Elliptic curve algorithm implementation method based on vector instruction set extension and chip

Abstract

The application belongs to the technical field of encryption, and aims at solving the problem that the prior art cannot simultaneously achieve the operation efficiency of ECC algorithm and the hardware power consumption, and provides an elliptic curve algorithm implementation method based on vector instruction set extension and a chip.The elliptic curve algorithm implementation method based on vector instruction set extension comprises the following steps: in a mode extraction unit, key operation steps of an elliptic curve encryption algorithm are analyzed, and parallel computing modes and fixed logic modes are extracted; in an instruction encoding unit, according to the vector instruction set encoding principle of RISC-V, the parallel computing modes are encoded into corresponding RISC-V vector extension instructions to form parallel control instructions; and in a vector execution unit, the fixed logic modes are solidified by hardware to form hardware-level operators, and then elliptic curve encryption operations are performed on input operands in combination with the parallel control instructions, so that the operation efficiency of the algorithm can be improved and the hardware power consumption can be reduced.

Description

Technical Field

[0001] This invention belongs to the field of encryption technology, and in particular relates to an elliptic curve algorithm implementation method and chip based on vector instruction set extension. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] Elliptic curve cryptography (ECC) algorithms are primarily implemented using software programming and integrated circuits. Software programming offers greater flexibility, enabling arbitrary ECC operations, but its slower processing speed makes it unsuitable for the real-time processing requirements of the Internet of Things (IoT). Integrated circuits offer high computational efficiency and security, but require redesigned circuits for different application scenarios, resulting in lower flexibility and higher hardware overhead.

[0004] In summary, it is difficult to simultaneously balance the computational efficiency of the ECC algorithm and the power consumption of hardware when using computers to implement elliptic curve cryptography with instruction set extensions. Summary of the Invention

[0005] To address the technical problems mentioned above, this invention provides an elliptic curve algorithm implementation method and chip based on vector instruction set extension, which can improve algorithm computation efficiency and reduce hardware power consumption.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: The first aspect of the present invention provides a method for implementing an elliptic curve algorithm based on an extended vector instruction set.

[0007] An elliptic curve algorithm implementation method based on vector instruction set extension includes: In the pattern extraction unit, the key operation steps of the elliptic curve cryptography algorithm are analyzed, and the parallel computing mode and fixed logic mode are extracted. In the instruction encoding unit, the parallel computing mode is encoded into the corresponding RISC-V vector extension instructions according to the RISC-V vector instruction set encoding principle, forming parallel control instructions; In the vector execution unit, fixed logic patterns are solidified in hardware and formed into hardware-level operators. Then, combined with parallel control instructions, elliptic curve cryptography is performed on the input operands.

[0008] In one implementation, the input operands include bitmap data in a mask register to dynamically mask invalid operands.

[0009] As one implementation method, the process of dynamically masking invalid operands based on the bitmap data in the mask register includes: During the instruction execution phase, the bitmap data in the mask register is read and each bit is used as a control signal to determine the validity of the corresponding parallel processing channel in the vector execution unit, and the gating logic is used to control the on / off state of the processing channel. The pipeline cycle time remains unchanged. During the write-back phase, only the new results calculated for the valid channels are written to the corresponding positions in the target vector register based on the bitmap data in the mask register; the invalid channels retain the original values ​​in the target vector register.

[0010] As one implementation method, when a bit in the bitmap data is 1, it is a valid channel, the gating logic is activated, and the actual operands are sent into the valid channel for arithmetic logic calculation. When a bit in the bitmap data is 0, it is an invalid channel. The gating logic cuts off the input of the actual operand and passes in a neutral data or directly shuts off the clock / power supply of the invalid channel execution unit to dynamically shield invalid operations and reduce power consumption.

[0011] As one implementation method, the key computational steps of the elliptic curve cryptography algorithm include: point addition, modular inverse calculation, and scalar multiplication.

[0012] As one implementation method, in the process of encoding the parallel computing mode into the corresponding RISC-V vector extension instruction, the opcode field is assigned as the Vector extension opcode, and the function code field is identified.

[0013] As one implementation, the input operands further include: The coordinates of the first elliptic curve point are stored in the first source vector register; The coordinates of the second elliptic curve points are stored in the second source vector register; The coordinates of the sum of the first and second elliptic curve points stored in the target vector register.

[0014] A second aspect of the present invention provides an elliptic curve cryptography chip based on instruction set custom instruction extensions.

[0015] An elliptic curve cryptography chip based on instruction set extension, comprising: The pattern extraction unit is configured to parse the key computational steps of the elliptic curve cryptography algorithm and extract the parallel computing patterns and fixed logic patterns therein. The instruction encoding unit is configured to encode the parallel computing mode into corresponding RISC-V vector extension instructions according to the RISC-V vector instruction set encoding principle, forming parallel control instructions; The vector execution unit includes hardware-level operators formed by solidifying fixed logic patterns in hardware; the vector execution unit is configured to perform elliptic curve cryptographic operations on input operands based on hardware-level computation and in conjunction with parallel control instructions.

[0016] In one implementation, the vector execution unit includes a Booth-encoded optimized multiplier array, which is used to calculate the product of two numbers and perform modulo operation on the product value using the Montgomery modular multiplication algorithm.

[0017] In one implementation, on the prime field, Montgomery's modular multiplication algorithm transforms the "divide by p modulo" operation of the product value into a "divide by a power of 2" operation, where the product value is 2N bits and p is an N-bit prime number.

[0018] The beneficial effects of this invention are: This invention analyzes the key computational steps of the elliptic curve cryptography algorithm in the pattern extraction unit to obtain a parallel computing mode and a fixed logic mode. In the instruction encoding unit, the parallel computing mode is encoded into corresponding RISC-V vector extension instructions, thereby forming parallel control instructions to achieve more efficient cryptographic computation. In the vector execution unit, the fixed logic mode is solidified in hardware and formed into a hardware-level operator. Then, combined with the parallel control instructions, elliptic curve cryptography is performed on the input operands, achieving the effect of simultaneously improving the algorithm's computational efficiency and reducing hardware power consumption.

[0019] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0020] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0021] Figure 1 This is a schematic diagram of an elliptic curve cryptographic chip structure based on instruction set custom instruction extension according to an embodiment of the present invention; Figure 2 This is the hardware-level operator corresponding to the vecc_madd / msub fixed logic mode in this embodiment of the invention; Figure 3 This is the hardware-level operator corresponding to the vecc_kmul fixed logic mode in this embodiment of the invention; Figure 4 This is the hardware-level operator corresponding to the vecc_bmod fixed logic mode in this embodiment of the invention; Figure 5It is the hardware-level operator corresponding to the vecc_binv fixed logic mode in this embodiment of the invention; Figure 6 This is a comparison of the computation time of scalar and vector instructions under encryption in an embodiment of the present invention. Detailed Implementation

[0022] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0023] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0024] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0025] according to Figure 1 As shown, this embodiment of the invention provides a method for implementing an elliptic curve algorithm based on an extended vector instruction set, including: Step 1: In the pattern extraction unit, the key operation steps of the elliptic curve cryptography algorithm are analyzed, and the parallel computing mode and fixed logic mode are extracted.

[0026] In practical implementation, the key computational steps of the elliptic curve cryptography algorithm include: point addition, modular inverse calculation, and scalar multiplication.

[0027] Point addition: To calculate the sum R=(x3,y3) of two elliptic curve points P=(x1,y1) and Q=(x2,y2), the following steps are required. Taking the prime field GF(p) as an example, where p is a prime number: Calculate the slope λ: If P≠Q, then λ=(y2-y1) / (x2-x1); If P=Q, then for doubling the point, λ=(3x1²+a) / (2y1); Calculate x3=λ 2 -x1-x2, y3=λ*(x1-x3)-y1; Division can be converted to multiplication using the multiplication inverse: λ = (y² - y₁) × (x² - x₁) -1 mod p, where inverse calculation is the performance bottleneck; mod represents the modulo operation.

[0028] Modular inverse calculation: Based on the extended Euclidean algorithm or Fermat's Little Theorem, when p is a prime number, a -1 =a^(p-2) mod p, which requires efficient calculation of the modulus of large powers.

[0029] Scalar multiplication: k×P (where k is a scalar and P is an elliptic curve point) usually uses the "double-and-add" algorithm, which requires iterative execution of log2k times of doubling and conditional addition. The conditional branch (choosing whether to add based on whether the binary bit of k is 1) is the main bottleneck of pipeline efficiency.

[0030] Step 2: In the instruction encoding unit, according to the RISC-V vector instruction set encoding principle, the parallel computing mode is encoded into the corresponding RISC-V vector extension instructions to form parallel control instructions.

[0031] In the process of encoding the parallel computing mode into the corresponding RISC-V vector extension instructions, the opcode field is assigned as the Vector extension opcode, and the function code field is identified.

[0032] Based on the RISC-V vector instruction set encoding principle (RV64V), the opcode field is assigned a custom Vector extended opcode (e.g., 'b1010111'), and the function code (funct3 / funct7) field is identified (e.g., funct3='b000', funct7='b000001'). Vs2, Vs1, and Vd are the Register allocation bits, which are allocated according to the compiler's register allocation principle and the program, as shown in Table 1.

[0033] Table 1 Register allocation principles;

[0034] In Table 1, Direction indicates the data direction, where input represents input and output represents output; Register is allocated according to Table 1, following the RISC-V architecture standard, where: EGS (Element Group Size): Element group size refers to the number of elements grouped together in a single vector encryption instruction. In the RISC-V Vector Encryption Extensions manual, "EGS" is explicitly defined as "ElementGroup Size" to describe the number of elements involved in the combination operation.

[0035] EGW (Element Group Width): The element group width refers to the total bit width of all elements in the element group defined by EGS. In vector processing, EGW must be no less than the product of EGS and SEW.

[0036] SEW (Standard Element Width): Standard element width is one of the most critical configurations in the RISC-V vector extension. SEW defines the bit width of a single element in a vector register and serves as the "basic unit" of operation for the entire vector processor, acting as a granularity adjuster that controls the fineness of data processing by vector instructions.

[0037] Step 3: In the vector execution unit, the fixed logic pattern is solidified in hardware and formed into hardware-level operators. Then, combined with parallel control instructions, elliptic curve cryptography is performed on the input operands.

[0038] In this embodiment, the fixed logic modes include vecc_madd / msub (modulo addition / subtraction instruction), vecc_kmul (scalar multiplication instruction), vecc_bmod (modulo inverse instruction), and vecc_binv (dot multiplication instruction). The hardware-level operators corresponding to these fixed logic modes are respectively... Figures 2-5 As shown.

[0039] use Figure 2 The `vecc_madd / msub` (modulo addition / subtraction instruction) algorithm for calculating multi-precision modular addition is as follows: When the sum of two large numbers A and B exceeds the modulus P, a subtraction operation is required to complete the modular arithmetic. The process is as follows: Step 1: Multi-precision addition; Align the large numbers A and B from the least significant digit to the most significant digit. The large number A is arranged from the most significant digit to the least significant digit as follows: a[i-1:i-8], a[i-8:i-16], ..., a[7:0]; the large number B is arranged from the most significant digit to the least significant digit as follows: b[i-1:i-8], b[i-8:i-16], ..., b[7:0]; Perform addition with carry by word, and record the final carry output.

[0040] For the result of addition with carry; Figure 2 In this context, `add` represents addition, `reg` is a register used to store intermediate calculation results, and `carry` represents carry addition. Step 2: Conditional subtraction; Judgment: If step 1 produces a carry (Carry Out=1), or the result of addition with carry temp≥P, then the result overflows the modulus P. Here, P is represented by the following bits from most significant to least significant: p[i-1:i-8], p[i-8:i-16], ..., p[7:0]; Correction: Execute Result=temp-P; where Result is the corrected result.

[0041] In hardware, this is typically achieved by setting a selector (mux) that, under the influence of the analog control signal (alog), will carry over the addition result. The value of P is compared with that pre-stored in register reg. If temp ≥ P, a subtraction operation is triggered in the next cycle. Additionally, Figure 2 In this context, "sub" means subtraction; "borrow" means subtraction with borrow.

[0042] Figure 3 The core idea is to decompose a large number multiplication into several smaller multiplications, thereby reducing the time complexity. Suppose we want to calculate the product of two n-digit integers a and b, P = a * b; use Figure 3 The `split` function in the code splits a single parallel signal into multiple independent sub-signals: that is, it divides a and b into two parts of length n / 2. ; ; Where m = n / 2, , It is the high-level part. , It is the lower part; Calculating intermediate values: Traditional multiplication requires calculating... , , , Four products, this embodiment utilizes Figure 3 The multiplier `mult` in the code only needs to calculate three intermediate results. , and : ; ; ; Combine: Add the three results by shifting them together. .

[0043] exist Figure 3In this context, `sub` represents subtraction; `group_div` represents the shift control signal.

[0044] Figure 4 The modulo method in [the text] is suitable for a fixed modulus. Repeated calculations. The brief process is as follows: Pre-calculation: Selected (or directly) , for (number of binary bits), calculate .

[0045] For each Modulo: Calculate the approximate quotient (In practice, multiplication is used followed by right shift) Bit); calculate ; like ,but If still Reduce it again (maximum two adjustments); final .

[0046] This modulo operation converts division into multiplication and shifting, making it suitable for large integers or hardware implementations.

[0047] Figure 5 The circuit decomposition of the binary modular inverse, i.e., the calculation process of the vecc_binv instruction, is given. Binary modular inverse typically refers to an algorithm that calculates the modular inverse using binary operations (shifting, addition, and subtraction). A common algorithm is the binary extended Euclidean algorithm (also known as a variant of Stein's algorithm), which avoids division and is suitable for hardware implementation. The process is as follows: Figure 5 In this context, (a) represents the iterative operation of variables u and v; the initial inputs are u=a and v=m, ensuring... ,Right now The greatest common divisor is 1; it is first sent to the initialization operation exec for initialization, and the basic u and v values ​​are output; The two signals are shifted by shift to obtain u / 2 and v / 2, which are then fed into the corresponding selector mux along with the original u and v to achieve path selection of "original value / shifted value". The selected u and v signals are fed into the subtractor sub, which calculates the difference between uv and vu. Finally, the selector mux at the end selects the output to obtain the merged u and v result vector.

[0048] Figure 5 (b) in the equation represents the iterative operation of variables x1 and x2; The two sets of inputs are fed into independent initial operations (exec) to obtain intermediate results (x1+m) / 2 and (x2+m) / 2 after the initial operations are completed. The two sets of raw inputs x1 and x2 and their respective operation results are sent to the corresponding selectors mux to complete the selection and switching of the signal path; The selected x1 and x2 signals are fed into the subtractor sub, which calculates the two differences x1-x2 and x2-x1. Finally, the output is selected by the end selector mux, resulting in the combined x1 and x2 result vector.

[0049] exist Figure 5 In the middle, initialization: set , (Modulus) , ,ensure ,Right now The greatest common divisor is 1; iteratively calculate variables u and v until... Or either u or v is 1; like Even numbers: ;like If it is even, then ,otherwise ; like Even numbers: ;like If it is even, then ,otherwise ; like All are odd numbers: like ,but , ; otherwise , .

[0050] End: If Inverse is ;like Inverse is .

[0051] in, This means that the calculated value at the end of the arrow is assigned to the symbol that the arrow is pointing to.

[0052] In practice, the input operands include bitmap data in the mask register to dynamically mask invalid operands.

[0053] Specifically, the process of dynamically masking invalid operands based on the bitmap data in the mask register includes: During the instruction execution phase, the bitmap data in the mask register is read and each bit (0 or 1) is used as a control signal to determine the validity of the corresponding parallel processing channel (Lane) in the vector execution unit, and the gate logic is used to control the on / off state of the processing channel. The pipeline cycle time remains constant. During the write-back phase, only the new results calculated for valid channels are written to the corresponding positions in the target vector register based on the bitmap data in the mask register; invalid channels retain their original values ​​in the target vector register to ensure they are not overwritten by errors.

[0054] When a bit in the bitmap data is 1, it is a valid channel, the gating logic is activated, and the actual operands are sent into the valid channel for arithmetic logic calculation. When a bit in the bitmap data is 0, it is an invalid channel. The gating logic cuts off the input of the actual operand and passes in a neutral data or directly shuts off the clock / power supply of the invalid channel execution unit to dynamically shield invalid operations and reduce power consumption.

[0055] This embodiment achieves constant-time execution of the entire pipeline in hardware by using this data flow selection method instead of control flow branching, completely avoiding pipeline flushing and pauses caused by conditional branches (such as processing infinity).

[0056] In this embodiment of the invention, the input operands further include: The coordinates of the first elliptic curve point are stored in the first source vector register; The coordinates of the second elliptic curve points are stored in the second source vector register; The coordinates of the sum of the first and second elliptic curve points stored in the target vector register.

[0057] In one or more embodiments, an elliptic curve cryptography chip based on instruction set extension includes: The pattern extraction unit is configured to parse the key computational steps of the elliptic curve cryptography algorithm and extract the parallel computing patterns and fixed logic patterns therein. The instruction encoding unit is configured to encode the parallel computing mode into corresponding RISC-V vector extension instructions according to the RISC-V vector instruction set encoding principle, forming parallel control instructions; The vector execution unit includes hardware-level operators formed by solidifying fixed logic patterns in hardware; the vector execution unit is configured to perform elliptic curve cryptographic operations on input operands based on hardware-level computation and in conjunction with parallel control instructions.

[0058] In the specific implementation process, the vector execution unit includes a Booth-encoded optimized multiplier array, which is used to calculate the product of two numbers and perform modulo calculation on the product value using the Montgomery modular multiplication algorithm.

[0059] The goal of Booth encoding-optimized multiplier arrays (A*B) is to quickly compute the product of two large numbers (A and B) to provide input for the Montgomery algorithm. For large bit widths (such as 256 bits), the core bottleneck of the multiplier lies in the number of partial products.

[0060] The specific optimization process of Booth encoding for optimizing multiplier arrays: Input and recoding: The multiplicand A is an N-bit number (e.g., 256 bits); the multiplier B is an N-bit number.

[0061] Before being input to the Booth encoder, it is logically expanded: an implicit bit is added after its least significant bit. =0.

[0062] The encoder divides the multiplier B into overlapping 3-bit groups ( , , ), where the range of i is from 0 to N / 2)-1.

[0063] Generate control signals: The internal logic of the Booth encoder analyzes these three bit groups. Based on different bit patterns, it generates control signals to select the partial product. The advantage of Booth encoding is that it can select values ​​of 0, +A, -A, +2A, and -2A. The calculation of 2A is simply a left shift of 1 bit, while -A is achieved by inverting and adding 1.

[0064] Generate partial product: Based on the encoder's control signal, the partial product generation network selects the corresponding 0, ±A, ±2A as the i-th partial product. For N-bit multiplication, traditional multipliers require N partial products. Booth 2-bit encoding reduces this number to N / 2. For 256-bit multiplication, the number of partial products is reduced from 256 to 128, significantly reducing hardware area and computational latency.

[0065] Accumulated sum output: Each part product They will all be shifted left by 2i bits (because it is a base of 4); All partial products are accumulated in parallel using an efficient addition tree (such as a Wallace Tree or Carry-Save Adders); Finally, an accumulator outputs a 2N-bit product (A*B).

[0066] In the prime field, Montgomery's modular multiplication algorithm transforms the "divide by p modulo" operation of the product value into the "divide by a power of 2" operation, where the product value is 2N bits and p is an N-bit prime number.

[0067] The result of A*B is 2N bits (e.g., 512 bits). For the prime field GF(p) (where p is an N-bit prime), directly calculating (A*B) mod p is extremely expensive. In hardware, this means a complex division operation requiring multiple clock cycles of iteration. The core idea of ​​the Montgomery algorithm is to introduce a specific "Montgomery field" and, by pre-compiling some parameters, transform the complex "divide by p and take the modulus" operation into a simple "divide by a power of 2" operation, which in hardware manifests as a low-cost right shift and accumulation.

[0068] The specific process of reducing the number of modulo operations: First, define the Montgomery space constant R = R must satisfy R>p and R and p are coprime.

[0069] Before computation, all inputs A and B must be converted to the Montgomery domain.

[0070] The calculation process is as follows: Step 1: Multiplication by a main multiplier; First, use an optimized N-bit multiplier (i.e., a Booth multiplier array) to calculate T = A * B. The result T is a 2N-bit number.

[0071] Step 2: Montgomery's brief summary; To process a 2N-bit T, the hardware typically processes it in units of "words" (e.g., word length w = 32 bits). Loop iteration: requires execution N / w times.

[0072] Word multiplication: In each step, first calculate =( *m)mod() ),in It is the lowest word (w bits) of the current T, m= It is a pre-calculated w-bit constant; N-bit multiplication: Calculate Q= *p. This is an N+w bit multiplication. Because With only w bits, this multiplication can be quickly completed using a smaller N-bit multiplier core.

[0073] Accumulation: Calculate T = T + Q; Shift: Calculate T = T / Divide by "It only requires a right shift operation of 2 bits, without the need for complex division."

[0074] After N / w iterations, the 2N-bit T is gradually reduced to approximately N-bit, while logically completing the multiplication. The operation.

[0075] Step 3: Final Comparison: After the loop ends, the result T is in the range [0, 2p-1]. The comparator (T≥p) in the conditional subtractor determines whether T=Tp needs to be executed; The final output is an N-bit modulo product.

[0076] from Figure 6 It can be seen that in the elliptic curve encryption and decryption processes with different finite field lengths, the method of implementing the ECC algorithm through custom vector instructions can provide varying degrees of acceleration compared to the traditional method of compiling large number algorithm instructions into RISC-V scalar instructions. By analyzing computational data, the vector-custom instruction set designed in this invention achieves efficient parallel processing of multi-precision bit-width data by mapping finite field operations to a vector register set. Comparative experiments show that by utilizing data-level parallelism, this invention achieves a 17.6% to 34.9% reduction in computational latency compared to traditional scalar optimization schemes in different finite fields with widths ranging from 163 to 571 bits. Especially in the scenario of large-bit-width prime number field operations, the computational efficiency is improved through the vectorized parallel operator pipeline.

[0077] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for implementing an elliptic curve algorithm based on an extended vector instruction set, characterized in that, include: In the pattern extraction unit, the key operation steps of the elliptic curve cryptography algorithm are analyzed to extract the parallel computing mode and fixed logic mode. In the instruction encoding unit, the parallel computing mode is encoded into the corresponding RISC-V vector extension instructions according to the RISC-V vector instruction set encoding principle, forming parallel control instructions; In the vector execution unit, the fixed logic pattern is solidified in hardware and formed into hardware-level operators. Then, combined with parallel control instructions, elliptic curve cryptography is performed on the input operands. The input operands include bitmap data in a mask register to dynamically mask invalid operands; The process of dynamically masking invalid operands based on the bitmap data in the mask register includes: During the instruction execution phase, the bitmap data in the mask register is read and each bit is used as a control signal to determine the validity of the corresponding parallel processing channel in the vector execution unit, and the gating logic is used to control the on / off state of the processing channel. The pipeline cycle time remains unchanged. During the write-back phase, only the new results calculated for the valid channels are written to the corresponding positions in the target vector register based on the bitmap data in the mask register; the invalid channels retain the original values ​​in the target vector register. When a bit in the bitmap data is 1, it is a valid channel, the gating logic is activated, and the actual operands are sent into the valid channel for arithmetic logic calculation. When a bit in the bitmap data is 0, it is an invalid channel. The gating logic cuts off the input of the actual operand and passes in a neutral data or directly shuts off the clock / power supply of the invalid channel execution unit to dynamically shield invalid operations and reduce power consumption.

2. The elliptic curve algorithm implementation method based on vector instruction set extension as described in claim 1, characterized in that, The key computational steps of the elliptic curve cryptography algorithm include: point addition, modular inverse calculation, and scalar multiplication.

3. The elliptic curve algorithm implementation method based on vector instruction set extension as described in claim 1, characterized in that, In the process of encoding the parallel computing mode into the corresponding RISC-V vector extension instructions, the opcode field is assigned as the Vector extension opcode, and the function code field is identified.

4. The elliptic curve algorithm implementation method based on vector instruction set extension as described in claim 1, characterized in that, The input operands also include: The coordinates of the first elliptic curve point are stored in the first source vector register; The coordinates of the second elliptic curve points are stored in the second source vector register; The coordinates of the sum of the first and second elliptic curve points stored in the target vector register.

5. An elliptic curve cryptography chip based on instruction set extension, characterized in that, The elliptic curve algorithm implementation method based on vector instruction set extension as described in any one of claims 1-4 includes: The pattern extraction unit is configured to parse the key computational steps of the elliptic curve cryptography algorithm and extract the parallel computing patterns and fixed logic patterns therein. The instruction encoding unit is configured to encode the parallel computing mode into corresponding RISC-V vector extension instructions according to the RISC-V vector instruction set encoding principle, forming parallel control instructions; The vector execution unit includes hardware-level operators formed by solidifying fixed logic patterns in hardware; the vector execution unit is configured to perform elliptic curve cryptographic operations on input operands based on hardware-level computation and in conjunction with parallel control instructions.

6. The elliptic curve cryptography chip based on instruction set extension as described in claim 5, characterized in that, The vector execution unit includes a Booth-encoded optimized multiplier array, which is used to calculate the product of two numbers and perform modulo operation on the product value using the Montgomery modular multiplication algorithm.

7. The elliptic curve cryptography chip based on instruction set extension as described in claim 6, characterized in that, In the prime field, Montgomery's modular multiplication algorithm transforms the "divide by p modulo" operation of the product value into the "divide by a power of 2" operation, where the product value is 2N bits and p is an N-bit prime number.

Images