorithm into dot addition operations and dot multiplication operations, and decompose the dot addition operations into a first set of basic operations and the dot multiplication operations into a second set of basic operations to obtain the decomposed elliptic curve cryptography algorithm.

[0186] Step S43: Determine the data processing result of the data to be processed based on the decomposed elliptic curve cryptography algorithm.

[0187] Wherein, some or all of the operations in the first set of basic operations can be performed using basic instructions, and some or all of the operations in the second set of basic operations can be performed using basic instructions; some or all of the basic instructions are modulo operation instructions obtained by using a prime number p as the modulus.

[0188] In the specific implementation of step S41, the data to be processed can be processed using an elliptic curve cryptography algorithm.

[0189] As an optional implementation, depending on the different data processing scenarios in which elliptic curve cryptography (ECC) algorithms are applied, the data to be processed using ECC can have different forms. For example, if ECC is applied to a data encryption scenario, the data to be processed can be plaintext to be encrypted; if ECC is applied to a data decryption scenario, the data to be processed can be ciphertext to be decrypted; if ECC is applied to a digital signature scenario, the data to be processed can be a data digest (such as a hash value) of the data to be signed.

[0190] In step S42, the elliptic curve cryptography algorithm may include multi-step dot multiplication operations.

[0191] It should be noted that the elliptic curve in elliptic curve cryptography is defined in the prime field. Therefore, elliptic curve cryptography involves using dot multiplication to calculate the coordinates of points on the elliptic curve for data processing scenarios such as encryption / decryption and digital signatures. Since dot multiplication accounts for a significant portion of the computational time in elliptic curve cryptography algorithms like SM2, its performance has a crucial impact on the overall performance of these algorithms. However, currently, dot multiplication is inefficient and computationally intensive, making it difficult to meet current requirements.

[0192] In one specific embodiment, the dot product operation can be represented as follows:

[0193] Input: k = (k t-1 ,……,k1,k0)2,P∈E(F q )

[0194] Output: k·P B

[0195] 1.Q←∞

[0196] 2. i from 0 to t-1:

[0197] 2.1Ifk i =1, thenQ←Q+P;

[0198] 2.2P←2P

[0199] 3. Return(Q).

[0200] In some embodiments, the elliptic curve cryptography algorithm is used in a processor, the processor including a basic instruction operation subunit for performing operations on the basic instructions, the basic instructions including modular subtraction instructions, modular addition instructions, modular multiplication instructions, and comparison instructions; decomposing the dot addition operation into a first basic operation set includes: decomposing the dot addition operation into a first basic operation set containing only modular subtraction operations, modular addition operations, modular multiplication operations, and comparison operations; wherein, the modular subtraction operation can call the basic instruction operation subunit to perform operations on the modular subtraction instructions, the modular addition operation can call the basic instruction operation subunit to perform operations on the modular addition instructions, the modular multiplication operation can call the basic instruction operation subunit to perform operations on the modular multiplication instructions, and the comparison operation can call the basic instruction operation subunit to perform operations on the comparison instructions.

[0201] Since dot multiplication can be broken down into dot addition and dot multiplication, dot addition can be further broken down into basic operations using the following steps:

[0202] Input: P = (X1:Y1:Z1) in Jacobian coordinates, Q = (x2,y2) in Affine coordinates, y 2 =x 3 -3x+b

[0203] Output: P + Q = (X3:Y3:Z3) in Jacobian coordinates.

[0204] 1.IfQ=∞then return(X1:Y1:Z1)

[0205] 2.IfP=∞then return(x2:y2:1)

[0206] 3.

[0207] 4. T2←T1·Z1 {T2←B=Z1A}

[0208] 5. T1←T1·x2 {T1←C=X2A}

[0209] 6.T2←T2·y2 {T2←D=Y2B}

[0210] 7.T1←T1-X1 {T1←E=C-X1}

[0211] 8.T2←T2-Y1 {T2←F=D-Y1}

[0212] 9.IfT1=0,then

[0213] (X3:Y3:Z3)=2(x2:y2:1)and return(X3:Y3:Z3)

[0214] else return(∞)

[0215] 10.Z3←Z1·T1 {Z3←Z1E}

[0216] 11. {T3←G=E 2 }

[0217] 12.T4←T3·T1 {T4←H=E 3 }

[0218] 13.T3←T3·X1 {T3←I=X1G}

[0219] 14.T1←2T3 {T1←2I}

[0220] 15. {X3←F 2 }

[0221] 16.X3←X3-T1 {X3←F 2 -2I}

[0222] 17.X3←X3-T4 {X3←F 2 -(H+2I)}

[0223] 18.T3←T3-X3 {T3←I-X3}

[0224] 19.T3←T3·T2 {T3←F(I-X3)}

[0225] 20.T4←T4·Y1 {T4←Y1H}

[0226] 21.Y3←T3-T4 {Y3←F(I-X3)-Y1H}

[0227] 22.Return(X3:Y3:Z3)

[0228] Specifically, steps 1 to 22 are all basic instructions. Among them, 1-2 are comparison instructions, 3-6 are modular multiplication instructions, 7-8 are modular subtraction instructions, 10-13 are modular multiplication instructions, 14 is modular addition instructions, 15 is modular multiplication instructions, 16-18 are modular subtraction instructions, 19-20 are modular multiplication instructions, and 21 is modular subtraction instructions.

[0229] It should be noted that the method of decomposing dot product into basic instructions is not limited to this. Other applicable decomposition results can also be obtained by adjusting the order of steps 1 to 22, such as changing the internal order of modular multiplication instructions 3-6 or the internal order of modular subtraction instructions 7-8.

[0230] In some embodiments, the elliptic curve cryptography algorithm is used in a processor, the processor including a basic instruction operation subunit for performing operations on the basic instructions, the basic instructions including modular subtraction, modular addition, modular multiplication, comparison, and right shift instructions; decomposing the doubling operation into a second set of basic operations includes: decomposing the doubling operation into a second set of basic operations containing only modular subtraction, modular addition, modular multiplication, comparison, and right shift operations; wherein the modular subtraction operation can call the basic instruction operation subunit to perform operations on the modular subtraction instruction, the modular addition operation can call the basic instruction operation subunit to perform operations on the modular addition instruction, the modular multiplication operation can call the basic instruction operation subunit to perform operations on the modular multiplication instruction, the comparison operation can call the basic instruction operation subunit to perform operations on the comparison instruction, and the right shift operation can call the basic instruction operation subunit to perform operations on the right shift instruction.

[0231] In one specific embodiment, the doubling operation can be decomposed into basic operations through the following steps:

[0232] Input: In the Jacobian coordinate system, P = (X1:Y1:Z1), y 2 =x 3 -3x+b

[0233] Output: 2P = (X3:Y3:Z3) in Jacobian coordinates.

[0234] 1. If P = ∞, then return (∞).

[0235] 2.

[0236] 3.T2←X1-T1

[0237] 4. T1←X1+T1

[0238] 5.T2←T2·T1

[0239] 6.T2←3T2

[0240] 7. Y3←2Y1 {Y3←B=2Y1}

[0241] 8.Z3←Y3·Z1 {Z3←BZ1}

[0242] 9. {Y3←C=B 2}

[0243] 10. T3←Y3·X1 {T3←D=CX1}

[0244] 11. {Y3←C 2}

[0245] 12.Y3←Y3 / 2 {Y3←C 2 / 2}

[0246] 13. {X3←A 2}

[0247] 14.T1←2T3 {T1←2D}

[0248] 15.X3←X3-T1 {X3←A 2 -2D}

[0249] 16. T1←T3-X3 {T1←D-X3}

[0250] 17. T1←T1·T2 {T1←(D-X3)A}

[0251] 18. Y3←T1-Y3 {Y3←(D-X3)AC 2 / 2}

[0252] 19. Return(X3:Y3:Z3)

[0253] Specifically, steps 1 to 19 are all basic instructions. Among them, 1 is a comparison instruction, 2 is a modular multiplication instruction, 3 is a modular subtraction instruction, 4 is a modular addition instruction, 5 is a modular multiplication instruction, 6-7 are modular addition instructions, 8-11 are modular multiplication instructions, 12 is a right shift instruction, 13 is a modular multiplication instruction, 14 is a modular addition instruction, 15-16 are modular subtraction instructions, 17 is a modular multiplication instruction, and 18 is a modular subtraction instruction.

[0254] It should be noted that the method of decomposing the doubling operation into basic instructions is not limited to this. Other applicable decomposition results can also be obtained by adjusting the order of steps 1 to 22, such as changing the internal order of modular multiplication instructions 8-11 or the internal order of modular subtraction instructions 15-16.

[0255] Based on this, the embodiments of this application optimize the dot product operation and provide a data processing scheme for elliptic curve cryptography algorithms that apply the optimized dot product operation. In data processing scenarios that apply elliptic curve cryptography algorithms, the improved computational performance through the optimized dot product operation enhances the algorithmic performance of elliptic curve cryptography algorithms, thereby improving the data processing performance (such as the performance of data encryption and decryption) of elliptic curve cryptography algorithms.

[0256] In the specific implementation of step S43, the data processing result of the data to be processed is determined according to the decomposed elliptic curve cryptography algorithm.

[0257] In some embodiments, the elliptic curve cryptography algorithm may include the SM2 encryption algorithm and the SM2 decryption algorithm.

[0258] Reference Figure 5 , Figure 5 This is a flowchart illustrating an SM2 encryption algorithm according to an embodiment of the present invention. The SM2 encryption algorithm may include steps S501 to S511, which are described below.

[0259] In step S501, input plaintext M and public key P. B .

[0260] In step S502, a random number k is generated.

[0261] In step S503, the basic instructions in the first and second basic operation sets are called to perform a first dot multiplication operation. The first dot multiplication operation is used to determine a first elliptic curve, and G is used to represent the base point of the elliptic curve.

[0262] Specifically, the basic instructions in the first and second basic operation sets are called to perform the first dot multiplication operation. The first dot multiplication operation is used to determine the first elliptic curve C1 = k·G = (x1, y1), where G represents the base point of the elliptic curve.

[0263] Optionally, in step S504, the basic instructions in the first and second basic operation sets are called to output the k·G of the affine coordinates.

[0264] In this embodiment of the invention, by outputting k·G of the affine coordinates, the dot product operation result in the affine coordinate system can be obtained, thereby improving the effectiveness of the output data.

[0265] In a specific implementation, the step of determining the first elliptic curve C1 = k·G = (x1, y1) may also include: after the first dot product operation, calling the basic instructions in the first and second basic operation sets to output the affine coordinates k·G.

[0266] In this embodiment of the invention, by outputting k·G of the affine coordinates, the dot product operation result in the affine coordinate system can be obtained, thereby improving the effectiveness of the output data.

[0267] It should be noted that, in another embodiment, the step of outputting the affine coordinates k·G can be combined with step S503, as shown above in the step of decomposing the point addition operation and the point multiplication operation into basic operations, that is, coordinate transformation is performed simultaneously.

[0268] In step S505, the basic instructions in the first and second basic operation sets are called to perform a second dot multiplication operation, which is used to determine the second elliptic curve.

[0269] Specifically, the second dot multiplication operation is used to determine the second elliptic curve k·P. u = (x2, y2).

[0270] Optionally, in step S506, the basic instructions in the first and second basic operation sets are called to output the k·P affine coordinates. B .

[0271] In this embodiment of the invention, the k·P of the affine coordinates is output. B This allows us to obtain the dot product results in affine coordinates, improving the effectiveness of the output data.

[0272] In specific implementation, the second elliptic curve k·P is determined. B The steps for =(x2,y2) further include: after the second dot product operation, calling the basic instructions in the first and second basic operation sets to output the k·P of the affine coordinates. B .

[0273] It should be noted that, in another embodiment, the k·P coordinates are output. B The steps can be combined in step S505, such as the step of decomposing the point addition operation and the point multiplication operation into basic operations as shown above, that is, coordinate transformation is performed at the same time.

[0274] In step S507, the coordinates (x2, y2) of the elliptic curve point are converted into a key t that matches the length of the plaintext M using the key derivation function KDF.

[0275] In step S508, it is determined whether the key t = 0. If the result is yes, then return to step S502; otherwise, continue to step S509.

[0276] In step S509, the plaintext M and the key t are XORed bit by bit to generate the ciphertext C2.

[0277] In step S510, the hash value C3 is calculated by concatenating the coordinates (x2, y2) of the elliptic curve point with the plaintext M.

[0278] In step S511, the ciphertext is assembled.

[0279] Specifically, the ciphertext C = C1||C3||C2 is obtained by assembly.

[0280] In the SM2 encryption algorithm disclosed in this embodiment of the invention, the algorithm performance and computational efficiency of the SM2 encryption algorithm can be significantly improved by using basic instructions to perform the first and second dot multiplication operations.

[0281] Reference Figure 6 , Figure 6 This is a flowchart illustrating an SM2 decryption algorithm according to an embodiment of the present invention. The SM2 decryption algorithm may include steps S601 to S608, which are described below.

[0282] In step S601, the bit string C1 is extracted from the ciphertext C as a temporary public key.

[0283] In step S602, the basic instructions in the first and second basic operation sets are invoked to determine the receiver's private key d. B Perform a third dot multiplication operation with the temporary public key C1 to obtain the shared point.

[0284] Specifically, the recipient's private key d B Performing a third dot product with the temporary public key C1 yields the shared point C1·d. B = (x2, y2).

[0285] In step S603, the key t is generated using the key derivation function KDF with (x2, y2).

[0286] In step S604, it is determined whether the key t = 0. If the result is yes, then return to step S601; otherwise, continue to step S605.

[0287] In step S605, bit string C2 is extracted from the ciphertext C, and bit-by-bit XOR operation is performed between the plaintext C2 and the key t to obtain the restored plaintext M'.

[0288] In step S606, the hash value u of (x2, M', y2) is recalculated, the bit string C3 is extracted from the ciphertext C, and the C3 is compared with the hash value u.

[0289] In step S607, it is determined whether C3 = u. If the result is no, the process returns to step S601; otherwise, it continues to step S608.

[0290] In step S608, the decrypted plaintext M is output.

[0291] In the SM2 decryption algorithm disclosed in this embodiment of the invention, the algorithm performance and computational efficiency of the SM2 decryption algorithm can be significantly improved by using basic instructions to perform the third dot multiplication operation.

[0292] Reference Figure 7 , Figure 7 This is a schematic diagram of the structure of a data processing device according to an embodiment of the present invention. The data processing device may include:

[0293] Module 71 is used to acquire data to be processed;

[0294] The decomposition module 72 is used to decompose some or all of the dot multiplication operations of the elliptic curve cryptography algorithm into dot addition operations and dot multiplication operations, and to decompose the dot addition operations into a first basic operation set and the dot multiplication operations into a second basic operation set, so as to obtain the decomposed elliptic curve cryptography algorithm.

[0295] The determining module 73 is used to determine the data processing result of the data to be processed based on the decomposed elliptic curve cryptography algorithm.

[0296] In this context, some or all of the operations in the first set of basic operations can be performed using basic instructions, and some or all of the operations in the second set of basic operations can be performed using basic instructions. Some or all of the basic instructions are modular arithmetic instructions obtained by using a prime number p as the modulus.

[0297] about Figure 7 For more information on the working principle, operation method, and beneficial effects of the communication device shown, please refer to the preceding text and... Figure 4 The specific details will not be elaborated here.

[0298] This application also provides a computer device, including a processor.

[0299] The processor can be referred to in the preceding text and... Figure 1 The processor shown.

[0300] It should be understood that in the embodiments of this application, the processor can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or other conventionally applicable processors.

[0301] This application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program that can run on the processor, and the processor executes the steps of the data processing method described above when running the computer program.

[0302] The memory in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Non-volatile memory can be ROM, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), which serves as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0303] This application also provides a storage medium, also known as a computer-readable storage medium, on which a computer program is stored. When the computer program is run by a computer, the above-described data processing method is executed.

[0304] This application also provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the above-described data processing method.

[0305] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer program are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer program can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, the computer program can be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means.

[0306] While the embodiments disclosed above are described in this application, this application is not limited thereto. Any person skilled in the art can make various modifications and alterations without departing from the spirit and scope of this application; therefore, the scope of protection of this application should be determined by the scope defined in the claims.

Claims

1. A processor, comprising: The method comprises the following steps: A decoder decodes a plurality of instructions in response to microcode of an elliptic curve cryptography algorithm, at least part of the instructions being basic instructions; A logic operation unit comprises: A basic instruction operation subunit for operating the basic instructions; Part or all of the basic instructions are modulus operation instructions obtained by using a prime number p as a modulus.

2. The processor of claim 1, wherein, The prime number p is embedded in the basic instruction operation subunit in a fixed value manner to support hard coding.

3. The processor of claim 1, wherein, The basic instructions comprise one or more of the following: A modulus subtraction instruction for performing a modulus subtraction operation on a first modulus subtraction operand and a second modulus subtraction operand by using the prime number p as a modulus and outputting a modulus subtraction result; A modulus addition instruction for performing a modulus addition operation on a first modulus addition operand and a second modulus addition operand by using the prime number p as a modulus and outputting a modulus addition result; A modulus multiplication instruction for performing a modulus multiplication operation on a first modulus multiplication operand and a second modulus multiplication operand by using the prime number p as a modulus and outputting a modulus multiplication result; wherein the prime number p = 2 256 -2 224 -2 96 +2 64 -1.

4. The processor of claim 3, wherein, The basic instructions further satisfy one or more of the following: The modulus subtraction instruction is performed by converting the first modulus subtraction operand and the second modulus subtraction operand to an intermediate domain, outputting a difference value, converting the difference value back to a normal value, and then using the prime number p as a modulus; The modulus addition instruction is performed by converting the first modulus addition operand and the second modulus addition operand to the intermediate domain, outputting a sum value, converting the sum value back to a normal value, and then using the prime number p as a modulus; The modulus multiplication instruction is performed by converting the first modulus multiplication operand and the second modulus multiplication operand to the intermediate domain, outputting a product value, converting the product value back to a normal value, and then using the prime number p as a modulus; The intermediate domain is a Montgomery domain.

5. The processor of claim 3, wherein, The basic instructions further satisfy one or more of the following: The first modulus subtraction operand and the second modulus subtraction operand are N bits and are less than the value of the prime number p; The first modulus subtraction operand is greater than the second modulus subtraction operand; The first modulus addition operand and the second modulus addition operand are N bits and are less than the value of the prime number p; The first modulus multiplication operand and the second modulus multiplication operand are N bits and are less than the value of the prime number p; N is a positive integer and N = 256.

6. The processor of claim 3, wherein, The basic instruction operation subunit supports N-bit operation; The basic instructions further comprise: A comparison instruction for comparing the sizes of a first comparison operand and a second comparison operand and outputting a comparison result; The first comparison operand and the second comparison operand are both N bits.

7. The processor of claim 3, wherein, The basic instruction operation subunit supports N-bit operation; The basic instructions further comprise one or more of the following: A right shift instruction for right shifting a first right shift operand by a second right shift operand as a right shift number, wherein the first right shift operand is N bits; A left shift instruction for left shifting a first left shift operand by a second left shift operand as a left shift number, wherein the first left shift operand is N bits.

8. The processor of claim 7, wherein, The basic instructions further satisfy one or more of the following: The result obtained by right shifting the first right shift operand is stored in the storage address of the first right shift operand; The result of right shifting the first right shift operand is N bits; The result of left shifting the first left shift operand is stored in the storage address of the first left shift operand; The result of left shifting the first left shift operand is N bits.

9. The processor of claim 3, wherein, The basic instruction operator unit supports operations of N bits; The basic instruction further comprises one or more of the following: a subtraction instruction, which outputs a subtraction result after performing a subtraction operation on a first subtraction operand and a second subtraction operand; an addition instruction, which outputs an addition result after performing an addition operation on a first addition operand and a second addition operand.

10. The processor of claim 9, wherein, The basic instruction further satisfies one or more of the following: The first subtraction operand and the second subtraction operand are N bits and are both less than the value of the prime number p; The first subtraction operand is greater than the second subtraction operand; The result of the subtraction operation is stored in the storage address of the first subtraction operand; The result of the subtraction operation is N bits; The first addition operand and the second addition operand are less than N bits and are both less than the value of the prime number p; The result of the addition operation is stored in the storage address of the first addition operand; The result of the addition operation is an integer less than or equal to N bits.

11. The processor of claim 1, wherein, The basic instruction is added to an instruction set architecture executed by the processor.

12. A data processing method, characterized by, It comprises: obtaining to-be-processed data; decomposing part or all of point multiplication operations of an elliptic curve cryptography algorithm into point addition operations and point doubling operations, decomposing the point addition operations into a first basic operation set, and decomposing the point doubling operations into a second basic operation set to obtain a decomposed elliptic curve cryptography algorithm; determining a data processing result of the to-be-processed data according to the decomposed elliptic curve cryptography algorithm; wherein part or all of the operations in the first basic operation set can be performed by using basic instructions, and part or all of the operations in the second basic operation set can be performed by using basic instructions; Part or all of the basic instructions are modulus operation instructions obtained by using a prime number p as a modulus.

13. The data processing method according to claim 12, characterized in that, The elliptic curve cryptography algorithm is used for a processor, the processor comprising a basic instruction operator unit for performing operations on the basic instructions, the basic instructions comprising modulus subtraction instructions, modulus addition instructions, modulus multiplication instructions, and comparison instructions; decomposing the point addition operations into a first basic operation set comprises: decomposing the point addition operations into a first basic operation set comprising only modulus subtraction operations, modulus addition operations, modulus multiplication operations, and comparison operations; wherein the modulus subtraction operations can call the basic instruction operator unit to perform operations on the modulus subtraction instructions, the modulus addition operations can call the basic instruction operator unit to perform operations on the modulus addition instructions, the modulus multiplication operations can call the basic instruction operator unit to perform operations on the modulus multiplication instructions, and the comparison operations can call the basic instruction operator unit to perform operations on the comparison instructions.

14. The data processing method according to claim 12, characterized in that, The elliptic curve cryptography algorithm is used for a processor, the processor comprising a basic instruction operation subunit for operating on basic instructions, the basic instructions comprising a modulo subtraction instruction, a modulo addition instruction, a modulo multiplication instruction, a comparison instruction and a right shift instruction; The point multiplication operation is decomposed into a second basic operation set, comprising: The point multiplication operation is decomposed into a second basic operation set comprising only a modulo subtraction operation, a modulo addition operation, a modulo multiplication operation, a comparison operation and a right shift operation; The modulo subtraction operation can call the basic instruction operation subunit to operate on the modulo subtraction instruction, the modulo addition operation can call the basic instruction operation subunit to operate on the modulo addition instruction, the modulo multiplication operation can call the basic instruction operation subunit to operate on the modulo multiplication instruction, the comparison operation can call the basic instruction operation subunit to operate on the comparison instruction, and the right shift operation can call the basic instruction operation subunit to operate on the right shift instruction.

15. The data processing method according to claim 12, characterized in that, The elliptic curve cryptography algorithm comprises an SM2 encryption algorithm; The operation steps of the SM2 encryption algorithm comprise one or more of the following: Input plaintext M and public key P B ; generating a random number k; calling the basic instructions in the first basic operation set and the second basic operation set to perform a first point multiplication operation, the first point multiplication operation being used to determine a first elliptic curve C1=k·G=(x1,y1), G being used to represent a base point of the elliptic curve; invoking a base instruction in the first and second base set of operations for a second point multiplication operation, the second point multiplication operation for determining a second elliptic curve k-P B = (x2, y2); converting the elliptic curve point coordinates (x2,y2) into a key t matching the length of the plaintext M through a key derivation function KDF; in response to the key t being a non-all-0 bit string, performing a bit-by-bit exclusive OR operation on the plaintext M and the key t to generate a ciphertext C2; calculating a hash value C3 after splicing the elliptic curve point coordinates (x2,y2) and the plaintext M; assembling to obtain a ciphertext C=C1||C3||C2.

16. The data processing method according to claim 15, characterized in that the determination of the first elliptic curve C1=k·G=(x1,y1) further comprises: after the first point multiplication operation, calling the basic instructions in the first basic operation set and the second basic operation set to output k·G in affine coordinates; and / or determining a second elliptic curve k · P B = (x2, y2), further comprising: After the second point multiplication operation, the basic instructions in the first and second basic operation sets are invoked to output the k*P affine coordinates B .

17. The data processing method of claim 15, wherein, The elliptic curve cryptography algorithm comprises an SM2 decryption algorithm; The operation steps of the SM2 decryption algorithm comprise one or more of the following: taking a bit string C1 from the ciphertext C as a temporary public key; calling a basic instruction in the first and second basic operation sets to determine a receiver private key d B performing a third point multiplication operation with the temporary public key C1 to obtain a shared point C1 · d B = (x2, y2); generating the key t using (x2,y2) through the key derivation function KDF; in response to the key t being a non-all-0 bit string, taking a bit string C2 from the ciphertext C, performing a bit-by-bit exclusive OR operation on the plaintext C2 and the key t to obtain a restored plaintext M'; recalculating a hash value u of (x2,M',y2), taking a bit string C3 from the ciphertext C, and comparing the C3 with the hash value u; in response to C3=u, outputting the decrypted plaintext M.

18. A data processing apparatus, characterized by comprising: an acquisition module configured to acquire to-be-processed data; a decomposition module configured to decompose part or all of point multiplication operation of the elliptic curve cryptography algorithm into point addition operation and point multiplication operation, decompose the point addition operation into a first set of basic operations, and decompose the point multiplication operation into a second set of basic operations, to obtain a decomposed elliptic curve cryptography algorithm; a determination module configured to determine a data processing result of the to-be-processed data according to the decomposed elliptic curve cryptography algorithm; wherein part or all of the operations in the first set of basic operations can be performed by using basic instructions, and part or all of the operations in the second set of basic operations can be performed by using basic instructions; part or all of the basic instructions are modulus operation instructions obtained by using a prime number p as a modulus.

19. A computer device, comprising: A processor comprising any one of claims 1-11.

20. A computer device, comprising: A processor and a memory, wherein the memory stores computer program instructions, and the processor invokes the computer program instructions stored in the memory to execute the data processing method of any one of claims 12-17.

21. A storage medium, characterized by A storage medium storing computer program instructions, wherein the computer program instructions are executed by a processor to implement the data processing method of any one of claims 12-17.

22. A computer program product, characterised in that, The computer program product comprises computer program instructions, wherein the computer program instructions are executed by a processor to implement the data processing method of any one of claims 12-17.

Images