An optimization method for elliptic curve scalar multiplication based on multi-window multi-base chain

Abstract

The application discloses a kind of based on multiple window multi-base chain elliptic curve scalar multiplication optimization method, device and equipment, which can be used in communication system core network.The method comprises the following steps: configuring parameter group arranged in descending order of window width, wherein the parameter group contains base set and window width w, and a corresponding candidate odd set is generated;Sliding re-encoding is performed on input scalar k, 0 is appended to even bit and right shifted k, and the re-encoding number with the smallest absolute value is found according to the priority of parameter group for odd bit, and if not found, wNAF rule is backed off, to obtain sparse number sequence D;According to fast / ct mode, pre-computed lookup table is generated by power chain combined with binary combination;D is scanned from high bit to low bit, and accumulator sequentially executes multiplication operation, and conditional addition operation is executed when non-zero number is encountered, to finally obtain scalar multiplication result.The method reduces the density of non-zero bit and side channel risk, improves operation efficiency, and adapts to various security scenarios.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to an elliptic curve scalar multiplication optimization method, apparatus and device based on multi-window multi-basis chain. Background Technology

[0002] In modern cryptography, elliptic curve cryptography (ECC) is widely used in various scenarios such as digital signatures, key exchange, blockchain, and zero-knowledge proofs due to its advantages of smaller key size and faster computation speed while maintaining the same security strength. Elliptic curve scalar multiplication, i.e., calculating point Q=k·P (where P is the base point and k is the scalar), is the core operation of ECC, and its performance directly determines the efficiency of the entire cryptographic system.

[0003] To improve the performance of scalar multiplication, various optimization algorithms have been proposed in the industry. The basic "doubling-adding" method is inefficient due to the excessive number of additions. The Non-Adjacent Form (NAF) reduces the non-zero bit density of the scalar from approximately n / 2 to n / 3 by introducing negative bits. The Windowed NAF (wNAF) method further optimizes this by processing the scalar with a window of width w, reducing the non-zero bit density to approximately 1 / (w+1), but at the cost of pre-compiling and storing 2^(w-2) points.

[0004] However, existing technologies still have several problems: the choice of window width w in the wNAF method faces a trade-off: increasing w can reduce the number of point addition operations in the main loop, but the size of the pre-computation table and the computational overhead will increase exponentially with w, which will be a heavy burden on resource-constrained devices (such as IoT terminals and smart cards) or single-operation scenarios.

[0005] Furthermore, the traditional wNAF's candidate number set is limited to {±1,±3,...,±(2^(w-1)-1)}, and its construction is entirely based on powers of 2. Multi-radix representations (such as τ-ad_ic NAF) demonstrate that introducing non-2-radix representations can yield sparser scalar representations, but universalizing this idea and efficiently combining it with the sliding window method remains a technical challenge. Moreover, during the evaluation phase, wNAF needs to access the pre-computation table based on the number d_i recoded from the secret scalar k. This memory access mode, dependent on secret data, is vulnerable to side-channel attacks such as timing attacks and cache attacks, potentially leaking key information. Therefore, a new scheme is urgently needed to achieve efficient, flexible, and secure computation of elliptic curve scalar multiplication.

[0006] The aforementioned issues are particularly prominent in high-performance, high-concurrency scenarios such as 5G core networks. In the 5G core network security architecture, the confidentiality and integrity protection of user plane data relies on key derivation and fast authentication mechanisms based on elliptic curve cryptography. As a data forwarding hub, the core network user plane function (UPF) gateway needs to generate and update session keys in real time for massive concurrent user sessions and process integrity verification codes for high-speed data streams. Summary of the Invention

[0007] The main objective of this application is to provide an elliptic curve scalar multiplication optimization method, apparatus, and device based on multi-window multi-base chain, aiming to significantly reduce the non-zero bit density and directly reduce the number of core operations to achieve efficient, flexible, and secure computation of elliptic curve scalar multiplication. This reduces the size and energy consumption of the core network equipment cluster, while also defending against side-channel attacks targeting the key derivation process, meeting the stringent requirements of high performance and high security in 5G enhanced mobile broadband and massive IoT connection scenarios.

[0008] To achieve the above objectives, this application provides an elliptic curve scalar multiplication optimization method based on a multi-window, multi-basis-chain approach, comprising: configuring multiple parameter groups arranged in descending order of window width, each parameter group including a cardinality set and a window width w, wherein the cardinality set is a tuple containing one or more small prime numbers or an empty tuple; generating a corresponding candidate odd number set according to each parameter group, the candidate odd number set being generated through iterative expansion via a multi-basis-chain approach; constructing an empty number sequence; performing sliding recoding on the input scalar k; when the least significant bit in k is even, appending 0 to the number sequence and shifting k one bit to the right; when the least significant bit in k is odd, traversing the candidate odd number set according to parameter group priority to find a value modulo 2 with k. w The odd number with the smallest absolute value and congruence is used as the recoded number. If not found, the recoded number is determined by the standard wNAF rule with the minimum window width. The recoded number is appended to the end of the number sequence to obtain the sparse number sequence D. According to the selected fast mode or ct mode, a pre-computation lookup table is generated by using an exponential chain combined with binary combination algorithm. The accumulator point is initialized as the identity element of the elliptic curve group, and the sparse number sequence D is scanned from the high bit to the low bit. The doubling operation is performed on the accumulator in turn to finally obtain the elliptic curve scalar multiplication result.

[0009] Optionally, generating a corresponding candidate odd number set for each parameter group includes: if the cardinality set is empty, then the candidate odd number set includes all numbers whose absolute value is less than 2. w-1 The set of odd numbers is composed of their opposites; if the cardinality set is not empty, the candidate odd number set is generated through the following iterative expansion process: the working set is initialized to {1}, and then... w-1The upper limit of the absolute value of the candidate odd numbers; for each base number in the base set, multiply each element in the working set by this base number, and add the results less than the absolute value upper limit in the product to the working set; repeat the above steps until the working set no longer changes; screen out all odd numbers from the final working set and add the opposite numbers of each odd number to obtain the candidate odd number set of this parameter group.

[0010] Optionally, sort the obtained candidate odd number set according to the rules of ascending absolute value and ascending numerical value, so that when looking for an odd number congruent to the scalar k, the representative with the smallest absolute value can be found first, thereby obtaining a sparser scalar representation. Optionally, the standard wNAF rule for falling back to the minimum window width determines the recoded digit, including: determining the minimum window width wmin in all parameter groups; calculating the intermediate value utemp = k & ((1 << wmin) - 1); judging utemp ≥ 2^(wmin - 1), then u = utemp - 2^wmin, otherwise u = utemp, and taking u as the recoded digit of the scalar k; where, u satisfies |u| < 2^(w_min - 1) and u ≡ k (mod 2^w_min).

[0011] Optionally, the power chain combines with the binary combination algorithm, including: determining the set S_pre of odd numbers that need to be precomputed according to the selected mode: in the fast mode, S_pre is the set composed of the absolute values of all non-zero digits in the sparse digit sequence D; in the ct mode, S_pre is the union of the absolute values of all non-zero digits in the candidate odd number sets of all parameter groups; determining the maximum value s_max in S_pre; performing consecutive point doubling operations on the base point P to generate the power chain [P, 2P, 4P,..., 2floor(log2(s_max))· P], where s_max is the largest target odd number and floor represents rounding down; for each odd number s in S_pre, according to the binary representation of s, add the points corresponding to the bits with 1 in the power chain to obtain the precomputed point s·P; construct a precomputed lookup table with each odd number s as the key and the corresponding precomputed point s·P as the value.

[0012] Optionally, scanning the sparse digit sequence D from high to low and performing point doubling operations on the accumulator in turn, including: performing a point doubling operation on the accumulator to obtain the doubled accumulator; if the recoded digit d_i of the current bit is not zero: in the fast mode, directly obtain the precomputed point with the key |d_i| from the precomputed lookup table; in the ct mode, traverse the precomputed lookup table in a fixed order and select the precomputed point with the key |d_i| through a data-independent conditional operation; if d_i is negative, then take the opposite of the obtained precomputed point; perform a point addition operation using the processed precomputed point and the doubled accumulator.

[0013] Optionally, the step of adding the points with corresponding bits of 1 in the power chain according to the binary representation of s to obtain the pre-calculated point s·P includes: determining the decimal value of s from the high bit to the low bit based on the binary representation of s; and in the power chain, determining the points with corresponding bits of 1 according to the decimal value and adding them to obtain the pre-calculated point s·P.

[0014] Furthermore, to achieve the above objectives, this application also provides an elliptic curve scalar multiplication optimization device based on a multi-window, multi-basis-chain approach, comprising: an odd number set generation module, configured to configure multiple parameter sets arranged in descending order of window width, each parameter set including a base set and a window width w, wherein the base set is a tuple containing one or more small prime numbers or an empty tuple; and generating a corresponding candidate odd number set according to each parameter set, wherein the candidate odd number set is generated through iterative expansion via a multi-basis-chain approach; and a scalar encoding module, configured to construct an empty number sequence, perform sliding recoding on the input scalar k, append 0 to the number sequence and shift k one bit to the right when the least significant bit of k is even; and when the least significant bit of k is odd, traverse the candidate odd number set according to parameter set priority to find a value modulo 2 with k. w The odd number with the smallest absolute value and congruence is used as the recoded number. If not found, the recoded number is determined by the standard wNAF rule with the minimum window width. The recoded number is appended to the end of the number sequence to obtain the sparse number sequence D. The pre-computation generation module is used to generate a pre-computation lookup table based on the selected fast mode or ct mode using an exponential chain combined with binary combination algorithm. The elliptic curve scalar generation module is used to initialize the accumulator point as the identity element of the elliptic curve group and scan the sparse number sequence D from the high bit to the low bit, performing doubling operations on the accumulator in sequence to finally obtain the elliptic curve scalar multiplication result.

[0015] To achieve the above objectives, this application also provides an electronic device, the electronic device comprising: at least one processor, a memory, and an input / output unit; wherein the memory is used to store a computer program, and the processor is used to call the computer program stored in the memory to execute the elliptic curve scalar multiplication optimization method based on multi-window multi-basis chain provided in any of the foregoing embodiments.

[0016] This application proposes an elliptic curve scalar multiplication optimization method, apparatus, and device based on multi-window multi-basis chain. The method includes configuring multiple parameter groups arranged in descending order of window width. Each parameter group includes a cardinality set and a window width w. The cardinality set is a tuple containing one or more small prime numbers or an empty tuple. A corresponding candidate odd number set is generated based on each parameter group, and the candidate odd number set is generated through iterative expansion using a multi-basis chain. An empty number sequence is constructed, and sliding recoding is performed on the input scalar k. When the least significant bit of k is even, 0 is appended to the number sequence and k is shifted right by one bit. When the least significant bit of k is odd, the candidate odd number set is traversed according to parameter group priority to find a value modulo 2 with k. w The odd number with the smallest absolute value and congruence is used as the recoded number. If not found, the recoded number is determined by the standard wNAF rule with the minimum window width. The recoded number is appended to the end of the number sequence to obtain the sparse number sequence D. According to the selected fast mode or ct mode, a pre-computation lookup table is generated using an exponential chain combined with binary combination algorithm. The accumulator point is initialized as the identity element of the elliptic curve group, and the sparse number sequence D is scanned from the high bit to the low bit. The doubling operation is performed on the accumulator in turn to obtain the elliptic curve scalar multiplication result. This application achieves a significant reduction in non-zero bit density by combining multi-window priority, multi-radix expansion and congruence minimum algebra selection, thereby directly reducing the number of core operations. Meanwhile, this application significantly reduces the constant overhead of a unit operation by adopting an efficient exponential chain combined with a binary combination precomputation strategy and specialized underlying point operation primitives, thereby further improving the computation speed. The comprehensive optimization scheme proposed in this application is applicable to various modern cryptographic application fields with high requirements for both computational performance and information security, including but not limited to signature generation and verification of digital signature schemes (such as ECDSA), key derivation of key exchange protocols (such as ECDH), transaction verification in blockchain consensus algorithms, proof generation in zero-knowledge proof systems (such as zk-SNARKs), and various lightweight cryptographic protocols running on mobile and IoT terminals. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating an embodiment of the elliptic curve scalar multiplication optimization method based on multi-window multi-basis chains in this application.

[0018] Figure 2 This is a system functional block diagram provided in an embodiment of the elliptic curve scalar multiplication optimization method based on multi-window multi-basis chain in this application;

[0019] Figure 3 This is a schematic diagram of stage segmentation provided in an embodiment of the elliptic curve scalar multiplication optimization method based on multi-window multi-basis chain in this application.

[0020] Figure 4This is a schematic diagram of the multi-window multi-base chain sliding recoding process provided in an embodiment of the elliptic curve scalar multiplication optimization method based on multi-window multi-base chains in this application.

[0021] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0022] It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0023] In existing technologies, for high-performance, high-concurrency scenarios such as 5G core networks, the mainstream acceleration solutions mainly adopt Non-Adjacent Form (NAF) and its windowed extension (wNAF). wNAF reduces the non-zero bit density to about 1 / (w+1) by introducing a window of width w and an odd number set {±1,±3,...,±(2(w-1)-1)}, which can significantly reduce the number of additions in the main loop. However, this comes at the cost of requiring a pre-computed lookup table of size 2^(w-2), and the larger w is, the more exponentially the startup latency and memory usage increase. To reduce the startup burden, engineering often involves a trade-off between "limited density reduction with smaller w" and "excessively large table with larger w", resulting in limited performance and resource trade-offs.

[0024] In fixed-base-point scenarios, table-driven methods such as fixed-window / comb are widely used. These methods utilize a common base point to build large-scale lookup tables offline, and complete the scan and evaluation in a fixed access sequence during runtime, resulting in high throughput and suitability for MSM subtasks in batch signature verification and proof systems. However, these methods are only applicable to fixed base points and are difficult to reuse for variable base points (such as general signature generation and key negotiation); at the same time, the large tables bring high caching pressure and platform migration costs, limiting their application on resource-constrained devices. Improvements for variable base points include JSF (double scalar concatenation encoding) and GLV / GLS (automorphic decomposition), but the former is only effective for double scalars, and the latter relies on curved automorphism, limiting its versatility.

[0025] At the side-channel and implementation levels, the Mont gomery / regular ladder method is commonly used. This method employs a fixed table full scan combined with mask selection (cmov) and a unified / complete addition formula to eliminate data-related branches and caches, thereby resisting timing and cache attacks. However, the long-time strategy of this type of method usually sacrifices some peak speed. The underlying layer also generates odd-numbered multiples by combining curve coordinates and formula specialization (such as dedicated multiples of Jacobian coordinates) with "power chain + binary combination", and reduces the unit operation constant through memory layout and vectorization. However, these optimizations are mostly "point-like improvements", and it is difficult to simultaneously achieve lower non-zero bit density, controlled pre-computation scale, and long-term access, thus still having comprehensive bottlenecks in performance, resources, and security.

[0026] Key terms and abbreviations:

[0027] WMB: multi-window multi-base;

[0028] wNAF: windowed non-adjacent form;

[0029] fast mode: builds a pre-computed lookup table only for the absolute values ​​used in this instance;

[0030] CT mode: Constructs a table for the entire set and selects masks in a fixed order;

[0031] LSB-first: Re-encode starting from the least significant bit;

[0032] G1 point: In elliptic curve pairing (such as BLS12-381), the element in the cyclic subgroup G1 defined on the base domain. This point can be represented by Jacobian coordinates (x, y, z).

[0033] To address the aforementioned technical problems in the existing technology, the main technical solution proposed in this application is as follows: For the input scalar k, sliding recoding is performed using multiple parameter groups arranged in descending order of window width, where each parameter group consists of a base set and a window width w; for each odd position of the scalar k, the parameter group with the larger window width is used first, and in the candidate odd number set generated by the multi-base chain associated with that group, the odd number that is congruent to the current value of the scalar k modulo 2^w and has the smallest absolute value is searched as the recoded number for that position; if no matching congruent odd number is found in all parameter groups, the process reverts to using the standard wNAF rule with the smallest window width to determine the recoded number for that position; based on the recoded sparse number sequence, scalar multiplication is performed using pre-computation points and the doubling-addition method, where the pre-computation points can be generated on demand (fast mode) or generated from the entire set (ct mode).

[0034] Preferably, the method for generating the candidate odd number set from the multi-base chain includes: initializing a working set as {1}; iteratively multiplying all elements in the current set by each base in the base set, and adding the result where the product is less than 2^(w-1) to the working set; repeating this process until the set no longer changes; filtering out all odd numbers in the working set and adding their opposites to form the final candidate odd number set.

[0035] Preferably, before the scalar multiplication calculation, the method further includes: efficiently generating a pre-computation point table using a combination of exponentiation chains and binary combinations; wherein, the exponentiation chain is generated by performing continuous doubling operations on the base point P to generate [P, 2P, 4P, ..., 2floor(log2(s_max))·P]. The binary combination is then performed by adding the corresponding points in the exponentiation chain according to the binary representation of the target odd number s to obtain s·P.

[0036] Preferably, this method also provides two evaluation modes: fast mode, which constructs a pre-computed lookup table only for the absolute values ​​of the non-zero digits that actually appear in the recoded digit sequence; ct mode, which constructs a fixed-size pre-computed lookup table for the union of the absolute values ​​of the non-zero digits in the candidate odd number sets of all parameter groups, and selects the points through fixed-order access and masking operations during evaluation to reduce the risk of side-channel attacks.

[0037] Preferably, during the scanning and evaluation phase, the sparse number sequence is scanned from the most significant bit to the least significant bit (MSB-first), and a doubling operation is performed on each bit. When a non-zero bit is encountered, a dot addition operation is performed again.

[0038] Preferably, in the dot addition operation, if the non-zero digit is negative, the dot is inverted from the point retrieved from the pre-calculated lookup table before the dot addition operation is performed.

[0039] Understandably, this invention can be applied to the core cryptographic computation stages in this scenario: accelerating the execution of elliptic curve d_iffie-Hellman (ECDH) shared secret computation for key derivation in the UPF gateway, and the scalar multiplication operations required in the HMAC-based key derivation function for generating data integrity authentication labels. Through multi-window, multi-base-chain sliding recoding technology, the efficiency of scalar multiplication operations is improved by approximately 34% while maintaining the same security strength. This allows a single UPF gateway to support a higher number of concurrent user sessions (improving by approximately 30%), thereby reducing the size and energy consumption of the core network equipment cluster. Simultaneously, its optional security modes can defend against side-channel attacks targeting the key derivation process, meeting the stringent requirements of high performance and high security in 5G enhanced mobile broadband and massive IoT connectivity scenarios.

[0040] To more clearly and completely illustrate the technical solutions of the embodiments of this application, the following will be combined with the appendix. Figures 1 to 4 This application provides a more detailed description of the specific implementation process, module interaction, and internal working principle of an elliptic curve scalar multiplication optimization method based on multi-window multi-basis chains.

[0041] Reference Figure 1The first embodiment of this application provides an elliptic curve scalar multiplication optimization method based on multi-window multi-basis chains. This method can be executed by a core network processor. The elliptic curve scalar multiplication optimization method based on multi-window multi-basis chains may include the following:

[0042] S101. Configure multiple parameter groups arranged in descending order of window width. Each parameter group includes a cardinality set and a window width w. The cardinality set is a tuple containing one or more small prime numbers or an empty tuple. Generate a corresponding candidate odd number set based on each parameter group. The candidate odd number set is generated through iterative expansion using a multi-basis chain.

[0043] For example, the processor first needs to define one or more sets of parameters g = (bases, w), which will guide the subsequent recoding process. These parameters are typically managed by the parameter configuration module 110 as static configurations of the system. Each parameter set g is a tuple where w is a positive integer representing the window width, which determines the lower w bits of the scalar k that the algorithm will examine at each step of the recoding. bases is a tuple containing one or more small prime numbers, such as (3, 5), which are called "radix" and are used to generate a richer set of candidate numbers through multiplication expansion. A special bases value is an empty tuple (), indicating that the parameter set follows the traditional, purely power-of-2-based wNAF rule. A proven efficient configuration list G is [((3, 5), 6), ((3, 5), 5), ((), 4)].

[0044] The priority rules for the above parameter groups are as follows:

[0045] Highest priority rule: Use a window width w=6 and combine the base 3 and 5 to generate candidate numbers.

[0046] Second highest priority rule: If the rule for w=6 does not apply, then try window w=5, also combining base 3 and 5.

[0047] Lowest priority / rollback rule: last try window w=4, and do not use additional cardinality (i.e. pure wNAF).

[0048] It is important to note that this configuration list must be strictly sorted in descending order of window width w. This sorting is crucial because it establishes a greedy strategy in the recoding process: always prioritize large windows that can process more bits at once, in order to maximize the efficiency of each recoding step and thus obtain a sparser final representation.

[0049] In one embodiment of this application, generating a corresponding set of candidate odd numbers based on each parameter group includes:

[0050] If the cardinality set is empty, then the candidate odd number set includes all numbers whose absolute value is less than 2. w-1 It consists of odd numbers and their opposites;

[0051] If the cardinality set is not empty, then the candidate odd number set is generated through the following iterative expansion process:

[0052] The initial working set is {1}, and it is set to 2. w-1 The upper limit of the absolute value of candidate odd numbers;

[0053] For each cardinality in the cardinality set, multiply each element in the working set by that cardinality, and add any product smaller than the upper limit of absolute value to the working set;

[0054] Repeat the above steps until the working set no longer changes;

[0055] All odd numbers are selected from the final working set, and the opposites of each odd number are added to obtain the candidate odd number set for this parameter group.

[0056] The process for determining the working set is as follows:

[0057] The working set is the set initialized to {1};

[0058] Step 1: Work set = {1} (Initially there is only one 1);

[0059] Step 2: Multiply the number in the working set by 3;

[0060] 1 × 3 = 3 → Add 3 to the working set;

[0061] The current work set is {1, 3}.

[0062] Step 3: Multiply the number in the working set by 5;

[0063] 1×5=5 → Add 5;

[0064] 3 × 5 = 15 → Add 15;

[0065] The current work set is {1, 3, 5, 15}.

[0066] Step 4: Multiply by 3 again (because the set has changed);

[0067] 5 × 3 = 15 (already available);

[0068] 15 × 3 = 45 (>32, do not use);

[0069] The working set remains {1, 3, 5, 15};

[0070] Step 5: Multiply by 5 again;

[0071] 3 × 5 = 15 (already available);

[0072] 5×5=25 → Add 25;

[0073] 15 × 5 = 75 (>32, do not use);

[0074] The current working set is {1, 3, 5, 15, 25}.

[0075] Optionally, the elliptic curve scalar multiplication optimization method based on multi-window multi-basis chains in this application may also include the following:

[0076] The obtained candidate odd number set is sorted according to the rules of ascending absolute value and ascending numerical value to obtain the sorted candidate odd number set.

[0077] Please refer to Figures 2 through 4. Figure 2 Figure 1 is a system functional block diagram of the method of the present invention, which clearly shows the core functional units that constitute the system and their interrelationships. Figure 3 is an overall flowchart of the method of the present invention, which macroscopically depicts the four main stages from input to output. Figure 4 This is a detailed flowchart of the multi-window, multi-base-chain sliding recoding, which reveals the most innovative scalar processing mechanism of this invention.

[0078] As shown in Figure 3, the elliptic curve scalar multiplication optimization method based on multi-window multi-basis chains provided in this application can be divided into the following four closely connected stages: Stage 1: Parameter configuration and initialization; Stage 2: Scalar sliding recoding; Stage 3: Pre-computation stage; and Stage 4: Scan evaluation stage. The specific steps and technical details of each stage will be described in detail below.

[0079] Phase 1: Parameter configuration and initialization.

[0080] In this stage, odd numbers are selected because scalar recoding requires building a candidate set based on odd numbers, and adding the opposite number can enrich the candidate range and meet the requirements for representing positive and negative values.

[0081] For example, for each parameter group gi, the processor needs to generate a corresponding set of candidate odd numbers Si. This process can be completed once during system initialization and cached, or it can be dynamically generated upon first use. The dynamic generation logic is as follows:

[0082] For a pure wNAF set (basesi is empty), Si is generated in a very straightforward way, containing all odd numbers whose absolute value is less than 2^(w_i-1). For example, for g=((),4), w=4, the upper bound is 2^(4-1)=8, so Si is {±1,±3,±5,±7};

[0083] For a multi-base chain set (basesi is not empty), the generation of Si is an iterative expansion process. Taking g=((3,5),6) as an example, w=6, and the upper bound is 2^(6-1)=32:

[0084] Initialize the working set `seen = {1}`;

[0085] Expanding using radix 3: Starting from 1, 1×3=3, 3×3=9, 9×3=27, add {3,9,27} to the working set seen;

[0086] Expand using radix 5: Multiply all elements ({1,3,9,27}) in the current working set seen by 5 respectively, to get 1×5=5, 3×5=15, 9×5=45 (32 is discarded because it exceeds the upper bound), 27×5=135 (27 is discarded because it exceeds the upper bound), and add {5,15} to the working set seen;

[0087] After the iteration, the working set seen contains all numbers less than 32 formed by multiplying 1, 3, and 5: {1,3,5,9,15,27}.

[0088] By filtering out all odd numbers in the working set seen and adding their opposites, we finally obtain Si = {±1,±3,±5,±9,±15,±27}.

[0089] Next, the processor sorts the generated Si according to deterministic rules. The absolute value of the number is used as the first sorting key (ascending order), and the value of the number itself is used as the second sorting key (ascending order). For example, the first few elements of Si after sorting might be [1,-1,3,-3,5,-5,...]. This sorting ensures that when searching for congruent representations, the first match is always the one with the smallest absolute value among all possible matches. This is key to achieving optimal sparsity, thus obtaining the sorted set of candidate odd numbers.

[0090] Clearly, by iteratively expanding the candidate odd number set through multi-base chains, more elements with better sparsity can be introduced compared to the traditional wNAF fixed candidate set, laying the foundation for reducing the density of non-zero bits in the future; while the sorting rule ensures the optimal selection of congruent representatives, further improving the recoding efficiency.

[0091] S102. Construct an empty number sequence. Perform sliding recoding on the input scalar k. When the least significant bit of k is even, append 0 to the number sequence and shift k one bit to the right. When the least significant bit of k is odd, traverse the candidate odd number set according to the parameter group priority to find a value modulo 2 with k. wUse the odd number that is congruent and has the smallest absolute value as the recoded digit. If not found, fallback to the standard wNAF rule with the smallest window width to determine the recoded digit, and append the recoded digit to the end of the digit sequence to obtain the sparse digit sequence D.

[0092] This step S102 corresponds to Phase II, which is executed by the sliding recoding module 120.

[0093] Specifically, sliding recoding starts from the least significant bit of the scalar k. For even bits, directly append 0 and shift k to the right, which can efficiently handle consecutive zero bits.

[0094] Exemplarily, as Figure 4 shown, for the input scalar k and base point P, the sliding recoding module 120 can perform the following operations:

[0095] S1021: Initialize to start the recoding process. The system initializes an empty list, which is used to sequentially store each recoded digit generated from the least significant bit to the most significant bit of k.

[0096] S1022 - S1027 are the main loop. In the main loop, as long as the value of k is still greater than 0, continuously execute the following loop body:

[0097] S1023: Even bit processing. In each step of the loop, first check the least significant bit of k. If k is even (k&1 == 0), it means the current bit is 0 in the binary representation and also corresponds to 0 in the sparse representation. Therefore, append 0 to the digit sequence, then logically shift k one bit to the right (k ← k>>1, which is equivalent to dividing by 2 and discarding the remainder), and then directly return to S1022 to start the next loop. This step can ensure that all consecutive zero bits in k are efficiently processed.

[0098] S1024: Odd bit processing. The processor needs to find the congruence representative. If k is odd, it needs to find the optimal non - zero odd number u representation for its lower bits. The processor traverses the parameter group gi in the order defined in S101 (w from large to small):

[0099] For the current parameter group gi=(basesi,wi), efficiently calculate the non - negative remainder of k modulo 2^wi through bit operation mod = k&((1<<wi)-1). This mod value captures the low wi - bit information of k;

[0100] In the sorted candidate digit set Si associated with gi, the processor can sequentially search from the beginning to the end for the first digit s that satisfies the congruence relation s ≡ mod (mod 2^wi). This congruence relation is quickly judged through bit operation (s&((1<<wi)-1))==mod.

[0101] S1025: Matching is successful. Since the parameter groups are sorted in descending order of w, once a matching s is found in a certain group gi, it means that the congruence representative that is valid under the large window rule and guaranteed to have the smallest absolute value due to the sorting of Si is obtained. At this time, the processor can immediately select u = s, jump out of the traversal of the parameter groups through the break statement, and directly enter S1027 to update the state.

[0102] S1026: Matching fails and fallback. If no matching s is found after traversing all the preset parameter groups, the system starts the fallback mechanism to ensure the completeness of the algorithm:

[0103] S1027: Update the state. Whether it is a successful match through S1025 or a fallback through S1026, a definite non-zero number u is obtained, and it is appended to the end of the list. Subsequently, the processor can update the scalar k. Since the design of u ensures that k = u (mod ^2) (both k and u are odd), k - u must be even. Therefore, the processor can update k to (k - u) >> 1 without loss. Then return to S1022 to start processing the new k value.

[0104] When k finally becomes 0, the loop terminates. At this time, the sparse digital sequence D of k from the low bit to the high bit is stored in the list.

[0105] After obtaining the sparse digital sequence D of the sparse representation, the processor needs to prepare a lookup table (precomputed point table precomp) for the evaluation phase, and this phase is executed by the precomputation module 130.

[0106] In this embodiment, the process of determining the recoded digit by falling back to the standard wNAF rule with the minimum window width may include the following:

[0107] Determine the minimum window width wmin in all parameter groups;

[0108] Calculate the intermediate value utemp = k & ((1 << wmin) - 1); judge whether utemp ≥ 2 ^ (wmin - 1). If so, u = utemp - 2 ^ wmin, otherwise u = utemp, and take u as the recoded digit of the scalar k;

[0109] Where u satisfies |u| < 2(wmin - 1) and u ≡ k (mod 2 ^ wmin), and mod represents the modulo operation.

[0110] It should be noted that the backoff mechanism ensures the completeness of the recoding. Even if no matching element is found in the multi-base chain candidate set, a valid recoded number can still be obtained through the standard wNAF rules. Understandably, prioritizing the selection of a large window parameter set allows for the processing of more bits at once. Combined with the selection of the smallest absolute value congruence algebra, this significantly reduces the non-zero bit density of the sparse number sequence D. This recoding method solves the problem of rigidity in the traditional wNAF candidate set. By dynamically matching the optimal congruence representative, it makes the scalar representation sparser, providing core support for reducing the number of dot additions in the subsequent process.

[0111] S103. Based on the selected fast mode or ct mode, generate a pre-computed lookup table using an exponential chain combined with binary combination algorithm;

[0112] In one embodiment of this application, a pre-computed lookup table is generated using an exponential chain combined with a binary combination algorithm, including:

[0113] Determine the set of odd numbers S_pre that needs to be pre-computed based on the selected pattern:

[0114] In fast mode, S_pre is the set of absolute values ​​of all non-zero numbers in the sparse number sequence D;

[0115] In ct mode, S_pre is the union of the absolute values ​​of all non-zero numbers in the candidate odd number set of all parameter groups;

[0116] Determine the maximum value s_max in S_pre;

[0117] By performing consecutive doubling operations on the base point P, an exponential chain [P, 2P, 4P, ..., 2floor(log2(s_max))·P] is generated;

[0118] For each odd number s in S_pre, according to the binary representation of s, add the points in the power chain that are 1 in the corresponding bit to obtain the pre-calculated point s·P;

[0119] Construct a pre-computation lookup table with each odd number s as the key and the corresponding pre-computation point s·P as the value.

[0120] For example, this step S103 corresponds to stage three, namely the pre-calculation stage.

[0121] This stage can also be performed by the pre-calculation module 130, with the following specific steps:

[0122] S1031: Determine the pre-calculation range based on the user-selected mode, the multiple of points the processor needs to calculate and store:

[0123] In fast mode, users can pursue the highest runtime performance and the lowest memory footprint, pre-computing only the points actually needed for the current calculation. Specifically, the processor can traverse the sparse number sequence D, collecting the absolute values ​​|d_i| of all non-zero numbers d_i, forming a set needabs;

[0124] In CT mode, security is the primary concern for users. This mode is designed to resist side-channel attacks; therefore, it is necessary to eliminate the association between the pre-computed lookup table contents and the specific scalar k. Based on this, the processor takes the union of the absolute values ​​of all non-zero numbers in the candidate number set Si of all parameter groups, forming a fixed set needabs that is independent of k.

[0125] S1032: The processor efficiently generates each odd number s in the pre-computed point pair needabs and calculates s·P. To avoid inefficient and repetitive additions, this invention adopts a "power chain + binary combination" strategy, which may include the following steps:

[0126] Construct an exponential chain to determine the maximum value smax in needsabs. This is done by performing consecutive doubling operations on the base point P, generating a list of exponential chains [P, 2P, 4P, 8P, ..., 2^floor(log2(smax))·P]. For example, if smax = 27, the processor needs to calculate up to 16P.

[0127] Determine the binary combination and examine the binary representation of each s. For example, the binary representation of s=27 is 11011 (i.e., 16+8+2+1). Then 27·P can be obtained by adding the corresponding 16P, 8P, 2P, and P in the power chain. This process only involves 4 point additions, which is much faster than 26 consecutive additions.

[0128] S1033: Store the pre-computed lookup table, storing all the calculated s·P results into the dictionary (or hash table) structure precomp, where the key of precomp is the odd number s and the value is the corresponding point s·P.

[0129] Clearly, the fast mode collects the absolute values ​​of non-zero numbers on demand, which avoids redundant pre-computation and saves memory; the ct mode uses a fixed set, eliminating the association with the scalar k, and can adapt to security requirements.

[0130] S104. Initialize the accumulator point to the identity element of the elliptic curve group, and scan the sparse number sequence D from the high bit to the low bit, and perform the doubling operation on the accumulator in turn to finally obtain the elliptic curve scalar multiplication result.

[0131] In one embodiment of this application, the process of scanning the sparse digit sequence D from the most significant bit to the least significant bit and sequentially performing doubling operations on the accumulator may include the following:

[0132] Perform a doubling operation on the accumulator to obtain the doubled accumulator;

[0133] If the recoded number d_i in the current position is not zero:

[0134] In fast mode, the pre-computed point with key |d_i| is directly obtained from the pre-computed lookup table;

[0135] In ct mode, the pre-computed lookup table is traversed in a fixed order, and the pre-computed point with key |d_i| is selected by conditional operations without data dependencies;

[0136] If d_i is negative, then the obtained pre-calculated points will be inverted;

[0137] The point addition operation is performed using the pre-calculated points and the accumulator after doubling.

[0138] Step S104 above corresponds to stage four, namely the scan evaluation stage. Step S104 is the last step in performing scalar multiplication and is executed by the scan evaluation module 140. The processor needs to utilize the re-encoded result, i.e., the sparse number sequence D and the final result of the precomp lookup table precomp, to perform the scalar multiplication from the high-order bits to the low-order bits (MSB-first) of the sparse number sequence D. Therefore, the processor needs to traverse the sparse number sequence D in reverse order. The scan evaluation module 140 finally obtains the elliptic curve scalar multiplication result by interacting with the underlying point operation module 150. For example, the specific steps above are as follows:

[0139] S1041: Initialize the accumulator point R as the identity element (i.e., the point at infinity) of the elliptic curve group.

[0140] S1042-S1044: The main loop starts from the last element of the sparse number sequence D and iterates backward through each number d_i:

[0141] S1043: Before doubling the dot value for each d_i, regardless of whether d_i is zero or non-zero, a doubling operation must be performed on the accumulator R: R←double(R). The underlying dot operation module 150 needs to provide an optimized dedicated double function.

[0142] S1044: Conditional addition. If the current number d_i is not zero, perform an addition operation, which includes the following steps:

[0143] a. Look up the addend in a table:

[0144] In fast mode, pre-computed points can be efficiently obtained directly using addend=precomp[abs(d_i)].

[0145] In CT mode, to avoid accessing data dependencies, a pseudo-constant selection function is called. This function iterates through each entry (key, point) in precomp in a fixed order (e.g., the keys of precomp are sorted in ascending order). In each iteration, the mask mask=(key==abs(d_i)) is calculated (all 1s when matching, all 0s otherwise). Then, a branchless conditional selection or conditional addition operation is performed (e.g., R_selected=conditional_select(mask,point,identity_point)). Finally, only the matching points are selected.

[0146] b. Sign adjustment: Check the sign of d_i. If d_i is negative, then perform the inversion operation on the obtained addend: addend←neg(addend). In Jacobian coordinates, this operation usually only changes the sign of the Y coordinate, which is extremely low cost.

[0147] c. Accumulation: Add the sign-adjusted addend to the accumulator R: R←add(R,addend).

[0148] S1045: After traversing all the numbers in D, the accumulator R stores the final scalar multiplication result k·P.

[0149] It should be emphasized again that the elliptic curve scalar multiplication optimization method based on multi-window multi-base chain proposed in this invention is actually applied to the core network security infrastructure of next-generation mobile communication systems such as 5G / 6G, aiming to solve the performance bottleneck problem of cryptographic operations in massive concurrency scenarios.

[0150] Specifically, in the core network User Plane Function (UPF) gateway, a hub for data forwarding and secure processing, this method is integrated into its underlying cryptographic library. It can be used to accelerate two core public-key cryptographic algorithms: one is Elliptic Curve Diffie-Hellman Key Exchange (ECDH), which provides a shared session key to the UPF and terminal or controlled network elements during real-time secure negotiation; the other is to provide the necessary subkeys to elliptic curve-based data encryption and integrity verification algorithms.

[0151] The application within the algorithm is as follows: When the two core public-key cryptographic algorithms mentioned above need to perform the core operation k·P (i.e., a temporary key / derived key k multiplied by a public point P on the elliptic curve), this invention does not perform the calculation directly, but instead inserts an efficient "preprocessing" step. The core of this step is the intelligent reconstruction of the secret scalar k, using the "multi-window multi-base chain sliding recoding" technique to transform the originally lengthy binary private key into a highly concise optimal computational sequence composed of "doubling," "triple-doubling," and "point addition" instructions. The processor then only needs to strictly follow this preset sequence to obtain the same correct result with the fewest computational steps, thus significantly improving computational efficiency. In this way, this invention can be directly applied to UPF gateways, enabling them to complete key negotiation and derivation with higher throughput, thereby significantly increasing the number of concurrent user sessions supported by a single device while maintaining the same level of security, and significantly reducing the overall system energy consumption.

[0152] The elliptic curve scalar multiplication optimization method provided in this application will be described below with reference to a complete and specific embodiment.

[0153] In this embodiment, the elliptic curve is BLS12-381, the base point is G1 (in Jacobian triplet form (x,y,z)), and the scalar k is a 255-bit random integer.

[0154] System configuration: Parameter group G uses the default value [((3,5),6),((3,5),5),((),4)], and the evaluation mode is selected as fast.

[0155] Operation process: (1) Input a 255-bit scalar k. After receiving k, the sliding recoding module 120 performs recoding according to the configured G. For example, when processing a certain odd low bit of k, first try the rule w=6. If kmod64 can be represented by a certain odd number with a smaller absolute value in S_((3,5),6) (such as ±1, ±3, ±5, etc.), then select the odd number as the current bit number; otherwise, try the rule w=5, and so on. Finally, a sparse number sequence D with a length of about 253 bits is generated. Experimental statistics show that the average non-zero bit density of the sparse number sequence D is about 0.1771.

[0156] (2) The pre-computation module 130 analyzes the sparse number sequence D, collects the absolute values ​​of all non-zero numbers, and forms a set needabs (e.g., {1,3,5,9,15,...}). The module first calculates the power chain of G1 [G1,2G1,4G1,8G1,16G1] (because the maximum value in needabs is less than 32), and then generates pre-computation points through binary combination. For example, when calculating 15G1, 15 is represented as 8+4+2+1, and the point addition operation of (8G1)+(4G1)+(2G1)+G1 is performed. All results are stored in the precomp table.

[0157] (3) The scanning evaluation module 140 starts scanning from the highest bit of the sparse number sequence D. It performs a doubling operation once per step. If the current bit d_i is non-zero, it takes |d_i|·G1 from the precomp table, determines whether to invert it according to the sign of d_i, and then adds it to the current result R.

[0158] (4) Compared with the highly optimized official multiply function in the py-ecc[optimized] library, the average execution time of the fast mode in this embodiment is reduced from 7.258ms to 5.314ms, achieving an acceleration of about 1.366 times; if the ct mode is selected, the average execution time is 5.415ms, achieving an acceleration of about 1.340 times, while providing stronger resistance to side-channel attacks.

[0159] The table below lists the performance comparison data of this invention and the multiply function in the official py-ecc[optimized] library on the BLS12-381 curve. The test conditions were: 200 255-bit random scalars running in the same hardware environment.

[0160]

[0161] Data shows that the present invention achieves a performance improvement of more than 34% in both modes, while the CT mode provides important security guarantees with only a minimal performance sacrifice (about 1.9%).

[0162] Based on the above method embodiments, the second embodiment of this application also provides an elliptic curve scalar multiplication optimization device based on multi-window multi-basis chains to solve the same technical problem as the method embodiments. The device may include:

[0163] The odd number set generation module is used to configure multiple parameter groups arranged in descending order of window width. Each parameter group includes a cardinality set and a window width w. The cardinality set is a tuple containing one or more small prime numbers or an empty tuple. The module generates a corresponding candidate odd number set based on each parameter group. The candidate odd number set is generated through iterative expansion using a multi-basis chain.

[0164] The scalar encoding module constructs an empty number sequence and performs sliding recoding on the input scalar k. When the least significant bit in k is even, 0 is appended to the number sequence and k is shifted one bit to the right. When the least significant bit in k is odd, the module searches for the odd number that is congruent to k modulo 2w and has the smallest absolute value in the candidate odd number set according to the parameter group priority. If no such number is found, the module backtracks to the standard wNAF rule with the minimum window width to determine the recoded number. The recoded number is then appended to the end of the number sequence to obtain the sparse number sequence D.

[0165] The pre-computation generation module is used to generate a pre-computation lookup table based on the selected fast mode or ct mode, using an exponential chain combined with a binary combination algorithm.

[0166] The elliptic curve scalar generation module is used to initialize the accumulator points as the identity elements of the elliptic curve group, and scan the sparse digital sequence D from the high bit to the low bit, performing doubling operations on the accumulator in sequence, and finally obtaining the elliptic curve scalar multiplication result.

[0167] The third embodiment of this application also provides an electronic device, the electronic device comprising: at least one processor, a memory, and an input / output unit; wherein, the memory is used to store a computer program, and the processor is used to call the computer program stored in the memory to execute the elliptic curve scalar multiplication optimization method based on multi-window multi-basis chain provided in any of the foregoing embodiments.

[0168] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A multi-window multi-base scalar multiplication optimization method based on elliptic curve, characterized in that, Applied to the core network of communication systems, including: Configure multiple parameter groups arranged in descending order of window width. Each parameter group includes a cardinality set and a window width w. The cardinality set is a tuple containing one or more small prime numbers or an empty tuple. Generate a corresponding candidate odd number set based on each parameter group. The candidate odd number set is generated through iterative expansion using a multi-basis chain. Construct an empty sequence of numbers. Perform sliding recoding on the input scalar k. When the least significant bit of k is even, append 0 to the sequence and shift k one bit to the right. When the least significant bit of k is odd, traverse the candidate set of odd numbers according to parameter group priority to find a value modulo 2 with k. w The odd number with the smallest absolute value and congruence is used as the recoded number. If it is not found, the recoded number is determined by the standard wNAF rule with the smallest window width. The recoded number is appended to the end of the number sequence to obtain the sparse number sequence D, where the scalar is the core network user's private key. Based on the selected fast mode or ct mode, a pre-computed lookup table is generated using an exponential chain combined with binary combination algorithm. The accumulator point is initialized to the identity element of the elliptic curve group, and the sparse number sequence D is scanned from the high bit to the low bit. The doubling operation is performed on the accumulator in turn to finally obtain the elliptic curve scalar multiplication result. The method of generating a pre-computed lookup table using an exponential chaining combined with a binary combination algorithm includes: Determine the set of odd numbers S_pre that needs to be pre-computed based on the selected pattern: In fast mode, S_pre is the set of absolute values ​​of all non-zero numbers in the sparse number sequence D; in ct mode, S_pre is the union of absolute values ​​of all non-zero numbers in the candidate odd number set of all parameter groups. Determine the maximum value s_max in S_pre; Perform continuous doubling operations on the base point P to generate the power chain [P,2P,4P,...,2floor(log2(s_max))·P], where s_max is the maximum target odd number and floor represents rounding down; For each odd number s in S_pre, according to the binary representation of s, add the points in the power chain that are 1 in the corresponding bit to obtain the pre-calculated point s·P; Construct a pre-computation lookup table with each odd number s as the key and the corresponding pre-computation point s·P as the value. 2.The multi-window multi-base point scalar multiplication optimization method based on elliptic curve according to claim 1, wherein, The step of generating a corresponding set of candidate odd numbers based on each parameter group includes: If the cardinal set is empty, the candidate odd set includes all odd numbers whose absolute value is less than 2 w-1 and their opposites; If the cardinality set is not empty, then the candidate odd number set is generated through the following iterative expansion process: The initial working set is {1}, and it is set to 2. w-1 The upper limit of the absolute value of candidate odd numbers; For each cardinality in the cardinality set, multiply each element in the working set by that cardinality, and add any product smaller than the upper limit of absolute value to the working set; Repeat the above steps until the working set no longer changes; All odd numbers are selected from the final working set, and the opposites of each odd number are added to obtain the candidate odd number set for this parameter group.

3. The multi-window multi-base point based elliptic curve scalar multiplication optimization method of claim 1, wherein, The standard wNAF rule that falls back to the minimum window width determines the recoded digits, including: Determine the minimum window width wmin among all parameter groups; Calculate the intermediate value utemp = k & ((1< <wmin)-1); If utemp≥2^(wmin-1), then u=utemp-2^wmin; otherwise, u=utemp. Use u as the recoded number of scalar k. Among them, u satisfies |u| < 2^(w_min-1) and u ≡ k (mod 2^w_min).

4. The multi-window multi-base point based elliptic curve scalar multiplication optimization method of claim 1, wherein, The step of scanning the sparse digital sequence D from the most significant bit to the least significant bit and performing doubling operations on the accumulator sequentially includes: Perform a doubling operation on the accumulator to obtain the doubled accumulator; If the recoded number d_i in the current position is not zero: In fast mode, the pre-computed point with key |d_i| is directly obtained from the pre-computed lookup table; In ct mode, the pre-computed lookup table is traversed in a fixed order, and the pre-computed point with key |d_i| is selected by conditional operations without data dependencies; If d_i is negative, then the obtained pre-calculated points will be inverted; The point addition operation is performed using the pre-calculated points and the accumulator after doubling.

5. The elliptic curve scalar multiplication optimization method based on multi-window multi-basis chains as described in claim 1, characterized in that, The step of adding the points with corresponding 1 bits in the power chain according to the binary representation of s to obtain the pre-calculated point s·P includes: Based on the binary representation of s, the decimal value is determined sequentially from the most significant bit to the least significant bit. In the power chain, the points whose corresponding bits are 1 are determined based on the decimal values ​​and then added together to obtain the pre-calculated point s·P.

6. A multi-window multi-base scalar multiplication optimization device based on elliptic curve, characterized in that, include: The odd number set generation module is used to configure multiple parameter groups arranged in descending order of window width. Each parameter group includes a cardinality set and a window width w. The cardinality set is a tuple containing one or more small prime numbers or an empty tuple. The module generates a corresponding candidate odd number set based on each parameter group. The candidate odd number set is generated through iterative expansion using a multi-basis chain. The scalar encoding module constructs an empty number sequence and performs sliding recoding on the input scalar k. When the least significant bit of k is even, it appends 0 to the number sequence and shifts k one bit to the right. When the least significant bit of k is odd, it iterates through the candidate odd number set according to parameter group priority to find a value modulo 2 that is equal to k. w The odd number that is congruent and has the smallest absolute value is used as the recoded number. If it is not found, the recoded number is determined by the standard wNAF rule with the minimum window width. The recoded number is then appended to the end of the number sequence to obtain the sparse number sequence D. The pre-computation generation module is used to generate a pre-computation lookup table based on the selected fast mode or ct mode, using an exponential chain combined with a binary combination algorithm. The elliptic curve scalar generation module is used to initialize the accumulator points as the identity elements of the elliptic curve group, and scan the sparse digital sequence D from the high bit to the low bit, perform doubling operations on the accumulator in turn, and finally obtain the elliptic curve scalar multiplication result. The method of generating a pre-computed lookup table using an exponential chaining combined with a binary combination algorithm includes: Determine the set of odd numbers S_pre that needs to be pre-computed based on the selected pattern: In fast mode, S_pre is the set of absolute values ​​of all non-zero numbers in the sparse number sequence D; in ct mode, S_pre is the union of absolute values ​​of all non-zero numbers in the candidate odd number set of all parameter groups. Determine the maximum value s_max in S_pre; Perform continuous doubling operations on the base point P to generate the power chain [P,2P,4P,...,2floor(log2(s_max))·P], where s_max is the maximum target odd number and floor represents rounding down; For each odd number s in S_pre, according to the binary representation of s, add the points in the power chain that are 1 in the corresponding bit to obtain the pre-calculated point s·P; Construct a pre-computation lookup table with each odd number s as the key and the corresponding pre-computation point s·P as the value.

7. An electronic device, comprising: The electronic device includes: At least one processor, memory, and input / output unit; The memory is used to store computer programs, and the processor is used to call the computer programs stored in the memory to execute the elliptic curve scalar multiplication optimization method based on multi-window multi-basis chains according to any one of claims 1 to 5.

Images