Elliptic curve point based on bn128 curve hardware accelerator and method

Abstract

The embodiment of the present disclosure provides a kind of elliptic curve point addition hardware accelerator and method based on BN128 curve, belong to communication technical field, specifically include: at least one advanced modular addition unit, for completing the modular addition of 254-bit operand in a time unit, modular subtraction or the modular multiplication operation of multiplication with small constant, and output intermediate result;A double-channel modular multiplication accumulation module is used for parallelly executing two signed modular multiplication accumulation operations, and each signed modular multiplication accumulation operation is used for fusing an addition / subtraction operation in the accumulation phase of one modular multiplication operation;A main state machine is connected with advanced modular addition unit and double-channel modular multiplication accumulation module.Through the scheme of the present disclosure, the processing speed of single elliptic curve point addition and the utilization rate of internal computing unit are improved without relying on a large number of external tasks, and the area is significantly reduced, and the balance of performance and low resource consumption is realized.

Description

Technical Field

[0001] This disclosure relates to the field of communication technology, and in particular to an elliptic curve point addition hardware accelerator and method based on the BN128 curve. Background Technology

[0002] Currently, in cryptographic hardware implementations, point operations on elliptic curves are not ordinary integer arithmetic, but rather modular operations defined within a finite field. Specifically, coordinate calculations in ECPA involve a large number of modular multiplication (MM) and modular addition / subtraction (MA) operations. Since the modulus of the BN128 curve lacks a sparse binary representation (such as pseudo-Mersen primes), fast reduction algorithms cannot be used; therefore, the high-radix Montgomery modular multiplication algorithm has become the mainstream choice in engineering practice. A complete point addition operation on a BN128 curve requires 15 modular multiplications and 17 modular additions / subtractions in projective coordinates, with modular multiplication becoming a performance bottleneck due to its long bit width (254 bits) and complex reduction process. The drawback of existing technologies is that… (1) Disadvantages of the full pipeline architecture: It consumes a large amount of DSP (digital signal processing) and register resources, resulting in high hardware area costs; and in order to maintain its high-depth pipeline without generating bubbles, a large number of concurrent ECPA operations must be collected at the system level to fill the pipeline, which is highly dependent on upper-level task scheduling. (2) Disadvantages of the iterative execution architecture: It only focuses on top-level task scheduling optimization and ignores the deep optimization of the underlying modular multiplication (MM) operation microarchitecture. When facing strong data dependencies, it still needs to rely on a large number of concurrent tasks (Batch-mode) to cover up the latency caused by pipeline data adventures. The latency of a single ECPA is still very high, and it cannot achieve efficient computation in low-concurrency scenarios.

[0003] It is evident that improving the processing speed of a single ECPA and increasing the utilization rate of internal computing units without significantly increasing the hardware area is a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0004] In view of this, the present disclosure provides an elliptic curve point-addition hardware accelerator and method based on BN128 curves, which at least partially solves the problems of large hardware area overhead, heavy reliance on a large number of concurrent tasks to mask pipeline bubbles, and high single-task latency in the prior art.

[0005] In a first aspect, embodiments of this disclosure provide an elliptic curve point-addition hardware accelerator based on the BN128 curve, comprising: At least one advanced modular addition unit is used to perform modular addition, modular subtraction, or modular multiplication with a small constant on a 254-bit operand within one time unit and output intermediate results; A dual-channel modular multiplication accumulation module is used to execute two signed modular multiplication accumulation operations in parallel. Each signed modular multiplication accumulation operation is used to fuse an addition / subtraction operation into the accumulation stage of a modular multiplication operation. The calculation formula is as follows: ; A master state machine, connected to the advanced modular addition unit and the dual-channel modular multiplication and accumulation module, performs the following operations: The mathematical process of a single elliptic curve point addition operation is reconstructed into a task sequence containing 12 signed modular multiplication and accumulation operations and 15 advanced modular addition operations. The execution rhythm is controlled based on a time unit, where each time unit contains a preset number of clock cycles. The computation delay of the advanced modular addition unit is one time unit. The dual-channel modular multiplication and accumulation module has a two-stage pipeline structure, with a task start interval of two time units and a total delay of four time units. According to a preset scheduling sequence, during the execution period of a single elliptic curve point addition operation, the dual-channel modular multiplication and accumulation module is controlled to seamlessly start a new signed modular multiplication and accumulation operation at the task start interval, so that the dual-channel modular multiplication and accumulation module runs continuously at full load and outputs the final result after a fixed delay.

[0006] According to a specific implementation of an embodiment of this disclosure, the dual-channel modular multiplication and accumulation module includes: A dual-channel iterative Montgomery modular multiplication unit is used to perform iterative word-level Montgomery modular multiplication calculations and output dual-channel intermediate results in carry-preserving format. A dual-channel final accumulation unit is used to receive the dual-channel intermediate results and, according to the selection signal, combine and compress the dual-channel intermediate results with a preset constant and an addition / subtraction operand C to realize the signed modular multiplication accumulation operation; Specifically, when performing signed modular multiplication accumulation, the dual-channel modular multiplication accumulation module injects the addition / subtraction operand C into the final accumulation stage of the modular multiplication operation, as follows: Based on the value of the selection signal sel, the operand C or its inverted value, the intermediate result of the carry-saving format or its inverted value, and the preset multiple constant M are combined and compressed to complete the signed multiplication-addition fusion calculation in a single compression operation.

[0007] According to a specific implementation of an embodiment of this disclosure, the advanced module addition unit is used for: In response to a 2-bit control signal, it switches between four operation modes: modular addition, modular subtraction, modular multiplication by a constant 3, and modular multiplication by a constant 9. Furthermore, the advanced modular addition unit includes a prediction and reduction logic based on the most significant bit feature, wherein the prediction and reduction logic is used for: When performing a modular multiplication operation by a constant k, the high-order feature segment of the input operand X is extracted, where the high 4 bits are extracted when k=9 and the high 2 bits are extracted when k=3. The hardware lookup table is queried based on the high-bit feature segments, and the predicted reduction boundaries Mh and Ml are obtained in parallel, where Mh and Ml are multiples of the modulus M. Parallel execution of two-way subtraction operations and ; Choose one of t0 and t1 as the output result based on the sign bit of t0.

[0008] According to a specific implementation of this disclosure, the dual-channel modular multiplication and accumulation module internally integrates a dual-channel iterative Montgomery modular multiplication unit, the dual-channel iterative Montgomery modular multiplication unit comprising: Six parallel 64-bit multipliers are used to produce partial products; A ping-pong interleaving scheduler is used to interleave the first and second modular multiplication tasks to six 64-bit multipliers, wherein the start time of the first and second modular multiplication tasks is one clock cycle apart, so that the six 64-bit multipliers alternately calculate the partial product of the two tasks in each clock cycle and are in an active operation state in each clock cycle. A left-right spacetime partitioning structure is used to divide the six 64-bit multipliers and their corresponding compressed tree logic into a left processing partition and a right processing partition, and to perform the following operations: In the clock phase preceding an iteration cycle, the left partition processes the first task and the right partition processes the second task. In the next clock phase, the left partition processes the second task and the right partition processes the first task; The generation order of partial products is scheduled so that partial products input into the same compressed tree within the same clock cycle have non-overlapping or only adjacent overlapping displacement offsets.

[0009] According to a specific implementation of an embodiment of this disclosure, a layered compression architecture is further included, the architecture comprising: Six initial compressors are connected to a corresponding 64-bit multiplier. Each initial compressor includes a compression array consisting of four layers of 64-bit carry-holding adders and is used to generate a cascaded dataset. The cascaded dataset is dynamically fed as input to the adjacent initial compressors according to the current scheduling requirements to achieve horizontal cascading. Two final compressors, a left final compressor and a right final compressor, are connected to their respective initial compressor groups. The final compressors are used for: The compressor receives the current-cycle merging result from the initial compressor and reads the intermediate result of the previous iteration from the result register. The intermediate result of the previous iteration adopts a hybrid storage strategy: the lowest 64 bits are stored as single-line data merged by the adder, and the higher 254 bits are stored as data in a double-carry-preserving format. Finally, the compressor uses two layers of carry-preserving adder logic to complete the cumulative compression.

[0010] Secondly, embodiments of this disclosure provide a processing method for elliptic curve point addition hardware accelerators based on BN128 curves, applied to elliptic curve point addition hardware accelerators based on BN128 curves, the method comprising: The mathematical process of a single elliptic curve point addition operation is reconstructed into a task sequence containing 12 signed modular multiplication accumulation operations and 15 advanced modular addition operations. The signed modular multiplication accumulation operation is used to fuse an addition / subtraction operation into the accumulation phase of a modular multiplication operation. The calculation formula is as follows: ; The execution rhythm is controlled based on a time unit, where each time unit contains a preset number of clock cycles. The computation delay of the advanced modular addition unit is one time unit, and the dual-channel modular multiplication and accumulation module performs pipelined processing with a task start interval of two time units. According to a preset scheduling sequence, during the execution period of a single elliptic curve point addition operation, a new signed modular multiplication and accumulation operation is seamlessly started to the dual-channel modular multiplication and accumulation module at the task start interval, so that the dual-channel modular multiplication and accumulation module runs continuously at full load. Output the final result of a single elliptic curve point addition operation after a fixed delay.

[0011] According to a specific implementation of an embodiment of this disclosure, the preset scheduling order includes: In the first time unit, the first signed modular multiplication and accumulation task and the second signed modular multiplication and accumulation task are started, and the first set of modular addition results are calculated in parallel using the advanced modular addition unit; In the second time unit, the second set of modular addition results are computed in parallel using the advanced modular addition unit, and the third and fourth signed modular multiplication accumulation tasks are started using the dual-channel modular multiplication accumulation module. At the same time, the first and second signed modular multiplication accumulation tasks continue to be executed in the pipeline. In subsequent time units, the remaining signed modular multiplication and accumulation tasks are started sequentially, and in each time unit, the modular addition result calculated in the previous stage is used as the input of the next stage task or its fused addition / subtraction operand C.

[0012] According to a specific implementation of an embodiment of this disclosure, when the dual-channel modular multiplication and accumulation module performs a signed modular multiplication and accumulation task, it dynamically receives an addition / subtraction operand C in the last time unit of the calculation cycle. The addition / subtraction operand C depends on other intermediate results calculated in the same single elliptic curve point addition operation and after the start of the calculation cycle.

[0013] According to a specific implementation of this disclosure, the advanced modular addition unit performs fast modular reduction by means of the following steps when performing modular multiplication with a small constant: Extract the high-order feature segment of the input operand X, where the high 4 bits are extracted when multiplied by a constant 9, and the high 2 bits are extracted when multiplied by a constant 3; The hardware lookup table is queried based on the high-bit feature segments to obtain the predicted reduction boundaries Mh and Ml in parallel. Parallel execution of two-way subtraction operations and ; Choose one of t0 and t1 as the output result based on the sign bit of t0.

[0014] The elliptic curve point addition hardware accelerator scheme based on the BN128 curve in this embodiment includes: at least one high-level modular addition unit, used to complete modular addition, modular subtraction, or modular multiplication with a small constant on a 254-bit operand within one time unit, and output intermediate results; a dual-channel modular multiplication accumulation module, used to execute two signed modular multiplication accumulation operations in parallel, each signed modular multiplication accumulation operation being used to fuse an addition / subtraction operation in the accumulation stage of a modular multiplication operation, the calculation formula being... A master state machine, connected to the advanced modular addition unit and the dual-channel modular multiplication and accumulation module, performs the following operations: reconstructs the mathematical process of a single elliptic curve point addition operation into a task sequence containing 12 signed modular multiplication and accumulation operations and 15 advanced modular addition operations; controls the execution rhythm based on a time unit, where each time unit contains a preset number of clock cycles, the computation delay of the advanced modular addition unit is one time unit, the dual-channel modular multiplication and accumulation module has a two-stage pipeline structure, its task start interval is two time units, and the total delay is four time units; according to a preset scheduling order, during the execution of a single elliptic curve point addition operation, controls the dual-channel modular multiplication and accumulation module to seamlessly start new signed modular multiplication and accumulation operations at the task start interval, so that the dual-channel modular multiplication and accumulation module runs continuously at full load, and outputs the final result after a fixed delay.

[0015] The beneficial effects of the embodiments disclosed herein are as follows: (1) High area-time (AT) efficiency: Compared with a pure pipeline architecture with full space expansion (such as PipeZK), this invention reduces the consumption of register resources by several orders of magnitude through efficient time-sharing multiplexing of the underlying operators (i.e., iterative operation) (only 3 254-bit registers are needed globally to temporarily store intermediate variables of the ECPA process), which significantly reduces the overall area.

[0016] (2) Low latency per task and no need to wait for batch processing: Compared with conventional iterative scheduling (such as in Falic where a large number of ECPA tasks must be waited for to fill the pipeline), this invention solves the data dependency of Montgomery modular multiplication from the bottom layer through "ping-pong interleaving". The module itself can achieve 100% multiplier utilization (no processing bubbles), does not rely on the system to provide a large number of concurrent requests, and the latency of a single ECPA operation is only 84 clock cycles.

[0017] (3) Shorter critical path and higher clock frequency: adMA introduces LUT boundary prediction technology based on MSB, and SMMAC introduces signed computation and optimized compressed tree logic, eliminating a large number of redundant large integer condition branches and long carry additions (such as omitting the adder for judging carry in the lower 64 bits), which greatly shortens the delay of combinational logic and can easily run at higher clock frequencies at lower process nodes. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1A schematic diagram of a hardware accelerator method based on BN128 curves for elliptic curve point addition provided in an embodiment of this disclosure; Figure 2 A schematic diagram of the structure of a signed modular multiplication accumulator unit provided in an embodiment of this disclosure; Figure 3 This disclosure provides an embodiment of a computational scheduling diagram for a single ECPA operation under a bn128 curve. Figure 4 A hardware structure diagram of a 64-bit multiplier provided in this disclosure embodiment; Figure 5 A hardware module diagram of a dual-channel modular multiplication and accumulation module (dual-IMM) provided in this embodiment of the disclosure; Figure 6 This is a hardware module diagram of an advanced modular assembly (adMA) module provided in an embodiment of the present disclosure.

[0020] Summary of attached image labels: The system includes an elliptic curve point addition hardware accelerator 100 based on the BN128 curve, an advanced modular addition unit 110, a dual-channel modular multiplication and accumulation module 120, and a main state machine 130. Detailed Implementation

[0021] The embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0022] The following specific examples illustrate the implementation of this disclosure. Those skilled in the art can easily understand other advantages and effects of this disclosure from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. This disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this disclosure. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0023] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0024] It should also be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this disclosure. The illustrations only show the components related to this disclosure and are not drawn according to the number, shape and size of the components in actual implementation. In actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0025] Furthermore, specific details are provided in the following description to facilitate a thorough understanding of the examples. However, those skilled in the art will understand that the described aspects can be practiced without these specific details.

[0026] This disclosure provides an elliptic curve point-addition hardware accelerator based on the BN128 curve, which can be applied to the accelerator design process in cryptographic hardware scenarios.

[0027] See Figure 1 This is a schematic diagram of an elliptic curve point-addition hardware accelerator based on the BN128 curve, provided in an embodiment of this disclosure. Figure 1 As shown, the elliptic curve point-addition hardware accelerator based on the BN128 curve mainly includes: At least one advanced modular addition unit is used to perform modular addition, modular subtraction, or modular multiplication with a small constant on a 254-bit operand within one time unit and output intermediate results; A dual-channel modular multiplication accumulation module is used to execute two signed modular multiplication accumulation operations in parallel. Each signed modular multiplication accumulation operation is used to fuse an addition / subtraction operation into the accumulation stage of a modular multiplication operation. The calculation formula is as follows: ; A master state machine, connected to the advanced modular addition unit and the dual-channel modular multiplication and accumulation module, performs the following operations: The mathematical process of a single elliptic curve point addition operation is reconstructed into a task sequence containing 12 signed modular multiplication and accumulation operations and 15 advanced modular addition operations. The execution rhythm is controlled based on a time unit, where each time unit contains a preset number of clock cycles. The computation delay of the advanced modular addition unit is one time unit. The dual-channel modular multiplication and accumulation module has a two-stage pipeline structure, with a task start interval of two time units and a total delay of four time units. According to a preset scheduling sequence, during the execution period of a single elliptic curve point addition operation, the dual-channel modular multiplication and accumulation module is controlled to seamlessly start a new signed modular multiplication and accumulation operation at the task start interval, so that the dual-channel modular multiplication and accumulation module runs continuously at full load and outputs the final result after a fixed delay.

[0028] In specific implementation, the ECPA hardware accelerator proposed in this invention consists of four main parts: a master state machine (FSM), two advanced modular addition modules (adMA), a dual-channel modular multiplication accumulation module (dual-SMMAC), and only three 254-bit wide RAM (Random Access Memory).

[0029] The FSM is responsible for parsing ECPA instructions and allocating operands to the underlying computation modules according to the scheduling table; RAM is used to temporarily store intermediate variables; the computation task is completed iteratively by two parallel adMA modules and one dual-SMMAC module. One of the dual-SMMAC modules can compute two SMMAC operations simultaneously.

[0030] This invention proposes a highly efficient iterative point addition calculation module.

[0031] The module initially inputs two points of elliptic curve data, P1(X1,Y1,Z1) and P2(X2,Y2,Z2). After 84 cycles, it outputs the result of adding points P3 = P1 + P2 (X3,Y3,Z3). A new ECPA task can be input every 72 cycles. During these 72 cycles, the critical computational part within the module (SMMAC computation) is a bubble-free, full-load computation.

[0032] The BN128 curve-point accelerator proposed in this invention operates with a master state machine (FSM) that strictly follows a rhythm of 6 clock cycles (CC) as a time unit (tu) for global control. The following describes the data flow between various hardware modules during a single ECPA operation: Periods 1-6: dual-SMMAC: In the first cycle, the state machine retrieves Y1, Y2 and Z1, Z2 from the storage unit and inputs them into channels A and B of the dual-channel modular multiplication and accumulation module (dual-SMMAC), respectively, initiating the multiplication iteration phase of SMMAC tasks 1 and 2. During this period, the adMA module is in an idle state.

[0033] Periods 7-12: adMA: In cycle 7, the state machine fetches Y2 and Z2 from the storage unit into module adMA0, while inputting Y1 and Z1 into module adMA1. At the end of cycle 12, adMA0 outputs T7 = Y2 + Z2 (mod M), and adMA1 outputs T4 = Y1 + Z1 (mod M).

[0034] Periods 13-18: dual-SMMAC: In cycle 13, the state machine inputs T4, T7 and X1, X2 into channels A and B of dual-SMMAC respectively, starting SMMAC tasks 3 and 4. At this time, SMMAC tasks 1 and 2 have not yet finished, and the SMMAC module is processing tasks 1, 2, 3, and 4 simultaneously.

[0035] adMA: In cycle 13, the state machine fetches X2 and Y2 from the storage unit and inputs them into the adMA0 module, while simultaneously inputting X1 and Y1 into the adMA1 module. At the end of cycle 12, adMA0 produces T6 = X2 + Y2 (mod M), and adMA1 produces T3 = X1 + Y1 (mod M).

[0036] Periods 19-24: dual_SMMAC: In cycle 19, the state machine injects a constant accumulation term C=0 into both tasks 1 and 2 of the dual-SMMAC module. In cycle 24, the dual-SMMAC module completes the operator fusion calculation of T1=Y1*Y2+0 (mod M) for task 1 and T2=Z1*Z2+0 (mod M) for task 2.

[0037] adMA: In cycle 19, the state machine fetches X2 and Z2 from the storage unit and inputs them into the adMA1 module, while simultaneously inputting X1 and Z1 into the adMA0 module. At the end of cycle 24, adMA0 produces T8 = X2 + Z2 (mod M), and adMA1 produces T5 = X1 + Z1 (mod M).

[0038] Periods 25-30: dual-SMMAC: In cycle 25, the state machine inputs T8, T5 and T3, T6 to channels A and B of dual-SMMAC respectively, starting SMMAC tasks 5 and 6. At this time, SMMAC tasks 3 and 4 have not yet finished, and the SMMAC module is processing tasks 3, 4, 5, and 6 simultaneously.

[0039] adMA: In cycle 25, the state machine fetches inputs T1 and T2 from the storage unit into the adMA0 module and inputs T2 into the adMA1 module. At the end of cycle 30, adMA0 produces G1 = T1 + T2 (mod M), and adMA1 produces U0 = 9 * T2 (mod M).

[0040] Periods 31-36: dual-SMMAC: In cycle 31, the state machine injects the accumulation terms C=-G1 and C=0 into tasks 3 and 4 of the dual-SMMAC module, respectively. In cycle 36, the dual-SMMAC module completes the operator fusion calculation of U2=T4*T7-G1 (mod M) for task 3 and T0=X1*X2+0 (mod M) for task 4.

[0041] adMA: In cycle 31, the state machine retrieves U0 and T1 from the storage unit and inputs them into the adMA0 and adMA1 modules. At the end of cycle 36, adMA0 produces K1 = U0 + T1 (mod M), and adMA1 produces K2 = T1 - U0 (mod M).

[0042] Periods 37-42: dual-SMMAC: In cycle 37, the state machine inputs K1, K2 and K1, U2 into channels A and B of dual-SMMAC respectively, starting SMMAC tasks 7 and 8. At this time, SMMAC tasks 5 and 6 have not yet finished, and this SMMAC module is processing tasks 5, 6, 7, and 8 simultaneously.

[0043] adMA: In cycle 37, the state machine fetches T2, T0 and T0, T1 from the storage unit and inputs them into the adMA0 and adMA1 modules respectively. At the end of cycle 42, adMA0 produces G2 = T2 + T0 (mod M), and adMA1 produces G0 = T0 + T1 (mod M).

[0044] Periods 43-48: dual-SMMAC: In cycle 43, the state machine injects the accumulation terms C=-G2 and C=-G0 into tasks 5 and 6 of the dual-SMMAC module, respectively. In cycle 48, the dual-SMMAC module completes the operator fusion calculation of U3=T5*T8-G2 (mod M) for task 5 and U1=T3*T6-G0 (mod M) for task 6.

[0045] adMA: In cycle 43, the state machine fetches input T0 from the storage unit into the adMA1 module. At the end of cycle 48, adMA1 produces K0 = 3 * T0 (mod M).

[0046] Periods 49-54: dual-SMMAC: In cycle 49, the state machine inputs K0,U1 and K2,U1 into channels A and B of dual-SMMAC respectively, starting SMMAC tasks 9 and 10. At this time, SMMAC tasks 7 and 8 have not yet finished, and the SMMAC module is processing tasks 7, 8, 9, and 10 simultaneously.

[0047] adMA: In cycle 49, the state machine fetches input U3 from the storage unit into the adMA1 module. At the end of cycle 54, adMA1 produces K3 = 9 * U3 (mod M).

[0048] Periods 55-60: dual-SMMAC: In cycle 55, the state machine injects a constant accumulation term C=0 into both tasks 7 and 8 of the dual-SMMAC module. In cycle 60, the dual-SMMAC module completes the operator fusion calculation of H1=K1*K2+0 (mod M) for task 7 and H4=K1*U2+0 (mod M) for task 8.

[0049] Periods 61-66: dual-SMMAC: In cycle 61, the state machine inputs K3, U2 and K0, K3 into channels A and B of dual-SMMAC respectively, starting SMMAC tasks 11 and 12. At this time, SMMAC tasks 9 and 10 have not yet finished, and the SMMAC module is processing tasks 9, 10, 11, and 12 simultaneously.

[0050] Periods 67-72: dual-SMMAC: In cycle 67, the state machine injects constant accumulation terms C=H4 and C=0 into tasks 9 and 10 of the dual-SMMAC module, respectively. In cycle 72, the dual-SMMAC module completes the operator fusion calculation of Z3=K0*U1+H4 (mod M) for task 9 and H2=K2*U1+0 (mod M) for task 10.

[0051] Periods 73-78: dual-SMMAC: In cycle 73, the state machine inputs Y1, Y2 and Z1, Z2 from the next round of ECPA calculations into channels A and B of dual-SMMAC, respectively, initiating SMMAC tasks 1 and 2 for the next round of ECPA calculations. At this time, SMMAC tasks 11 and 12 from the previous round of ECPA calculations have not yet finished. The SMMAC module is simultaneously processing tasks 11 and 12 and tasks 1 and 2 from the next round of ECPA.

[0052] Periods 79-84: dual-SMMAC: In cycle 79, the state machine injects constant accumulation terms C=H2 and C=H1 into tasks 11 and 12 of the dual-SMMAC module, respectively. In cycle 84, the dual-SMMAC module completes the operator fusion calculation of X3=-K3*U2+H2 (mod M) for task 11 and Y3=K0*K3+H1 (mod M) for task 12. At this point, the final coordinates (X3, Y3, Z3) of a single ECPA operation are obtained.

[0053] adMA: In cycle 79, the state machine retrieves Y2, Z2, and Y1 for the next round of ECPA from the storage unit, and Z1 is input into the adMA0 and adMA1 modules respectively. At the end of cycle 84, adMA0 outputs T7 = Y2 + Z2 (mod M) for the next round of ECPA, and adMA1 outputs T4 = Y1 + Z1 (mod M) for the next round of ECPA.

[0054] The structure, processing method, and processing flow proposed in this invention can significantly improve the utilization rate of the core computing module SMMAC under the stringent data hazard conditions of ECPA. This, in turn, reduces the chip's critical parameter: the area-delay product.

[0055] In the ECPA data flow graph of a conventional BN128 curve, continuous modular multiplication (MM) and modular addition / subtraction exhibit strict data dependencies. This invention reconstructs the underlying operators: (1) Introduction of SMMAC: Traditional modular multiplication (MM) only calculates R = X×Y mod M. This design proposes the SMMAC module, which introduces a symbol and adds an addition operation in the final compression stage of modular multiplication, so that the calculation formula becomes R=(±(X×Y)±C) modM. This allows the modular addition / subtraction operations (such as subtracting an intermediate variable) that originally needed to be performed independently after or before modular multiplication to be "freely" integrated into SMMAC, which not only shortens the critical path but also reduces the number of independent MA operations.

[0056] The hardware foundation for this "free" fusion lies in the inherent characteristics of the underlying architecture of the Montgomery modular multiplication algorithm. When performing 254-bit modular multiplication, the hardware must internally construct a multi-level carry-preserving adder (CSA) compression tree to process and accumulate massive partial products (i.e., intermediate results of multiplication operations) in parallel. The result obtained in this process is in carry-preserving format, i.e., two rows of carry and sum. In the final accumulation stage of the iterative calculation, when the carry and sum are accumulated to obtain the final result, the critical path length is a 254-bit addition carry chain. If we then calculate R = (-(X×Y) + C) mod M, inverting the carry and sum, and also incorporating the addend C, the critical path only adds an inverter and a CSA compressor to the 254-bit carry chain, an increase that is almost negligible. Therefore, the transition from MM to SMMAC is virtually "free."

[0057] In this invention, such as Figure 2 As shown, the SMMAC module includes: It consists of a dual-channel iterative Montgomery (dual-IMM) module and a final dual-channel accumulation (dual-FA) module.

[0058] In dual-IMM: The first module is for calculating partial products, which is used to perform multiplication in the word-level Montgomery algorithm.

[0059] The third module is the compression module, which is used to quickly accumulate partial products and existing data.

[0060] Both the second and fourth modules are registers, with the data in the fourth module stored in carry-save format.

[0061] In the dual-FA module: Step 1: During clock cycle 1, input the two operands X and Y for modular multiplication. Dual-IMM continuously iterates through cycles 1-20. In cycle 21, the dual-IMM calculation ends, outputting two 254-bit rows of carry-save format data: carry and sum. The following explanation focuses on the FA processing for one channel.

[0062] Step 2: Input the 254-bit positive integer addend C to be calculated in one channel of the dual-FA module.

[0063] Step 3: Based on the selection signal sel of this channel input to the dual-FA module, If sel=0, the output is +(Carry+Sum)+C. If sel=1, the output is +(Carry+Sum)-C. If sel=2, the output is -(Carry+Sum)+C. If sel=3, the output is -(Carry+Sum)-C. For step 3, the specific implementation is as follows: If sel=0, compress C, Carry, and sum.

[0064] If sel=1, invert C and compress it with (M+1), Carry, and Sum.

[0065] If sel=2, invert both Carry and Sum, and compress them with (2M+2) and C.

[0066] If sel=3, invert Carry, Sum, and C, and compress them with (3M+3).

[0067] In all four cases described above, compression will result in a new carry-save format: Carry, Sum.

[0068] Step 4: Perform three parallel additions on the Carry and Sum obtained in Step 3. The additions are R0 = Carry + Sum + 0, R1 = Carry + Sum + (-M), and R2 = Carry + Sum + (-2M).

[0069] Step 5: If the 254th bit of R2: R2

[254] equals 0, then the final output is R2; otherwise, if the 254th bit of R1: R1

[254] equals 0, then the final output of this channel is R1; otherwise, the final output of this channel is R0. The final output mentioned here is the output of this channel in the dual-SMMAC module.

[0070] (2) Extended adMA: adMA not only performs the conventional A±B mod M operation, but is also extended to support modular multiplication with a small constant k (i.e., k×X mod M, where k=3 or 9). This invention implements the three k×X mod M operations (two 9*X mod M operations and one 3*X mod M operation) in the BN128 point addition operation using the adMA module, avoiding the use of MM or SMMAC to calculate the modular multiplication operation. Through operator fusion, the original 15 conventional MM operations are reduced in order and fused into 12 SMMAC operations, reducing the computational burden.

[0071] like Figure 3 As shown, the specific process of efficient scheduling and pipeline optimization for a single ECPA is as follows: This invention proposes a fine-grained scheduling scheme based on time units (tu), defining one tu as 6 clock cycles (CC) and setting a strict execution rhythm according to the operational characteristics of the underlying modules. The computational latency of the Advanced Modular Addition (adMA) module is compressed to 1 tu, while the core SMMAC operation is designed as a two-stage pipeline structure, with a total latency of 4 tu (24 CC) from input to output, but capable of receiving a new task every 2 tu (12 CC). This parameter setting establishes a virtuous cycle, where the startup interval of one SMMAC operation corresponds exactly to the execution time of two adMA operations, laying the foundation for achieving full-load operation of the underlying resources.

[0072] To completely eliminate pipeline bubbles within a single ECPA calculation, this invention reconstructs the mathematical flow of the ECPA for the BN128 curve into 12 SMMAC operations and 15 adMA operations. By decoupling the critical path in the original data flow graph, this invention compactly maps these 12 SMMAC operations onto a dual-SMMAC module, which can compute two SMMAC operations simultaneously. Under this scheduling, the two SMMAC operations start concurrently; as the first two operations enter the second stage of their pipeline, the latter two operations immediately enter the first stage. This seamless scheduling ensures that the underlying multiplier array is operational almost every defined cycle during a single ECPA execution.

[0073] Experimental data shows that the entire ECPA process, from the first data input to the final result output, only takes 84 clock cycles. Furthermore, since the scheduling strategy resolves data hazards within a single task, the system does not need to rely on the stacking of a large number of external tasks to mask latency, as is the case in traditional designs.

[0074] like Figure 3 As shown, 'x' represents a modular multiplication operation, and '+' and '-' represent modular addition and subtraction operations. Adjacent dashed lines represent a 6-clock-cycle interval. The top two lines represent adMA operations; two adMA operations can be executed simultaneously. The bottom two lines represent SMMAC operations; two SMMAC operations can also be executed simultaneously.

[0075] Furthermore, this scheduling scheme includes specific timing rules for the addend inputs in SMMAC operations. In the critical path of ECPA in the BN128, some SMMAC addend terms (i.e., C in the formula R=A*B+C mod M) often depend on the results of other operations immediately preceding them. To address this extremely short time margin, the SMMAC module of this invention supports dynamically receiving addend inputs at the last tu of the computation cycle. Taking the computation variable U2 as an example, after waiting for the preceding operations to complete and for the intermediate value G1 to be obtained through adMA processing, the system can send G1 to the end of the pipeline in real time for fusion without interrupting the SMMAC pipeline. This flexible dynamic data injection mechanism, combined with the aforementioned compact mapping strategy, enables the originally complex and variable elliptic curve ECPA operation to be completed within a very short fixed cycle, improving the real-time response capability of cryptographic hardware under low concurrency loads.

[0076] The dual-channel modular multiplication and accumulation module (Dual-SMMAC) designed in this invention is the core computing engine in the accelerator, with the core module being the dual-IMM iterative Montgomery modular multiplication structure. Its microarchitecture, through a deep reconstruction of the word-level Montgomery algorithm execution timing, not only constructs the 256-bit modular multiplication into a two-stage pipeline but also achieves 100% utilization of internal multiplier resources.

[0077] The internal structure of the 64-bit multiplier Muli: This module utilizes the DSP processing unit inside the FPGA to construct the multiplication. For example... Figure 4 As shown.

[0078] Constructing a 64-bit multiplier requires 12 DSPs. The 64-bit inputs a and b are truncated evenly according to the rules shown in the diagram. These truncated portions are then fed into each DSP. Utilizing the configurability of the DSPs, six DSPs are configured to perform multiplication before addition, pre-accumulating partial products within each DSP. The outputs of the remaining 12 DSPs are reduced to six outputs: p0~5. These five data points are then output to the ICP preliminary compression module for initial compression.

[0079] The specific implementation is as follows: Step 1: Configure the 6 DSPs to an unsigned 22-bit x 16-bit computing mode with no internal registers. Step 2: Configure the 6 DSPs to an unsigned 22-bit x 16-bit, plus 32-bit calculation mode with registers after the addition is completed.

[0080] Step 3: Pad the 64-bit input data 'a' with 2 bits of 0 in the high-order bits to form a 66-bit data set, then divide it into three equal parts: {a2, a1, a2}. The bit width of a_i is 22 bits. Divide the 64-bit input data 'b' into three equal parts: {b3, b2, b1}, where the bit width of b_i is 16 bits. Input these data into the 12 DSP input ports according to the rules shown in the image.

[0081] The high-order bits of the outputs from the six DSPs in the first step are connected to the addition inputs of the six DSPs in the second step. The DSPs configured in the second step are used to calculate the result of the multiplication of the two DSPs. Finally, the low-order bits of the DSP outputs from the first step and the outputs from the DSPs in the second step are combined to form the final output pi, which is then fixed using a register set.

[0082] There are a total of 6 outputs p0~p5. The relationship between the input multiplication a*b and the results p0~p5 is: a*b=p0+{p1,22'b0}+{p2,38'b0}+{p3,48'b0}+{p4,60'b0}+{p5,76'b0}.

[0083] like Figure 5 As shown, the dual-IMM integrates six 64-bit integer multipliers (Mul0 to Mul5), and defines a fixed two-cycle delay cycle for single word-level multiplication and subsequent addition compression operations based on the characteristics of FPGA hardware. That is, the multiplication calculation is completed in the first cycle and the result compression is completed in the second cycle.

[0084] To mask the delays of these two cycles and eliminate data waiting bubbles within the tasks, Dual-IMM employs a "ping-pong interleaving" scheduling mechanism, merging two independent IMM tasks (IMM-A and IMM-B) into a single pipeline execution sequence. Under this mechanism, while the multiplier array is calculating the partial product for task A in odd-numbered cycles, the compressed tree is synchronously processing the results of task B from the previous cycle, and vice versa, thus ensuring that all six hardware multipliers are performing valid operations in every clock cycle.

[0085] At the top-level scheduling logic, the entire multiplication input sequence is constructed as a compact structure with an InitiationInterval (II) of 12 clock cycles. This means that the system can receive a completely new set of SMMAC inputs (new SMMAC inputs of types A and B) every 12 cycles, while the start times of task A and task B differ by only 1 cycle.

[0086] Through this precise periodic task arrangement, the six multipliers are fully filled in both the horizontal time dimension and the vertical resource dimension during continuous SMMAC computation. Simultaneously, to further optimize the hardware critical path and reduce the complexity of the compression logic, this invention divides the entire computation process and corresponding hardware circuitry into two processing partitions: left (Lmul / Lcmp) and right (Rmul / Rcmp). Lmul handles tasks in cycles 1 to 12, and Rmul handles tasks in cycles 9 to 20. The left and right partitions logically overlap in cycles 9 to 12. This spatial partitioning strategy prevents the Lcmp and Rcmp compression trees from simultaneously dealing with the partial product of six identical tasks within a single cycle. Instead, it distributes the workload across two independently operating partition compressors, maximizing the alleviation of timing pressure during high-congestion cycles.

[0087] Furthermore, this architecture also features targeted optimizations in the generation and arrangement of partial products (pp). During the iteration of the word-level Montgomery modular multiplication algorithm, the generated word-level partial products typically have different offsets. This invention, through careful scheduling of the multiplication operators, ensures that multiple partial products fed into the compression tree within the same clock cycle are all non-overlapping or only adjacent overlapping partial products. This scheduling strategy has significant hardware implications: it successfully avoids excessive stacking of multiple partial products on the same bit, thereby physically reducing the height of the compression tree and requiring fewer compression layers to complete the merging. This design, which reduces compression depth from the source of algorithm scheduling, not only reduces hardware resource consumption but also ensures that the module can operate stably at high frequencies approaching 300MHz, achieving a better trade-off between area and performance.

[0088] The process of obtaining the partial product using the 64-bit multiplication module is as follows: The computational multiplication part of the dual-IMM is implemented by six 64-bit multipliers, Mul0-Mul5. The input rules for the six multipliers are specified in "Table 1: Dual-IMM Multiplication Input Scheduling Table".

[0089] Step 1: Input the modular multiplication operands for two channels. Each channel's modular multiplication operand is a 254-bit X and Y. Pad the high-order bits of both operands with zeros to extend them to 256 bits, and then divide them into segments of 64 bits each to obtain X0-Y3 and Y0-Y3. Next, input the 254-bit modulus M and perform the same processing to obtain M0-M3.

[0090] Step 2: Input 64 bits of pre-computed data M`.

[0091] Step 3: According to the rules in Table 1, put X0-Y3, Y0-Y3 and M0-M3, M`, F[0], q[i] of the two channels into Mul0-Mul5: The multiplications calculated by the Mul0-Mul2 multipliers in periods 1-4 and the Mul0-Mul3 multipliers in periods 5-12 belong to the left multiplication part L_Mul.

[0092] The multiplications calculated by the Mul4-Mul5 multipliers in periods 9-12 and 17-20, and the Mul3-Mul5 multipliers in periods 13-16, belong to the right-hand multiplication part R_Mul.

[0093] Multiplications calculated in period 5-12 of Mul3 belong to the left multiplication part L_Mul, while multiplications calculated in period 13-16 belong to the right multiplication part R_Mul.

[0094] During cycles 9-12, the six multipliers Mul0-Mul5 simultaneously calculate the left and right multiplication parts.

[0095] The multipliers perform multiplication of channel A in the periods 1, 3, 5, 7, 9, 11 of the left multiplication part L_Mul and the periods 10, 12, 13, 15, 17, 19 of the right multiplication part R_Mul.

[0096] In the periods 2, 4, 6, 8, 10, 12 of the left multiplication part L_Mul and the periods 9, 11, 14, 16, 18, 20 of the right multiplication part R_Mul, the multipliers perform multiplication of channel B.

[0097] In the periods 3, 4, 7, 8, 11, 12 of the left multiplication part L_Mul and the periods 15, 16 of the right multiplication part R_Mul, there exist multipliers Mul2 or Mul3 that use F[0] and M` to calculate the quotient q[i]. At this time, the output of the corresponding multiplier will not enter the subsequent compression operation, but will be compressed by an additional compressor, and then accumulated by a 64-bit adder to obtain the quotient q[i], which is then stored in the q register.

[0098] Step 4: In the periods 5, 6, 9, 10 of the left multiplication part L_Mul and the periods 13, 14, 15, 16, 17, 18, 19, 20 of the right multiplication part, the multiplier uses q[i] and M0-M3 to calculate the partial product. q[i] is obtained directly from the q register.

[0099] Step 5: Starting from cycle 13, M0-M1 begin accepting new IMM calculation tasks. At this time, the right-hand multiplication part R_Mul is still processing the original IMM calculation tasks until cycle 20.

[0100] When performing multiple IMM computation tasks serially, the six 64-bit multipliers Mul0-Mul5 are performing multiplications in every cycle. There is no idle time.

[0101] The multiplication calculation takes one cycle, and compressing and merging the multiplication result with the existing result takes another cycle. Therefore, completing a single iteration of the dual-IMM calculation takes a total of two cycles. Due to the pipelined structure, when running multiple iterations serially, the total processing time only needs to be increased by one cycle.

[0102] A complete dual-IMM iteration requires a total of 20 iterations. This takes a total of 20+1 cycles.

[0103] The process of compressing the partial product using the initial compressor ICP is as follows: During the compression phase, there are a total of six ICP compression modules and two FCP compression modules. The six ICP modules correspond one-to-one with the six multiplication units Mul0-Mul5, receiving the output of the multiplication. The FCP compression modules are divided into left and right parts: L_FCP and R_FCP, corresponding to the left and right multiplication units L_Mul and R_Mul, respectively.

[0104] Step 1: Connect the six ICPs according to the rule of adjacent partial products: In any period, the adSet output of ICP1 is connected to ICP0. The adSet output of ICP4 is connected to ICP5.

[0105] In cycles 4, 5, 16, and 17, the adSet output of ICP2 is not connected to ICP1; in the remaining cycles, they are connected.

[0106] During cycles 2, 3, 14, and 15, the adSet output of ICP3 is connected to ICP4.

[0107] During cycles 6, 7, 10, 11, 18, and 19, the output of ICP3 is connected to ICP2.

[0108] Step 2: In ICP2 (cycles 4 and 5) and ICP3 (cycles 8, 9, 12, and 13), the quotient word qi is processed. During this time, the ICPs are not connected to any other ICPs. After compression, the adSet output of the ICPs is arranged into two 64-bit carry-save format data rows. A 64-bit adder is then used to calculate these two rows of data to obtain the quotient word qi, which is then fixed using the q register.

[0109] Step 3: For the left compression part L_cmp, during periods 2, 3, 8, 9, 12, and 13, the four outputs—adSet output of ICP0, the output of ICP0 itself, the output of ICP1, and the output of ICP2—will be allocated to bits 64-320 of the input port of the left FCP (L_FCP) module.

[0110] During cycles 4 and 5, the three outputs—the adSet output of ICP0, the output of ICP0 itself, and the output of ICP1—are allocated to bits 64-256 of the L_FCP input port.

[0111] During cycles 6, 7, 10, and 11, the five outputs—the adSet output of ICP0, the output of ICP0 itself, the output of ICP1, the output of ICP2, and the output of ICP3—are allocated to bits 0-320 of the L_FCP input port.

[0112] Step 4: For the right-hand compression section R_cmp, the three outputs in cycles 10, 16, and 17—the adSet output of ICP5, the output of ICP5 itself, and the output of ICP4—will be allocated to bits 128-320 of the input port of the right FCP (R_FCP) module.

[0113] During cycles 11, 20, and 21, the adSet output of ICP5, the output of ICP5 itself, and the output of ICP4 are distributed to bits 64-256 of the input port of the R_FCP module.

[0114] In cycles 12 and 13, the four outputs—the adSet output of ICP5, the output of ICP5 itself, the adSet output of ICP4, and the output of ICP4 itself—are allocated to bits 64-320 of the input port of the R_FCP module.

[0115] In cycles 14 and 15, the four outputs—adSet output of ICP5, the output of ICP5 itself, the output of ICP4, and the output of ICP3—are allocated to bits 0-256 of the input port of the R_FCP module.

[0116] In cycles 18 and 19, the adSet output of ICP5, the output of ICP5 itself, and the output of ICP4 are distributed to bits 0-256 of the input port of the R_FCP module.

[0117] The final compressor FCP processing section's process is as follows: For the left FCP (L_FCP), after receiving the output of ICP, it is also necessary to extract the data from the result register F. Depending on the different AB channels and the different processing parts on the left and right (L and R), there are a total of four result registers, named as: F_AL, F_BL, F_AR, F_BR. Each F register contains two rows of data, the first row is 324 bits and the second row is 260 bits, where bits 0-64 of the first row are F[0]. The remaining parts of the two rows constitute 2*260 bits and are defined as F[1].

[0118] Step 1: In cycles 6 and 10, the L_FCP module extracts F_AL[0] for calculation and inputs it to the 0-64 bits of the input port.

[0119] In cycles 7 and 11, the L_FCP module extracts F_BL[0] for calculation and inputs it to the 0-64 bits of the input port.

[0120] In cycles 14 and 18, the R_FCP module extracts F_AR[0] for calculation and inputs it to the 0-64 bits of the input port.

[0121] In cycles 15 and 19, the R_FCP module extracts F_BR[0] for calculation and inputs it to the 0-64 bits of the input port.

[0122] In other cases, bits 0-64 of the inputs of L_FCP and R_FCP are all 0.

[0123] Step 2: For L_FCP, extract F_AL[1] into the input port 64-324 bits during periods 2, 4, 6, 8, 10, 12, and extract F_BL[1] into the input port 64-324 bits during periods 3, 5, 7, 9, 11, 13.

[0124] For R_FCP, in periods 11, 13, 14, 16, 18, 20, F_AR[1] is extracted and input to the input port for 64-324 bits. In periods 10, 12, 15, 17, 19, 21, F_BR[1] is extracted and input to the input port for 64-324 bits.

[0125] During the iteration process, the FCP output undergoes further processing before being latched into the register. This processing switches between two different processing scenarios depending on the scheduling timing: (1) Case 1 is “carry propagation and discarding”. At this time, the system uses a 64-bit adder to simplify the current lowest 64-bit sum vector (Ft[0]). According to the characteristics of the Montgomery algorithm, the system can accurately identify whether a carry to the higher bit has been generated by simply using a simple 2-input OR gate to judge the highest bit of the carry-saving vector of Ft[0]. Subsequently, the updated F[0] is stored in the register, and the processed F[1-4] serves as the basis for the next round of iteration.

[0126] (2) Case 2 is "carry-save accumulation". In this case, the 64-bit adder is in an idle state. The system directly injects the cached 1-bit carry into the high-order CS format for storage without updating F[0]. It is worth noting that the present invention ensures that the 64-bit adder is in a non-critical cycle of modular multiplication qi when executing FCP scenario 1 through precise multiplication scheduling. This realizes the hardware reuse of the adder between "restoring F[0]" and "calculating qi", which slightly saves chip area.

[0127] Step 1: The output of FCP is divided into three parts: the first part, out[0], consists of two rows of data, each with a width of 64 bits; the second part, out[1], consists of two rows of data, each with a width of 64 bits and 63 bits respectively; and the third part, out[2], consists of two rows of data, each with a width of 196 bits. These three parts are physically adjacent and can be directly concatenated. The first part is the least significant bit, the second part is the middle part, and the third part is the most significant bit. Step 2: There are two processing methods for these three parts. After processing, the result register F can be used to fix the result.

[0128] For L_FCP, during periods 2, 6, and 10, the first processing method is executed: the highest bits of the two rows in out[0] are ANDed to directly obtain the carry bit after the accumulation of the two rows of data in the first part. This carry bit is then padded to the second row of the second part out[1], making out[1] a 64-bit data in two rows. A 64-bit adder is used to accumulate out[1] at this time, and the 64-bit result is output to the result register F_AL[0]. The carry output of the adder is stored in a single-bit register. At this time, the third part output out[2] is padded with 64 zeros in the high bits to form two 260-bit data in two rows, which are fixed in the F_AL[1] register.

[0129] In the remaining cycles, the second processing method is executed: the data in the single-bit register is padded into the second row of the second part out[1], making out[1] into two rows of 64-bit data. At this time, out[1] and the third part output out[2] are combined to form two rows of 260-bit data, which are fixed in the F_AL[1] register.

[0130] It should be noted that, since it is a dual-channel IMM, the data processed in each cycle needs to be allocated to the corresponding result register.

[0131] Step 3: For R_FCP, during periods 14, 15, 18, and 19, the three parts of the output are processed using the first method. In the remaining periods, the three parts of the output are processed using the second method.

[0132] Finally, the dual-IMM outputs are as follows: Channel A outputs the lower 254 bits of the F_AR register, and Channel B outputs the lower 254 bits of the F_BR register.

[0133] Furthermore, this invention proposes a unified multi-mode advanced modular addition (adMA) operation module, with the following structure: Figure 6 As shown, its core invention lies in achieving high integration and fast execution of modular addition, modular subtraction, and small constant modular multiplication (such as 3*X mod M and 9*X mod M) through a compact hardware architecture. In the ECPA logic of the BN128 curve, this module not only carries the conventional coordinate transformation addition and subtraction operations, but also is specifically responsible for handling the constant multiplication task that originally required the resources of a general modular multiplier. Through this "overloaded" functional design, the number of core modular multiplications in the ECPA process is successfully reduced from 15 to 12.

[0134] To perform complex modulo reduction operations quickly, adMA employs a predictive reduction technique based on the most significant bit (MSB) segment features. When performing 3*X or 9*X operations, the hardware first obtains the unreduced result through simple bit shifting and addition logic (e.g., 9*X = X + (X << 3)), at which point the numerical range expands to [0, 9M). Since the modulus M and the constant k are both fixed values, this invention proposes an algorithm to locate the bit width h of the high-order feature segment of the input operand X, and the interval where k*X lies when h has different values: [Ml, Mh + M), where Ml and Mh are both multiples of M. The algorithm is as follows: Step 1: Substitute k=9, N=254, and the constant M into the equations to find that the high-order bits to be truncated are 4 bits. Therefore, the value range of h is 0 to (the high 4 bits of M = M[253:250] = 12). Based on each value of h, Mh and Ml can be uniquely calculated.

[0135] Step 2: Substitute k=3, N=254, and the constant M into the equations to find that the high-order bits to be truncated are 2 bits. Therefore, the value range of h is 0 to (the high 2 bits of M = M[253:252] = 3). Based on each value of h, Mh and Ml can be uniquely calculated.

[0136] Based on the different values ​​of h, hardware lookup tables (LUTs) for Ml and Mh can be pre-created. During hardware processing, this invention extracts the high-order feature segment h of the input operand X (for example, only the high 4 bits need to be extracted when k=9, and only the high 2 bits need to be extracted when k=3). Using the pre-computed hardware lookup tables, the invention can accurately predict the boundaries of the multiple intervals Mh and Ml to which the current result belongs. This prediction mechanism transforms the reduction process, which originally required multiple serial comparisons and subtractions, into a one-step lookup operation, thereby ensuring the deterministic low-latency performance of the module when processing ultra-wide bit-width data.

[0137] In this invention, the adMA module is driven by a 2-bit control signal sel, capable of dynamically switching between four operation modes. Regardless of the mode, it can complete finite field operations with a width of 254 bits within a fixed low latency of four clock cycles. At the underlying circuit implementation level, adMA employs a segmented iterative processing strategy to balance operating frequency and hardware area. The core of the module consists of an 87-bit 3-2CSA compressor and an 87-bit carry-propagating adder (CPA), completing full-width processing of 254-bit data through three iterative cycles. In the first cycle, the control logic extracts the corresponding reduction boundary parameters from the LUT based on the sel signal; in the subsequent three calculation cycles, the hardware performs two-way subtraction operations in parallel through segmented iteration: t0 = kX Mh and t1=kX Ml. Ultimately, the module only needs to perform a single two-to-one multiplexing based on the sign bit of t0 to output the correct result within the range [0, M). This integrated architecture design, combining "multi-functional computation, prefetching parameters, and parallel reduction," makes adMA an indispensable and highly efficient functional component in the ECPA accelerator.

[0138] The specific process is as follows: Step 1: Preprocess the data according to the current selection mode.

[0139] When sel=0, it indicates that the current mode is modulo-addition mode, and Ml and Mh are 0 and M respectively.

[0140] When sel=1, it indicates that the current mode is modulo-subtraction, and Ml and Mh are ~M and 0 respectively. Furthermore, Y is converted to ~Y.

[0141] When sel=2, it indicates that the current mode is modular multiplication by a constant 3. In this case, the first two digits of X are used to directly retrieve the corresponding Ml and Mh from the lookup table. Y is the data after X is shifted left by one bit, and Y is 2*X.

[0142] When sel=3, it indicates that the current mode is modular multiplication by a constant 9. In this case, the first four bits of X are used to directly retrieve the corresponding Ml and Mh from the lookup table. Y is the data after X is shifted left by three bits, and Y is 8*X.

[0143] After padding X, Y, Ml, and Mh with leading zeros, they are divided into three parts, each of which is 87 bits.

[0144] The second step involves iterative addition operations. This consists of two main operations that are executed in parallel.

[0145] The calculation of X plus Y minus Mh is performed iteratively using S1, S3, and S5. In the first cycle, S1 is obtained by operating on the lower 87 bits of X, Y, and Mh. In the second cycle, S3 is obtained by operating on bits 87-172 of X, Y, and Mh, as well as the overflow high-order bits of S1. S5 is obtained similarly. The result is then {S5, S3, S1}. The calculation of X plus Y minus Ml is performed iteratively using S2, S4, and S6. In the first cycle, S2 is obtained by operating on the lower 87 bits of X, Y, and Ml. In the second cycle, S4 is obtained by operating on the 87th to 172nd bits of X, Y, and Ml, as well as the overflow high-order bits of S2. Similarly, S6 is obtained. The result is then {S6, S4, S2}.

[0146] Final step: If the sign bit of S5 is 0, it proves to be a positive number. Truncate {S5, S3, S1} to 254 bits to get the final result. If the sign bit of S5 is 1, truncate {S6, S4, S2} to 254 bits to get the final result.

[0147] Optionally, this embodiment uses Radix-2^{64} (i.e., a 64-bit sub-multiplier). However, on other FPGA platforms or ASIC processes, if the multiplier's hard core characteristics are different, it can be replaced with a Radix-$2^{32}$ or Radix-$2^{128}$ architecture. The corresponding number of ping-pong interleaving cycles and the width of the compressed tree need to be adjusted proportionally, but the core scheduling idea is the same.

[0148] Optionally, the constant k in this scheme is 3 or 9. If subsequent algorithm variants require multiplication by other small constants (such as 5, 7, etc.), this can be replaced by adjusting the pre-calculated value of the lookup table (LUT) and the truncated high-order bit width; the principle of prediction reduction still applies.

[0149] Optionally, existing dual-task interleaving can be further extended to multi-task interleaving (such as Quad-SMMAC processing 4 internal microtasks) to accommodate deeper pipelines or higher frequency computing needs.

[0150] The elliptic curve point addition hardware accelerator method based on the BN128 curve provided in this embodiment reduces register resource consumption by several orders of magnitude through efficient time-division multiplexing (i.e., iterative operation) of the underlying operators (only three 254-bit registers are needed globally to temporarily store intermediate variables in the ECPA process), significantly reducing the synthesis area. It solves the data dependency of Montgomery modular multiplication from the underlying level through "ping-pong interleaving." The module itself can achieve 100% multiplier utilization (no bubbles), does not rely on the system to provide a large number of concurrent requests, and the latency of a single ECPA operation is only 84 clock cycles. adMA introduces LUT boundary prediction technology based on MSB, and SMMAC introduces signed computation and optimized compressed tree logic, eliminating a large number of redundant large integer conditional branches and long carry additions (such as omitting the adder for judging carry in the lower 64 bits), which greatly shortens the latency of combinational logic and can easily run at higher clock frequencies at lower process nodes.

[0151] Based on the above embodiments, a layered compression architecture is also included, which includes: Six initial compressors are connected to a corresponding 64-bit multiplier. Each initial compressor includes a compression array consisting of four layers of 64-bit carry-holding adders and is used to generate a cascaded dataset. The cascaded dataset is dynamically fed as input to the adjacent initial compressors according to the current scheduling requirements to achieve horizontal cascading. Two final compressors, a left final compressor and a right final compressor, are connected to their respective initial compressor groups. The final compressors are used for: The compressor receives the current-cycle merging result from the initial compressor and reads the intermediate result of the previous iteration from the result register. The intermediate result of the previous iteration adopts a hybrid storage strategy: the lowest 64 bits are stored as single-line data merged by the adder, and the higher 254 bits are stored as data in a double-carry-preserving format. Finally, the compressor uses two layers of carry-preserving adder logic to complete the cumulative compression.

[0152] In practical implementation, this invention proposes a hierarchical compression architecture, which aims to process the dynamic displacement partial product (pp) generated in word-level Montgomery modular multiplication with minimal logical latency.

[0153] (1) The first level is the Initial Compressor (ICP): The system instantiates a total of 6 ICP modules (ICP0-ICP5), which correspond one-to-one with 6 hardware multipliers (M0-M5). The six outputs (p0-5) of the multipliers are directly input into the ICP modules. Since the task assigned to the multipliers in each cycle is different, the offset of the generated p also changes dynamically. The ICP adopts a dynamic multiplexing (MUX) structure, which can concatenate and merge the carry-save data generated by adjacent or even non-adjacent multipliers, avoiding the increase in depth caused by the overlap of useless leading zeros / tail zeros in the traditional compression tree.

[0154] Each ICP internal core uses a compressed array consisting of 4 layers of 64-bit carry-store adders (CSA) to process the 6 sub-part products (p0-p5) of a single set of multiplier outputs.

[0155] The key to ICP lies in the introduction of a dynamic distribution mechanism for cascaded datasets (adSet). Each ICP generates an output data packet called adSet_out (containing the lower 22 bits of direct output and intermediate sum / carry vectors generated by three layers of CSA). This data packet can be dynamically fed as adSet_in to adjacent or even non-adjacent ICP modules according to current scheduling needs. This cascaded design allows multiple ICPs processing adjacent partial products to be horizontally assembled like "building blocks," avoiding the increased compression height caused by alignment and overlap in traditional designs by directly passing intermediate results between CSA levels. Through the flexible selection of MUX, ICP can adapt to periodically changing partial product offset requirements, and the critical path of the entire ICP stage is strictly controlled within the logical length of "4 layers of CSA + 1 MUX". In addition, during the specific cycle of calculating the quotient qi, only the first 64 bits of carry-preserving format data in adSet_out need to be extracted using zero-padding, and the 64-bit adder in the backend needs to be called to restore it to a single-line result to calculate the quotient qi.

[0156] The inputs are: the six outputs p0-p5 from the Mul multiplier, and the adSet from the outside.

[0157] The output is an adSet, with both layers having a 64-bit output.

[0158] Step 1: Construct four layers of CSA compressors, each 64-bit wide, with three inputs and two outputs for each layer.

[0159] Step 2: The relative offset between the second-layer compressor and the first-layer compressor is 7 bits, the relative offset between the third-layer compressor and the second-layer compressor is 16 bits, and the relative offset between the fourth-layer compressor and the third-layer compressor is 19 bits.

[0160] The p0 output from the multiplier and the first line of data from adSet_input are concatenated and then input into the first-level compressor along with the p1 and p2 data for processing.

[0161] The two lines of output from the first-level compressor are combined with the second and third lines of data from adSet_input, and then input to the second-level compressor along with p3 for processing.

[0162] The two lines of output from the second-layer compressor are combined with the fourth and fifth lines of data from adSet_input, and then input to the third-layer compressor along with p4 for processing.

[0163] The two lines of output from the third-layer compressor are combined with the sixth and seventh lines of data from adSet_input, and then input to the fourth-layer compressor along with p5 for processing. The output of the fourth-layer compressor is the 64-bit output of both layers of the ICP module itself.

[0164] Step 3: The lower 22 bits of data input to p0 in the ICP module constitute the first row of the adSet output, adSet_output. The carry-holding outputs of the lower 7 and 6 bits of the first compressor, the carry-holding outputs of the lower 16 and 15 bits of the second compressor, and the carry-holding outputs of the lower 19 and 18 bits of the third compressor constitute the second, third, fourth, fifth, sixth, and seventh rows of data in adSet_output, respectively.

[0165] (2) The second level is the final compressor (FCP). Its main task is to accumulate and compress the current merge result generated by ICP and the old data (i.e. the intermediate result of the previous iteration) stored in the F register. The input path of FCP is very ingeniously designed: the old data input does not adopt the carry-save format completely, but adopts the "hybrid storage" strategy: the lowest 64 bits (F[0]) are single-line data after being merged by the adder (non-carry-save format), while the higher 254 bits (F[1-4]) are retained in the double-line carry-save (CS) format. FCP only uses two layers of CSA logic (the first layer is 324 bits wide and the second layer is 256 bits wide) to complete the fusion of the new and old data.

[0166] The inputs to the FCP module include: data from the ICP, with a maximum of two rows each with a width of 320 bits, and data from the result memory F, with widths of 324 bits and 260 bits respectively.

[0167] The FCP output consists of three parts: the first part, out[0], contains two rows of data, each 64 bits wide; the second part, out[1], contains two rows of data, each 64 bits wide and 63 bits wide; and the third part, out[2], contains two rows of data, each 196 bits wide. These three parts are physically adjacent and can be directly concatenated. The first part is the least significant bit, the second part is the middle part, and the third part is the most significant bit.

[0168] Step 1: Construct two CSA compressor layers. The first layer is 324 bits wide, and the second layer is 260 bits wide. Each compressor layer has three inputs and two outputs.

[0169] Step 2: Input the two 320-bit wide data lines from the ICP and the first data line from the result register into the first-layer compressor.

[0170] Step 3: Extract the first 64 bits of the first layer compressor and add a zero to the low bit of the carry row as out[0] output, which contains two rows of data with a bit width of 64.

[0171] Step 4: The last 260 bits of the two layers of data output from the first layer compressor are input into the third layer compressor and compressed together with the 260 bits of data from the second layer of the result register. The result is a carry-preserving form with two rows of 260 bits each. At this time, the lower 64 bits of data are truncated as out[1] output, which contains two rows of data with widths of 64 bits and 62 bits respectively. The higher 196 bits of data are truncated as out[2] output, which contains two rows of data with widths of 196 bits each.

[0172] Corresponding to the above embodiments, this disclosure also provides a processing method for elliptic curve point addition hardware accelerator based on BN128 curves, including: The mathematical process of a single elliptic curve point addition operation is reconstructed into a task sequence containing 12 signed modular multiplication accumulation operations and 15 advanced modular addition operations. The signed modular multiplication accumulation operation is used to fuse an addition / subtraction operation into the accumulation phase of a modular multiplication operation. The calculation formula is as follows: ; The execution rhythm is controlled based on a time unit, where each time unit contains a preset number of clock cycles. The computation delay of the advanced modular addition unit is one time unit, and the dual-channel modular multiplication and accumulation module performs pipelined processing with a task start interval of two time units. According to a preset scheduling sequence, during the execution period of a single elliptic curve point addition operation, a new signed modular multiplication and accumulation operation is seamlessly started to the dual-channel modular multiplication and accumulation module at the task start interval, so that the dual-channel modular multiplication and accumulation module runs continuously at full load. Output the final result of a single elliptic curve point addition operation after a fixed delay.

[0173] The beneficial effects of the embodiments disclosed herein are as follows: 1. Bubble-free single-cycle ECPA scheduling that does not rely on external batch tasks. Breaking away from the traditional limitation of relying on batch-mode tasks to fill pipeline bubbles, this invention refactors a single ECPA into 12 SMMAC and 15 adMA operations, dispersing data dependencies within a single task. The underlying Dual-SMMAC seamlessly starts at 12 clock cycles (II=12), operating at full capacity throughout. A single ECPA requires only 84 cycles, achieving superior area-time (AT) efficiency.

[0174] 2. Nearly "free" fusion of SMMAC operators based on iterative characteristics This overcomes the limitation that modular multiplication and modular addition / subtraction must be executed serially. In the final accumulation stage of iterative word-level Montgomery modular multiplication, a signed addend (C) is inserted for mixed calculation. With a small increase in critical logic paths, a one-step calculation of R=(±(A×B)±C) mod M is achieved, reducing the constant modular multiplication requirement of ECPA from 15 to 12.

[0175] 3. Dual-IMM Microarchitecture Based on Ping-Pong Interweaving and Partitioning Single-word multiplication and compression are defined as a fixed 2-cycle loop. Through "ping-pong interleaving," a single multiplication array processes two independent tasks alternately in odd and even cycles, perfectly masking pipeline latency. At the same time, the introduction of "left and right spatiotemporal partitioning" and "non-overlapping partial product scheduling" avoids excessive stacking of data on the same bit from the physical source, significantly reducing the height of the compression tree and wiring congestion, and ensuring stable operation at high clock frequency.

[0176] 4. Supports hierarchical compression circuits (ICP and FCP) for dynamic cascading and hybrid storage. Initial Compressor (ICP): Supports dynamic routing of cascaded packets (adSet). Adjacent ICPs can be flexibly spliced ​​together through MUX, and the critical path is strictly controlled within "4 layers CSA + 1 MUX".

[0177] Final Compressor (FCP): Employs a hybrid storage method of "low 64-bit single-line parsing + high-bit double-line carry storage" for old data. Utilizing algorithmic characteristics, carry detection can be completed with only one logical OR gate, and time-division multiplexing of the 64-bit adder is achieved between simplification and quotient calculation.

[0178] 5. Advanced Modular Addition Unit (adMA) Supporting Multiple Modes and MSB Prediction Reduction Highly integrate modular addition, modular subtraction, and modular multiplication with small constants using a single compact hardware. The core innovation lies in the prediction reduction logic based on the Most Significant Bit (MSB): by intercepting the high-order feature segment of the operand (such as the high 4 bits) to query the hardware Look-Up Table (LUT), directly obtain the prediction boundaries (Mh, Ml), and complete the reduction in one step through two-way parallel subtraction (t0, t1) and sign judgment at the subsequent pipeline stage. Replace the serial conditional subtraction with a long critical path by parallel table lookup.

[0179] The term explanations in this article are as follows: bit: Bit.

[0180] ECPA (Elliptic Curve Point Addition): Elliptic Curve Point Addition, an operation in cryptography to calculate the sum of two points on an elliptic curve to obtain a third point.

[0181] BN128 / BN254: A pairing-friendly Short Weierstrass elliptic curve defined over a 254-bit prime field, widely used in zero-knowledge proofs.

[0182] DSP (Digital Signal Processing Slice): Digital Signal Processing Unit / Multiply-Add Processing Hard Core.

[0183] MM (Modular Multiplication): Modular multiplication operation.

[0184] MA (Modular Addition): Modular addition operation.

[0185] SMMAC (Signed Modular Multiply-Accumulate): Signed Modular Multiply-Accumulate Unit, the core computing unit designed in this invention, which integrates modular multiplication and modular addition and subtraction.

[0186] IMM (Iterative Modular Multiple): Iterative modular multiplication.

[0187] FA (final addition): The final addition part. After the iterative modular multiplication is processed, the final addition is required. This does not refer to a single addition operation, but a general term.

[0188] adMA (advanced Modular Addition): An advanced modular addition unit that supports addition, subtraction, and fast modular arithmetic operations with small constants.

[0189] Montgomery Reduction: A fast modular multiplication algorithm that avoids trial division of large integers.

[0190] ICP (Initial Compressor) / FCP (Final Compressor): Initial compressor / final compressor used to align and accumulate the large number of partial products generated by the multiplier in carry-save format.

[0191] adSet (additional Set): An additional dataset used for interaction between different ICP modules.

[0192] LUT (Look-Up Table): A lookup table that stores pre-computed data in hardware logic.

[0193] Figure 3 The method shown can be applied to the above embodiment of the elliptic curve point-plus-hardware accelerator based on the BN128 curve. For parts not described in detail in this embodiment, please refer to the content described in the above method embodiment, and will not be repeated here.

[0194] It should be understood that the various parts of this disclosure can be implemented in hardware, software, firmware, or a combination thereof.

[0195] The above description is merely a specific embodiment of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this disclosure should be included within the scope of protection of this disclosure. Therefore, the scope of protection of this disclosure should be determined by the scope of the claims.

Claims

1. An elliptic curve point-addition hardware accelerator based on the BN128 curve, characterized in that, include: At least one advanced modular addition unit is used to perform modular addition, modular subtraction, or modular multiplication with a small constant on a 254-bit operand within one time unit and output intermediate results; A dual-channel modular multiplication accumulation module is used to execute two signed modular multiplication accumulation operations in parallel. Each signed modular multiplication accumulation operation is used to fuse an addition / subtraction operation into the accumulation stage of a modular multiplication operation. The calculation formula is as follows: ; A master state machine, connected to the advanced modular addition unit and the dual-channel modular multiplication and accumulation module, performs the following operations: The mathematical process of a single elliptic curve point addition operation is reconstructed into a task sequence containing 12 signed modular multiplication and accumulation operations and 15 advanced modular addition operations. The execution rhythm is controlled based on a time unit, where each time unit contains a preset number of clock cycles. The computation delay of the advanced modular addition unit is one time unit. The dual-channel modular multiplication and accumulation module has a two-stage pipeline structure, with a task start interval of two time units and a total delay of four time units. According to a preset scheduling sequence, during the execution period of a single elliptic curve point addition operation, the dual-channel modular multiplication and accumulation module is controlled to seamlessly start a new signed modular multiplication and accumulation operation at the task start interval, so that the dual-channel modular multiplication and accumulation module runs continuously at full load and outputs the final result after a fixed delay.

2. The accelerator according to claim 1, characterized in that, The dual-channel modular multiplication and accumulation module includes: A dual-channel iterative Montgomery modular multiplication unit is used to perform iterative word-level Montgomery modular multiplication calculations and output dual-channel intermediate results in carry-preserving format. A dual-channel final accumulation unit is used to receive the dual-channel intermediate results and, according to the selection signal, combine and compress the dual-channel intermediate results with a preset constant and an addition / subtraction operand C to realize the signed modular multiplication accumulation operation; Specifically, when performing signed modular multiplication accumulation, the dual-channel modular multiplication accumulation module injects the addition / subtraction operand C into the final accumulation stage of the modular multiplication operation, as follows: Based on the value of the selection signal sel, the operand C or its inverted value, the intermediate result of the carry-saving format or its inverted value, and the preset multiple constant M are combined and compressed to complete the signed multiplication-addition fusion calculation in a single compression operation.

3. The accelerator according to claim 1, characterized in that, The advanced molding unit is used for: In response to a 2-bit control signal, it switches between four operation modes: modular addition, modular subtraction, modular multiplication by a constant 3, and modular multiplication by a constant 9. Furthermore, the advanced modular addition unit includes a prediction and reduction logic based on the most significant bit feature, wherein the prediction and reduction logic is used for: When performing a modular multiplication operation by a constant k, the high-order feature segment of the input operand X is extracted, where the high 4 bits are extracted when k=9 and the high 2 bits are extracted when k=3. The hardware lookup table is queried based on the high-bit feature segments, and the predicted reduction boundaries Mh and Ml are obtained in parallel, where Mh and Ml are multiples of the modulus M. Parallel execution of two-way subtraction operations and ; Choose one of t0 and t1 as the output result based on the sign bit of t0.

4. The accelerator according to claim 1, characterized in that, The dual-channel modular multiplication and accumulation module integrates a dual-channel iterative Montgomery modular multiplication unit, which includes: Six parallel 64-bit multipliers are used to produce partial products; A ping-pong interleaving scheduler is used to interleave the first and second modular multiplication tasks to six 64-bit multipliers, wherein the start time of the first and second modular multiplication tasks is one clock cycle apart, so that the six 64-bit multipliers alternately calculate the partial product of the two tasks in each clock cycle and are in an active operation state in each clock cycle. A left-right spacetime partitioning structure is used to divide the six 64-bit multipliers and their corresponding compressed tree logic into a left processing partition and a right processing partition, and to perform the following operations: In the clock phase preceding an iteration cycle, the left partition processes the first task and the right partition processes the second task. In the next clock phase, the left partition processes the second task and the right partition processes the first task; The generation order of partial products is scheduled so that partial products input into the same compressed tree within the same clock cycle have non-overlapping or only adjacent overlapping displacement offsets.

5. The accelerator according to claim 1, characterized in that, It also includes a layered compression architecture, which includes: Six initial compressors are connected to a corresponding 64-bit multiplier. Each initial compressor includes a compression array consisting of four layers of 64-bit carry-holding adders and is used to generate a cascaded dataset. The cascaded dataset is dynamically fed as input to the adjacent initial compressors according to the current scheduling requirements to achieve horizontal cascading. Two final compressors, a left final compressor and a right final compressor, are connected to their respective initial compressor groups. The final compressors are used for: The compressor receives the current-cycle merging result from the initial compressor and reads the intermediate result of the previous iteration from the result register. The intermediate result of the previous iteration adopts a hybrid storage strategy: the lowest 64 bits are stored as single-line data merged by the adder, and the higher 254 bits are stored as data in a double-carry-preserving format. Finally, the compressor uses two layers of carry-preserving adder logic to complete the cumulative compression.

6. A processing method for an elliptic curve point-addition hardware accelerator based on the BN128 curve, applied to the elliptic curve point-addition hardware accelerator based on the BN128 curve as described in any one of claims 1 to 5, characterized in that, The method includes: The mathematical process of a single elliptic curve point addition operation is reconstructed into a task sequence containing 12 signed modular multiplication accumulation operations and 15 advanced modular addition operations. The signed modular multiplication accumulation operation is used to fuse an addition / subtraction operation into the accumulation phase of a modular multiplication operation. The calculation formula is as follows: ; The execution rhythm is controlled based on a time unit, where each time unit contains a preset number of clock cycles. The computation delay of the advanced modular addition unit is one time unit, and the dual-channel modular multiplication and accumulation module performs pipelined processing with a task start interval of two time units. According to a preset scheduling sequence, during the execution period of a single elliptic curve point addition operation, a new signed modular multiplication and accumulation operation is seamlessly started to the dual-channel modular multiplication and accumulation module at the task start interval, so that the dual-channel modular multiplication and accumulation module runs continuously at full load. Output the final result of a single elliptic curve point addition operation after a fixed delay.

7. The accelerator according to claim 6, characterized in that, The preset scheduling order includes: In the first time unit, the first signed modular multiplication accumulation task and the second signed modular multiplication accumulation task are started, and the first set of modular addition results are calculated in parallel using the advanced modular addition unit; In the second time unit, the second set of modular addition results are computed in parallel using the advanced modular addition unit, and the third and fourth signed modular multiplication accumulation tasks are started using the dual-channel modular multiplication accumulation module. At the same time, the first and second signed modular multiplication accumulation tasks continue to be executed in the pipeline. In subsequent time units, the remaining signed modular multiplication and accumulation tasks are started sequentially, and in each time unit, the modular addition result calculated in the previous stage is used as the input of the next stage task or its fused addition / subtraction operand C.

8. The accelerator according to claim 7, characterized in that, When the dual-channel modular multiplication and accumulation module performs a signed modular multiplication and accumulation task, it dynamically receives the addition / subtraction operand C in the last time unit of the calculation cycle. The addition / subtraction operand C depends on other intermediate results calculated in the same single elliptic curve point addition operation after the start of the calculation cycle.

9. The accelerator according to claim 6, characterized in that, When performing modular multiplication with a small constant, the advanced modular addition unit performs fast modular reduction by the following steps: Extract the high-order feature segment of the input operand X, where the high 4 bits are extracted when multiplied by a constant 9, and the high 2 bits are extracted when multiplied by a constant 3; The hardware lookup table is queried based on the high-bit feature segments to obtain the predicted reduction boundaries Mh and Ml in parallel. Parallel execution of two-way subtraction operations and ; Choose one of t0 and t1 as the output result based on the sign bit of t0.

Images