Modular multiplication optimization method and related apparatus

Abstract

A modular multiplication optimization method is applied to the use scene of SM2 algorithm. By decomposing the product of two values needing to perform modular multiplication operation into a polynomial, and based on the characteristics of the modulus in the modular multiplication operation, the coefficients in the polynomial are reduced, so that the result of performing the modulus operation after reducing the coefficients of the polynomial is unchanged. In this way, based on the polynomial after reducing the coefficients, a plurality of intermediate variables with smaller values can be obtained, that is, each intermediate variable can be a part of the polynomial after reducing the coefficients, and therefore by performing weighted summation on the plurality of intermediate variables and then performing the modulus operation, the final modular multiplication result can be obtained. Since the summation result of the plurality of intermediate variables is much smaller than the product of the original two values, the scheme can effectively improve the calculation efficiency of the modular multiplication operation, and further improve the execution performance of the SM2 algorithm.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a modular multiplication optimization method and related apparatus. Background Technology

[0002] The SM2 elliptic curve public-key cryptography algorithm (SM2 for short) is a commercially available cryptographic algorithm widely used in key exchange, digital signatures, and public-key encryption. Based on elliptic curve cryptography (ECC), the SM2 algorithm is implemented by combining mathematical challenges and standardized parameters, achieving a balance between security and efficiency.

[0003] In the execution of the SM2 algorithm, the core algorithm is modular multiplication, meaning that the SM2 algorithm often needs to perform modular multiplication operations frequently. Modular multiplication involves multiplying two numbers and then taking the modulo of the product with a prime number to obtain the modular multiplication result. In the SM2 algorithm, because the two numbers used for modular multiplication are often 256-bit values, and the computational complexity of modular multiplication itself is relatively high, modular multiplication is one of the more time-consuming operations in the SM2 algorithm.

[0004] Since modular multiplication is a core and time-consuming operation in the SM2 algorithm, improving its computational efficiency can effectively enhance the algorithm's performance. Therefore, how to effectively improve the computational efficiency of modular multiplication has become an urgent problem to be solved. Summary of the Invention

[0005] This application provides a modular multiplication optimization method and related apparatus, which can improve the computational efficiency of modular multiplication operations in the SM2 algorithm.

[0006] Firstly, a modular multiplication optimization method is provided, comprising: obtaining a first value and a second value that require modular multiplication in the SM2 elliptic curve public-key cryptography algorithm. The first value and the second value can be any two values ​​that require modular multiplication.

[0007] Then, the execution device analyzes the product of the first and second values, obtaining multiple intermediate variables. These intermediate variables are obtained by decomposing the product into polynomials and reducing the coefficients of the polynomials based on the modulus in the modular multiplication operation. The coefficients of the polynomials are 2 to the power of n. That is, after decomposing the product into polynomials, the execution device can use the congruence multiplication property in the modulo operation to reduce the coefficients of the polynomials, thereby reducing the result of the polynomial, but the result of performing the modulo operation on the polynomial remains unchanged.

[0008] Secondly, since each intermediate variable is obtained based on a portion of the polynomial after coefficient reduction, the execution device performs a weighted summation operation based on multiple intermediate variables to obtain a summation result. The summation result and the modulo operation result are the same as the product and the modulo operation result, and the summation result is less than the product.

[0009] Finally, the execution device performs a modulo operation based on the summation result and the modulus to obtain the modular multiplication result of the first and second values. For example, assuming the summation result is s and the modulus is p, the execution device can perform the modulo operation s mod p to obtain the modular multiplication result.

[0010] In this scheme, the product of two values ​​requiring modular multiplication is decomposed into a polynomial. Based on the characteristics of the modulus in modular multiplication, the coefficients of the polynomial are reduced, ensuring that the result of the modulo operation remains unchanged after the coefficients are reduced. Thus, based on the polynomial with reduced coefficients, multiple intermediate variables with smaller values ​​are obtained; each intermediate variable can be a part of the reduced polynomial. Therefore, by performing a weighted summation on these intermediate variables and then performing the modulo operation, the final modular multiplication result can be obtained. Since the summation of the multiple intermediate variables is much smaller than the original product of the two values, this scheme effectively improves the computational efficiency of modular multiplication, thereby enhancing the performance of the SM2 algorithm.

[0011] In one possible implementation, to obtain multiple intermediate variables, the execution device can first decompose the product into a polynomial, where multiple coefficients are powers of 2 and have distinct values. Then, the execution device replaces the fourth value in the polynomial with a third value, resulting in a polynomial with reduced coefficients. The modulo operation between the third value and the modulus yields the same result as the modulo operation between the fourth value and the modulus, with the third value being less than the fourth value, which is a power of 2. Thus, based on the polynomial with reduced coefficients, the execution device can obtain multiple intermediate variables, and the summation of these intermediate variables yields the same result as the operation on the polynomial with reduced coefficients.

[0012] In this scheme, by decomposing the product into multiple parts and obtaining the corresponding polynomials, smaller values ​​can be used to replace some larger coefficients in the polynomials, thereby reducing the coefficients in the polynomials. Ultimately, the result of the polynomials is reduced while ensuring that the modulo result remains unchanged, thereby improving the efficiency of subsequent modulo operations and effectively improving the computational efficiency of modular multiplication.

[0013] In one possible implementation, the third value is the sum of the target number to the power of 7, the target number to the power of 3, and 1, minus the target number to the power of 2; the fourth value is the target number to the power of 8; and the target number is 2 to the power of 32. That is, the target number W is 2.32 The third value is W 7 +W 3 -W 2 +1, the fourth value is W 8 .

[0014] In one possible implementation, during the process of obtaining multiple intermediate variables based on the polynomial with reduced coefficients, the execution device performs like-term merging on the polynomial with reduced coefficients to obtain a new polynomial, wherein the multiple coefficients of the new polynomial are successively from the 0th power of the target number to the 7th power of the target number, and the target number is 2 to the 32nd power. Each of the multiple coefficients of the new polynomial corresponds to multiple variables.

[0015] Then, based on the new polynomial, the execution device obtains multiple intermediate variables. For example, the execution device can obtain multiple intermediate variables by decomposing the contents of the new polynomial, so that each of the multiple intermediate variables is based on a part of the contents of the new polynomial (i.e., a partial monomial).

[0016] In one possible implementation, there are 10 intermediate variables. The first intermediate variable is represented by a first polynomial. The coefficients of the first polynomial are the same as the coefficients of the new polynomial, and the variables corresponding to some coefficients in the first polynomial are the variables corresponding to the coefficients in the new polynomial.

[0017] In this scheme, by distributing all coefficients of the polynomial after coefficient reduction to the intermediate variables, it is possible to avoid assigning only large or small coefficients to some intermediate variables, thereby ensuring the balance of size among the intermediate variables. This helps to save memory space and improve the efficiency of performing weighted summation operations on the intermediate variables.

[0018] In one possible implementation, the variable corresponding to the target coefficient in the first polynomial is obtained by inverting the variable corresponding to the target coefficient in the new polynomial, and the operator for the variable corresponding to the target coefficient in the new polynomial is a minus sign. That is, in the new polynomial, the variable corresponding to the target coefficient needs to be subtracted, not added, and this can be achieved by inverting the variable and then using it as the variable corresponding to the target coefficient in the first polynomial.

[0019] In one possible implementation, when performing a weighted summation operation based on multiple intermediate variables, to compensate for the introduction of new variables by performing a negation operation on the variables, the execution device can perform the weighted summation operation based on multiple intermediate variables and a fifth value. The fifth value has a negative weight in the weighted summation operation, and is determined based on the difference between the variable corresponding to the target coefficient in the first polynomial and the variable corresponding to the target coefficient in the new polynomial.

[0020] In this scheme, for the monomials that need to be subtracted from the polynomial after coefficient reduction, the variables of these monomials are inverted and merged into an intermediate variable. This effectively avoids constructing new intermediate variables for the monomials that need to be subtracted separately, thereby effectively reducing the number of intermediate variables and reducing the time consumption of modular multiplication.

[0021] In one possible implementation, when performing a modulo operation based on the summation result and the modulus, the execution device compares the summation result with the modulus. If the summation result is less than the modulus, the execution device outputs the summation result as the modular multiplication result. If the summation result is not less than the modulus, the execution device subtracts the modulus from the summation result and determines the modular multiplication result based on the resulting difference.

[0022] In one possible implementation, one of the multiple intermediate variables is represented using 256 bits.

[0023] In general, when the summation result is less than the modulus, the execution device directly outputs the summation result as the modular multiplication result; when the summation result is not less than the modulus, the execution device actually subtracts the modulus from the summation result continuously until the difference is less than the modulus, and finally outputs the corresponding difference as the modular multiplication result.

[0024] Secondly, a modular multiplication optimization device is provided, comprising: an acquisition module for acquiring a first value and a second value that require modular multiplication in the SM2 elliptic curve public key cryptography algorithm; a processing module for analyzing the product of the first value and the second value to obtain multiple intermediate variables, wherein the multiple intermediate variables are obtained by decomposing the product into polynomials and reducing the coefficients of the polynomials based on the modulus in the modular multiplication operation, and the coefficients of the polynomials are powers of 2; the processing module is further configured to perform a weighted summation operation based on the multiple intermediate variables to obtain a summation result, wherein the summation result and the modulo operation result are the same as the product and the modulo operation result, and the summation result is less than the product; the processing module is further configured to perform a modulo operation based on the summation result and the modulo to obtain the modular multiplication result of the first value and the second value.

[0025] In one possible implementation, the processing module is specifically used to: decompose the product into a polynomial, where multiple coefficients in the polynomial are all powers of 2 and the values ​​of the multiple coefficients are different; replace the fourth value in the polynomial with a third value to obtain a polynomial with reduced coefficients, the result of the modulo operation of the third value and the modulus is the same as the result of the modulo operation of the fourth value and the modulus, and the third value is less than the fourth value, the fourth value is a power of 2; based on the polynomial with reduced coefficients, obtain multiple intermediate variables, the summation result of the multiple intermediate variables is the same as the operation result of the polynomial with reduced coefficients.

[0026] In one possible implementation, the third value is the sum of the target number to the power of 7, the target number to the power of 3, and 1 minus the target number to the power of 2, and the fourth value is the target number to the power of 8, with the target number being 2 to the power of 32.

[0027] In one possible implementation, the processing module is specifically used to: perform like-term merging on the polynomial with reduced coefficients to obtain a new polynomial, wherein the coefficients of the new polynomial are successively from the 0th power to the 7th power of the target number, and the target number is 2 to the 32nd power, and each coefficient of the new polynomial corresponds to multiple variables; and based on the new polynomial, obtain multiple intermediate variables.

[0028] In one possible implementation, there are 10 intermediate variables. The first intermediate variable is represented by a first polynomial. The coefficients of the first polynomial are the same as the coefficients of the new polynomial, and the variables corresponding to some coefficients in the first polynomial are the variables corresponding to the coefficients in the new polynomial.

[0029] In one possible implementation, the variable corresponding to the target coefficient in the first polynomial is obtained by performing a negation operation on the variable corresponding to the target coefficient in the new polynomial, and the operator for the variable corresponding to the target coefficient in the new polynomial is a minus sign.

[0030] In one possible implementation, the processing module is specifically used to: perform a weighted summation operation based on multiple intermediate variables and a fifth value; wherein the weight of the fifth value in the weighted summation operation is negative, and the fifth value is determined based on the difference between the variable corresponding to the target coefficient in the first polynomial and the variable corresponding to the target coefficient in the new polynomial.

[0031] In one possible implementation, the processing module is specifically used to: compare the summation result with the modulus; if the summation result is less than the modulus, output the summation result as the modular multiplication result; if the summation result is not less than the modulus, subtract the modulus from the summation result and determine the modular multiplication result based on the obtained difference.

[0032] In one possible implementation, one of the multiple intermediate variables is represented using 256 bits.

[0033] Thirdly, a modular multiplication optimization apparatus is provided, which may include a processor, a processor coupled to a memory, the memory storing program instructions, and the method described in the first aspect or any implementation thereof implemented by the processor when the program instructions stored in the memory are executed. For details regarding the steps in each possible implementation of the first aspect executed by the processor, please refer to the first aspect; further details will not be elaborated here.

[0034] Fourthly, a computer-readable storage medium is provided, wherein a computer program is stored therein, which, when run on a computer, causes the computer to perform the method of any implementation of the first aspect described above.

[0035] Fifthly, a circuit system is provided, the circuit system including a processing circuit configured to perform the method of any implementation of the first aspect described above.

[0036] Sixthly, a computer program product is provided that, when run on a computer, causes the computer to execute any implementation of the first aspect described above.

[0037] In a seventh aspect, a chip system is provided, comprising a processor for supporting the functions involved in any implementation of the first aspect, such as transmitting or processing data and / or information involved in the methods described above. In one possible design, the chip system further includes a memory for storing program instructions and data necessary for a server or communication device. The chip system may be composed of chips or may include chips and other discrete devices.

[0038] The beneficial effects of the second to seventh aspects mentioned above can be referred to the introduction of the first aspect above, and will not be repeated here. Attached Figure Description

[0039] Figure 1 A schematic diagram of an elliptic curve provided for this application;

[0040] Figure 2 A schematic diagram of an application scenario provided in this application;

[0041] Figure 3 A flowchart illustrating a modular multiplication optimization method provided in this application;

[0042] Figure 4 A flowchart illustrating an analytical product to obtain multiple intermediate variables provided in this application;

[0043] Figure 5This application provides a schematic diagram of decomposing a product into a polynomial;

[0044] Figure 6 A schematic diagram illustrating the construction of intermediate variables based on polynomials provided in this application;

[0045] Figure 7 This application provides a schematic diagram illustrating an application scenario for a modular multiplication optimization method.

[0046] Figure 8 A schematic diagram illustrating a process for performing modular multiplication on two numerical values, as provided in this application;

[0047] Figure 9 A flowchart illustrating a method for reducing the summation result based on auxiliary numbers, as provided in this application;

[0048] Figure 10 This is a schematic diagram of the structure of a modular multiplication optimization device provided in this application;

[0049] Figure 11 A schematic diagram of the structure of an execution device provided in this application;

[0050] Figure 12 This is a schematic diagram of the structure of a computer-readable storage medium provided in this application. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application are described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some, and not all, of the embodiments of this application. Those skilled in the art will understand that, with the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0052] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such descriptions can be used interchangeably where appropriate to allow embodiments to be implemented in a sequence other than that illustrated or described in this application. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or modules is not necessarily limited to those explicitly listed, but may include other steps or modules not explicitly listed or inherent to such processes, methods, products, or devices. The naming or numbering of steps appearing in this application does not imply that the steps in the method flow must be performed in the chronological / logical order indicated by the naming or numbering. The execution order of named or numbered process steps can be changed according to the desired technical purpose, as long as the same or similar technical effect is achieved.

[0053] The division of units in this application is a logical division. In practical applications, there may be other division methods. For example, multiple units may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the shown or discussed mutual coupling, direct coupling, or communication connection may be through some interface, and the indirect coupling or communication connection between units may be electrical or other similar forms, none of which are limited in this application. Furthermore, the units or sub-units described as separate components may or may not be physically separated, may or may not be physical units, or may be distributed among multiple circuit units. Some or all of the units can be selected to achieve the purpose of the solution in this application according to actual needs.

[0054] For ease of understanding, some technical terms used in this application will be explained below.

[0055] (1) SM2 algorithm

[0056] The SM2 algorithm is a commercial cryptographic algorithm based on ECC (SM is an abbreviation for commercial cryptography). The core principle of the SM2 algorithm leverages a mathematical problem: on an elliptic curve group, given the result of an operation on two points on the curve, it is extremely difficult to deduce the specific information of those two points. Taking encryption using the SM2 algorithm as an example, first, an elliptic curve and a base point P are selected; then, the public key S = d * P is calculated using the private key d. With the base point P and the public key S publicly available, it is very difficult to deduce the private key d based on P and S, thus ensuring the security of the private key.

[0057] For example, please refer to Figure 1 , Figure 1This is a schematic diagram of an elliptic curve provided for this application. (For example...) Figure 1 As shown, the elliptic curve used by the SM2 algorithm is a curve defined over a 256-bit finite field, and its formula is y 2 =x 3 +ax + bmod p. Where the modulus p is a 256-bit prime number (i.e., a natural number divisible only by 1 and itself), and p = 2. 256 -2 224 -2 96 +2 64 -1.

[0058] (2) Modular multiplication

[0059] Modular multiplication refers to multiplying two numbers and then taking the modulo of the product with a prime number. Specifically, it can be represented as a * b mod p, where a and b are the two numbers to be multiplied, and mod represents the modulo operation.

[0060] (3) Modulo Operation

[0061] The modulo operation is used to calculate the remainder after dividing two integers, and it is commonly represented by the symbol mod.

[0062] (4) Polynomial

[0063] In mathematics, the sum or difference of several monomials is called a polynomial. Each monomial in a polynomial is called a term of the polynomial, and the degree of the highest term among these monomials is the degree of the polynomial.

[0064] (5) Monomial

[0065] Generally speaking, an algebraic expression consisting of the product of numbers and letters is called a monomial, and a single number or a single letter is also called a monomial.

[0066] Currently, the core algorithm in the application of the SM2 algorithm is modular multiplication. Specifically, in various application scenarios of the SM2 algorithm, data is often represented using 256 bits. Therefore, multiplying two data points results in a value requiring 512 bits. To simplify data representation, many multiplication operations in the SM2 algorithm are followed by modulo operations (e.g., modulo operation on a prime number p), resulting in modular multiplication, ensuring the result is still a 256-bit representation. However, modular multiplication itself has high computational complexity, and frequent execution of modular multiplication can significantly impact the performance of the SM2 algorithm.

[0067] Based on this, this application provides a modular multiplication optimization method. By decomposing the product of two values ​​to be multiplied into a polynomial, and by reducing the coefficients of the polynomial based on the characteristics of the modulus in modular multiplication, it ensures that the result of the modulo operation remains unchanged after the polynomial coefficients are reduced. Thus, based on the polynomial with reduced coefficients, multiple intermediate variables with smaller values ​​can be obtained; that is, each intermediate variable can be a part of the polynomial with reduced coefficients. Therefore, by performing a weighted summation on multiple intermediate variables and then performing the modulo operation, the final modular multiplication result can be obtained. Since the summation result of multiple intermediate variables is much smaller than the original product of the two values, this scheme can effectively improve the computational efficiency of modular multiplication, thereby improving the execution performance of the SM2 algorithm.

[0068] Please see Figure 2 , Figure 2 This is a schematic diagram of an application scenario provided in this application. (For example...) Figure 2 As shown, in one application scenario architecture, execution devices 201 and 202 are included. Execution devices 201 and 202 are communicatively connected, and key negotiation, digital signature, and public key encryption are performed between them based on the SM2 algorithm. The modular multiplication optimization method provided in this application can be applied to execution devices 201 or 202 to improve the efficiency of modular multiplication operations in the SM2 algorithm. Execution devices 201 or 202 can be, for example, terminal devices capable of executing the SM2 algorithm, such as servers, personal computers, smartphones, tablets, laptops, or smart cars; this application does not specifically limit their capabilities.

[0069] Please see Figure 3 , Figure 3 This is a flowchart illustrating a modular multiplication optimization method provided in this application. Figure 3 As shown, the execution flow of the modular multiplication optimization method includes the following steps 301-304.

[0070] Step 301: Obtain the first and second values ​​that need to be modularly multiplied in the SM2 algorithm.

[0071] In this application, the execution device can execute the SM2 algorithm in scenarios such as key negotiation, digital signature, or public-key encryption. Furthermore, during the execution of the SM2 algorithm, the execution device obtains two values ​​(i.e., a first value and a second value) that require a modular multiplication operation. The first and second values ​​can be any two values ​​for which a modular multiplication operation is required, and they are typically represented using 256 bits, meaning the maximum value of both the first and second values ​​is 2. 256 -1.

[0072] Step 302: Analyze the product of the first and second values ​​to obtain multiple intermediate variables. These intermediate variables are obtained by decomposing the product into polynomials and reducing the coefficients of the polynomials based on the modulus in the modular multiplication operation. The coefficients of the polynomials are 2 to the power of n.

[0073] In this application, since the first and second values ​​are 256-bit values, their product often requires 512 bits to represent, resulting in a very large product. Because of this large product, directly performing a modulo operation on the product would incur significant computational overhead, leading to low efficiency. Therefore, this application aims to minimize the size of the values ​​requiring the modulo operation while maintaining the same result, thereby reducing computational overhead.

[0074] Specifically, the execution device can analyze the product of the first and second values ​​to obtain multiple intermediate variables with smaller values. During this analysis, the device first decomposes the product into a polynomial, where the coefficients of each monomial are pre-specified and are powers of 2, where n is an integer greater than or equal to 0. After decomposing the product into a polynomial, the device can utilize the property of congruence in modulo operations to reduce the coefficients of the polynomial, thereby reducing the size of the polynomial result.

[0075] The multiplication property of congruence states that if b mod p = c mod p, then the result of ab mod p is the same as the result of ac mod p. Therefore, for each monomial b in a polynomial, if a smaller value c is found such that b mod p = c mod p, then c can be used to replace b, thereby reducing the coefficient of the monomial. For example, in the SM2 algorithm, the modulus p = 2 when performing modular multiplication. 256 -2 224 -2 96 +2 64 -1, at this point W=2 32 Then we can determine up to W 8 mod p = (W 7 +W 3 -W 2 +1)mod p. Therefore, in a polynomial, if the coefficients can be based on W... 8 Therefore, the value W in the coefficient is obtained. 8 The numerical value W can be used.7 +W 3 -W 2 +1 is used to replace it, in order to reduce the coefficient.

[0076] Therefore, after reducing the coefficients of the polynomial, the result of the polynomial with reduced coefficients will be less than the product of the first and second values. At this point, the execution device can obtain multiple intermediate variables based on the polynomial with reduced coefficients, and each intermediate variable can be a part of the polynomial. Specifically, since the coefficients of each monomial in the polynomial obtained by the execution device through product transformation are fixed (2 to the power of n), the variable multiplied by the coefficient in the monomial is related to the specific value of the product of the first and second values. Furthermore, reducing the coefficients of the polynomial also reduces the coefficients of the monomials. Therefore, for the polynomial obtained from decomposition and the polynomial with reduced coefficients, only the coefficients have changed, while the variables in the polynomial remain unchanged. Moreover, since the coefficient reduction process is also deterministic, the execution device can obtain multiple intermediate variables based on the variables in the decomposition polynomial and their corresponding reduced coefficients (i.e., it is equivalent to knowing in advance the reduced coefficients corresponding to each coefficient in the polynomial, and then combining the variables in the polynomial with the reduced coefficients to obtain the intermediate variables). In this way, the execution device can then obtain the result of the polynomial with reduced coefficients by weighted summation of multiple intermediate variables.

[0077] Step 303: Based on multiple intermediate variables, perform a weighted summation operation to obtain the summation result. The summation result and the modulo operation result are the same as the product and the modulo operation result, and the summation result is less than the product.

[0078] After determining multiple intermediate variables, since each intermediate variable is derived from a portion of the polynomial with reduced coefficients, the execution device can perform a weighted summation operation on these intermediate variables to obtain the summation result. The summation result of the multiple intermediate variables is the result of the polynomial with reduced coefficients. Therefore, the summation result of the multiple intermediate variables and the modulo operation result of the modulo p are the same as the product and the modulo operation result of the modulo p.

[0079] To conserve storage space for intermediate variables and reduce computational resources when performing weighted summation on them, each intermediate variable is represented using 256 bits. This means that by using 256 bits for each intermediate variable, their sizes are kept as close as possible, ensuring that each variable occupies a relatively small amount of storage space (not 512 bits). Furthermore, performing weighted summation on each intermediate variable sequentially ensures that the sum gradually increases, preventing uneven summation from negatively impacting computational efficiency.

[0080] Step 304: Based on the summation result and the modulus, perform the modulo operation to obtain the modulo multiplication result of the first and second values.

[0081] For example, assuming the summation result is s and the modulus is p, the execution device can perform the modulo operation s mod p to obtain the modular multiplication result, which is the modular multiplication result of the first and second values. That is, the execution device only needs to perform the modulo operation on the summation result of multiple intermediate variables (i.e., the result of the polynomial with reduced coefficients) and the modulus, instead of directly performing the modulo operation on the product of the first and second values ​​and the modulus. This effectively reduces the size of the values ​​involved in the modulo operation, thereby reducing the computational load and improving the efficiency of executing the SM2 algorithm.

[0082] To facilitate understanding, the following will detail the process of analyzing the product in step 302 above to obtain multiple intermediate variables. Please refer to [link to relevant documentation]. Figure 4 , Figure 4 This application provides a flowchart illustrating an analysis of products to obtain multiple intermediate variables. For example... Figure 4 As shown, the process of performing device analysis product and obtaining multiple intermediate variables includes the following steps 3021-3023.

[0083] Step 3021: Decompose the product into a polynomial, in which multiple coefficients are all powers of 2 and the values ​​of the multiple coefficients are different.

[0084] Specifically, since the product is a value represented by 512 bits, the execution device can divide the 512 bits into multiple parts of 32 bits each. Furthermore, the multiple parts obtained from the product can be represented using polynomials, that is, each part corresponds to a monomial.

[0085] For example, please refer to Figure 5 , Figure 5 This application provides a schematic diagram of decomposing a product into a polynomial. For example... Figure 5As shown, assuming the first value is 'a', the second value is 'b', and the product of the first and second values ​​is 'ab' = 'c', then the 256 bits of 'a' and 'b' can be divided into 8 parts, each consisting of 32 bits. In this case, 'a' can be represented as... b can be represented as in, Similarly, c = ab can also be divided into 16 parts, each represented by 32 bits. Therefore, for a 512-bit c, c can be represented as... It can be seen that in the polynomials mentioned above, to All are coefficients, and these coefficients are essentially powers of 2. 0 To c 15 These are the variables corresponding to the coefficients in the polynomial, and these variables can be obtained based on the specific value of c.

[0086] Step 3022: Replace the fourth value in the polynomial with the third value to obtain a polynomial with reduced coefficients. The result of the modulo operation of the third value and the modulus is the same as the result of the modulo operation of the fourth value and the modulus, and the third value is less than the fourth value, and the fourth value is a power of 2.

[0087] After obtaining the polynomial, in order to reduce the coefficients in the polynomial, the execution device can replace the fourth value in the polynomial with a third value, thereby obtaining a polynomial with reduced coefficients.

[0088] For example, the third value can be the sum of the target number to the power of 7, the target number to the power of 3, and 1, minus the target number to the power of 2; the fourth value can be the target number to the power of 8, and the target number is 2 to the power of 32. That is, the target number W is 2. 32 The third value is W 7 +W 3 -W 2 +1, the fourth value is W 8 .

[0089] It should be noted that during the process of reducing the coefficients of a polynomial, the execution device can continuously simplify the polynomial and replace any fourth value that appears during the simplification process with a third value, until the coefficients in the polynomial are no longer greater than the third value. For example, for the polynomial... For this monomial, W is used first. 7 +W 3 -W 2 +1 to replace W 8 Thus, we obtain c9W*(W 7+W 3 -W 2 +1); At this point, the executing device can continue to simplify the monomial after replacing the coefficients, and use W 7 +W 3 -W 2 +1 to continue replacing the W that appeared during the simplification process. 8 That is, c9W*(W 7 +W 3 -W 2 +1) can be transformed into c9W 8 +c9W*(W 3 -W 2 +1), and then through coefficient substitution, it is converted to c9(W) 7 +W 4 -W 2 +W+1).

[0090] For example, please refer to Figure 5 ,like Figure 5 As shown, by adopting W 7 +W 3 -W 2 +1 replaces W in the polynomial 8 This can simplify the polynomial, ultimately yielding a set of coefficients respectively. to The polynomial with reduced coefficients. Clearly, the product of ab was originally a 512-bit value, represented by coefficients respectively. to It is represented by a polynomial; and after coefficient reduction, the coefficients in the reduced polynomial are respectively to Therefore, the result of the polynomial with reduced coefficients can be represented by 256 bits.

[0091] Step 3023: Based on the polynomial with reduced coefficients, multiple intermediate variables are obtained. The summation result of the multiple intermediate variables is the same as the operation result of the polynomial with reduced coefficients.

[0092] For example, after performing a coefficient reduction operation on a polynomial, the execution device can perform like-term merging on the polynomial with reduced coefficients (i.e., merging variables using coefficients with values ​​equal to the power of 2n as like terms) to obtain a new polynomial. The coefficients of the new polynomial are successively from the 0th power of the target number to the 7th power of the target number, with the target number being 2 to the power of 32. Each coefficient of the new polynomial corresponds to multiple variables.

[0093] In this way, the execution device can obtain multiple intermediate variables based on the new polynomial. For example, the execution device can obtain multiple intermediate variables by decomposing the contents of the new polynomial, so that each of the multiple intermediate variables is obtained based on a part of the contents of the new polynomial (i.e., a partial monomial).

[0094] It should be noted that during the process of obtaining multiple intermediate variables based on a new polynomial, the execution device can try to ensure that the values ​​of each intermediate variable are close to each other, so as to save storage space for intermediate variables and improve the efficiency of subsequent weighted summation operations on multiple intermediate variables.

[0095] In one possible example, the multiple intermediate variables obtained based on the new polynomial are specifically 10 intermediate variables.

[0096] In this system, the first intermediate variable is represented by a first polynomial. The coefficients of this first polynomial are the same as those of the coefficients of the new polynomial, and the variables corresponding to some coefficients in the first polynomial are the variables corresponding to the coefficients of the new polynomial. That is, the coefficients of the new polynomial are respectively... to The coefficients of the first polynomial are also respectively to Furthermore, in the new polynomial, a coefficient may correspond to multiple variables, and the variable corresponding to a coefficient in the first polynomial can be a partial variable corresponding to that coefficient in the new polynomial.

[0097] Optionally, the variable corresponding to the target coefficient in the first polynomial is obtained by inverting the variable corresponding to the target coefficient in the new polynomial, and the operator for the variable corresponding to the target coefficient in the new polynomial is a minus sign. That is, in the new polynomial, the variable corresponding to the target coefficient needs to be subtracted, not added. This can be done by inverting the variable (i.e., reversing the values ​​of multiple bits representing the variable, for example, from 1 to 0, or from 0 to 1) and then using it as the variable corresponding to the target coefficient in the first polynomial. Specifically, since a variable S in the new polynomial is represented using 32 bits, inverting the variable s is equivalent to... Therefore, it is possible to base on This is used to represent the operator (i.e., minus sign) corresponding to the variable S in the new polynomial.

[0098] For example, please refer to Figure 6 , Figure 6 This is a schematic diagram illustrating the construction of intermediate variables based on polynomials, as provided in this application. Figure 6 As shown, in Figure 5 Based on the above, by adopting W7 +W 3 -W 2 +1 replaces W in the polynomial 8 Furthermore, by performing a merging operation of similar types, polynomials can be simplified, ultimately resulting in a set of coefficients. to A new polynomial. In the new polynomial, the coefficients... To coefficient Each of these corresponds to multiple variables. For example, coefficients. The corresponding variables include c0, c8, c9, and c 10 c 11 c 12 ,2c 13 ,2c 14 ,2c 15 And these

[0099] The relationship between the variables is additive; coefficients The corresponding variables include c2, c8, c9, and c 13 c 14 Furthermore, the relationship between these variables is subtraction. Based on the new polynomial, A1 to A can be constructed by distributing the variable corresponding to each coefficient as evenly as possible to each intermediate variable. 10 These 10 intermediate variables. Among them, A1 to A 10 The representation of these 10 intermediate variables is shown in Table 1 below.

[0100] Table 1

[0101]

[0102] in,

[0103] That is, each intermediate variable is a 256-bit integer, and each intermediate variable is divided into 8 parts of 32 bits each, with each part having a corresponding coefficient. a power of n. For example, At this point, ab mod p = (A1 + 2A2 + 2A3 + 2A4 + 2A5 + A6 + A7 + A8 + A9 + A 10 -4W 3 Modulo p. That is, after performing a weighted summation on multiple intermediate variables, the modulo operation is then performed based on the summation result to obtain the modular multiplication result.

[0104] As explained above, when performing a weighted summation on multiple intermediate variables, for the coefficients in intermediate variables A6 to A9... The introduced variables are all obtained by inverting the variables in the original polynomial, thus effectively introducing new variables. Furthermore, new variables With coefficient After multiplication, it becomes At this point, when summing multiple intermediate variables with weights, it is necessary to subtract the new values ​​introduced to ensure that the result of the multiple intermediate variables is the same as the result of the polynomial after the coefficients are reduced.

[0105] For example, after obtaining multiple intermediate variables, the execution device can perform a weighted summation operation based on the multiple intermediate variables and a fifth value. The fifth value has a negative weight (i.e., -1) in the weighted summation operation, and the fifth value is based on the variable corresponding to the target coefficient in the first polynomial (such as the one mentioned above). ) and the variables corresponding to the target coefficients in the new polynomial (such as c above). 14 The difference between them is used to determine the fifth value, which is the aforementioned 4W. 3 .

[0106] In summary, during modular multiplication, the number of intermediate variables significantly impacts the computation time. This is because intermediate variables need to be stored in memory after being obtained, and the weighted summation requires accessing them (i.e., copying them from memory to registers for calculation). This approach distributes all coefficients of the reduced polynomial evenly among the intermediate variables, avoiding the problem of assigning only large or small coefficients to some intermediate variables. This ensures a balance in the size of the intermediate variables, saving memory and improving the efficiency of weighted summation.

[0107] Furthermore, for the monomials that need to be subtracted from the polynomial after coefficient reduction, by performing the inversion operation on the variables of these monomials and merging them into an intermediate variable, it is possible to effectively avoid constructing new intermediate variables for the monomials that need to be subtracted separately, thereby effectively reducing the number of intermediate variables and reducing the time consumption of modular multiplication operations.

[0108] During the execution of the modulo operation on the summation result and the modulus by the execution device, since the modulo operation is essentially a division operation, and performing division operations is a very complex and time-consuming operation for the device, it often consumes a lot of computing resources. Therefore, the execution device may not directly perform the modulo operation on the summation result and the modulus, but instead use one or more subtraction operations to achieve the modulo operation.

[0109] Alternatively, as an alternative to directly performing the modulo operation, the execution device may first compare the summation result with the modulus.

[0110] If the summation result is less than the modulus, the execution device can directly output the summation result as the modular multiplication result.

[0111] If the summation result is not less than the modulus, the execution device subtracts the modulus from the summation result and determines the modular multiplication result based on the resulting difference. That is, the execution device continues to compare the resulting difference with the modulus to determine whether to output the difference as the modular multiplication result or to continue subtracting the modulus from the difference.

[0112] In general, when the summation result is less than the modulus, the execution device directly outputs the summation result as the modular multiplication result; when the summation result is not less than the modulus, the execution device actually subtracts the modulus from the summation result continuously until the difference is less than the modulus, and finally outputs the corresponding difference as the modular multiplication result.

[0113] The above describes the execution flow of a modular multiplication optimization method provided in this application. For ease of understanding, the following will detail the execution process of this modular multiplication optimization method in practical applications with specific examples.

[0114] For example, please refer to Figure 7 , Figure 7 This is a schematic diagram illustrating an application scenario for the modular multiplication optimization method provided in this application. For example... Figure 7 As shown, in the interaction between the decryptor and the encryptor, the decryptor first generates a key based on the SM2 algorithm. This key generation process involves modular multiplication, which can be optimized using the aforementioned modular multiplication optimization method. After generating the public key, the decryptor sends it to the encryptor, enabling the encryptor to encrypt the plaintext using the SM2 algorithm and obtain the ciphertext. The encryption process also involves modular multiplication, which can be optimized using the aforementioned modular multiplication optimization method. After obtaining the ciphertext, the encryptor sends it to the decryptor. The decryptor can then use its private key to decrypt the ciphertext using the SM2 algorithm, thus completing the data exchange between the two parties. Again, the decryption process involves modular multiplication, which can be optimized using the aforementioned modular multiplication optimization method.

[0115] Optionally, the decryption party could be a browser or application on the user's terminal device, while the encryption party could be a server. Alternatively, the decryption party could be a server, and the encryption party could be a browser or application.

[0116] Of course, in addition to the above Figure 7In addition to the public key decryption scenarios mentioned, the modular multiplication optimization method of this application can also be applied to other scenarios using the SM2 algorithm, such as key negotiation or digital signature, without specific limitations.

[0117] Please see Figure 8 , Figure 8 This application provides a flowchart illustrating a modular multiplication operation on two numerical values. For example... Figure 8 As shown, based on the modular multiplication optimization method provided in this application, any two values ​​that need to undergo modular multiplication in the SM2 algorithm can be processed to improve the efficiency of obtaining the modular multiplication result. Specifically, the processing flow for performing modular multiplication on two values ​​includes the following steps 801-807.

[0118] Step 801: Input 256-bit values ​​a and b.

[0119] In this algorithm, both values ​​'a' and 'b' are 256-bit values, and they are the two values ​​that need to be modularly multiplied in the SM2 algorithm. For example, suppose value a = 0x816378f99cde25e380cc2dfaf24edcdd55a7f9ce916795d27abd73506622b81, and value b = 0x1278557e2a8d281f5869151ae56548f204df3d0428442657d0e83dbdd7b4fa0c. Furthermore, the modulus p of the result of the modular multiplication is 0xfffffffeffffffffffffffffffffffffffffff00000000ffffffffffffffff.

[0120] Step 802, calculate c = ab.

[0121] After obtaining the values ​​a and b, the execution device first performs a multiplication operation on values ​​a and b, resulting in c = ab. That is, c = ab = 0x955d0580dab3ca6b177b80a75f54ad3bf6169d270aa876addeeab77cf742cedc14bb17e851e5af68f95731f8753b79d7cfcf613edcdf7edd9ca98518ca040c.

[0122] Step 803: Decompose c into a polynomial representation to obtain multiple variables (c 15 c 14 c 13 ...c0).

[0123] In this step, by dividing the 512-bit 'c' into 16 parts and representing each of the 16 parts based on a monomial, 'c' can be decomposed into a polynomial. Furthermore, the coefficients of the polynomial are... The variables corresponding to the coefficients of the polynomial are (c 15 c 14 c 13 ...c0).

[0124] For example, with respect to the above c, we can obtain c 15 =0x00955d05, c 14 =0x80dab3ca, c 13 =0x6b177b80, c 12 =0xa75f54ad,c 11 =0x3bf6169d,c 10 =0x270aa876,c9=0xaddeeab7, c8 = 0x7cf742ce c7=0xdc14bb17, c6=0xe851e5af, c5=0x68f95731, c4=0xf8753b79, c3=0xd7cfcf61, c2=0x3edcdf7e, c1=0xdd9ca985, c0=0x18ca040c.

[0125] Step 804, based on multiple variables (c 15 c 14 c 13 ...c0), to obtain multiple intermediate variables (A1, A2, A3...A 10 ).

[0126] For the multiple variables obtained from the polynomial derived by decomposing c, the execution device can obtain multiple intermediate variables (A1, A2, A3...A...) according to the instructions in Table 1 above. 10 Specifically, the values ​​of several intermediate variables are shown below.

[0127] A1=0xdc14bb17e851e5af68f95731f8753b79d7cfcf613edcdf7edd9ca98518ca040c

[0128] A2=0x00955d050000000000955d0580dab3ca6b177b800000000000955d0500955d05

[0129] A3=0x80dab3ca000000000000000000000000000000000000000080dab3ca80dab3ca

[0130] A4=0x6b177b80000000000000000000000000000000000000000000000006b177b80

[0131] A5=0xa75f54ad0000000000000000000000000000000000000000000000000000000

[0132] A6=0x3bf6169d00955d0580dab3ca00955d0500955d057f254c366b177b80a75f54ad

[0133] A7=0x270aa87680dab3ca6b177b806b177b8080dab3ca94e88480a75f54ad3bf6169d

[0134] A8=0xaddeeab73bf6169d270aa876a75f54ada75f54ad522115493bf6169d270aa876

[0135] A9=0x7cf742ce0000000000000000addeeab73bf6169d8308bd32270aa876addeeab7

[0136] A 10 =0x00955d050000000000000000000000007cf742ce00000000addeeab77cf742ce

[0137] Step 805: Perform a weighted summation on multiple intermediate variables to obtain the summation result.

[0138] Specifically, the executing device can calculate temp = A1 + 2A2 + 2A3 + 2A4 + 2A5 + A6 + A7 + A8 + A9 + A 10 Where temp can be any value that has not been subtracted (i.e., ... The summation result of ) is as follows. Specifically, based on the values ​​of the above intermediate variables, temp = 0x5924ec6ada5b80d1c7d20e8febb15baf98fbb854a281482b303d3451e270f5def can be calculated.

[0139] Step 806: Reduce the summation result based on the auxiliary number.

[0140] Specifically, please refer to Figure 9 , Figure 9 This application provides a flowchart illustrating a method for reducing the summation result based on auxiliary numbers. For example... Figure 9 As shown, the process of reducing the summation result based on the auxiliary number may include the following steps S1-S7.

[0141] S1, Constructing auxiliary numbers

[0142] S2, determine whether the summation result temp is less than or equal to p.

[0143] S3, if the summation result temp ≤ p, then reduce the result.

[0144] S4. If the summation result temp > p, then let the reduction result ret = temp - Q.

[0145] S5, under the condition that ret = temp - Q, determine whether ret is greater than or equal to p.

[0146] S6. If ret≥p, then let ret=ret-p.

[0147] That is, the execution device updates ret to the value after subtracting p. Furthermore, after completing step S6, the execution device continues to execute step S5 as described above.

[0148] S7, in step S3, reduce the result Alternatively, if in step S5 it is found that ret < p, the reduced result ret is output.

[0149] Step 807: Output the reduction result as the modular multiplication result.

[0150] Specifically, the execution device can output the reduction result ret as the modular multiplication result ab mod p. Based on the value of temp above, ret = temp - qpppp = 0x924ec6b2a5b80d1c7d20e8febb15baf98fbb854b281482ae03d3451e270f5df4 is calculated.

[0151] Of course, in some embodiments, in step 805 above, the executing device may also subtract excess values ​​when performing the weighted summation, thus obtaining... At this point, in step 806, the execution device may determine whether temp is less than the modulus p. If temp is less than the modulus p, then temp is output as the modular multiplication result; if temp is not less than the modulus p, then temp is subtracted from the modulus p until a modular multiplication result less than the modulus p is obtained.

[0152] The methods provided in the embodiments of this application have been described in detail above. Next, the device for performing the above methods provided in the embodiments of this application will be described.

[0153] Please see Figure 10 , Figure 10 This is a schematic diagram of a modular multiplication optimization device provided in this application. Figure 10 As shown, the modular multiplication optimization device includes: an acquisition module 1001, used to acquire a first value and a second value that need to be modularly multiplied in the SM2 elliptic curve public key cryptography algorithm; a processing module 1002, used to analyze the product of the first value and the second value to obtain multiple intermediate variables, which are obtained by decomposing the product into polynomials and reducing the coefficients of the polynomials based on the modulus in the modular multiplication operation, wherein the coefficients of the polynomials are 2 to the power of n; the processing module 1002 is also used to perform a weighted summation operation based on the multiple intermediate variables to obtain a summation result, wherein the summation result and the modulo operation result are the same as the product and the modulo operation result, and the summation result is less than the product; the processing module 1002 is also used to perform a modulo operation based on the summation result and the modulus to obtain the modular multiplication result of the first value and the second value.

[0154] In one possible implementation, the processing module 1002 is specifically used to: decompose the product into a polynomial, wherein multiple coefficients in the polynomial are all powers of 2 and the values ​​of the multiple coefficients are different; replace the fourth value in the polynomial with a third value to obtain a polynomial with reduced coefficients, wherein the result of the modulo operation of the third value and the modulus is the same as the result of the modulo operation of the fourth value and the modulus, and the third value is less than the fourth value, and the fourth value is a power of 2; and based on the polynomial with reduced coefficients, obtain multiple intermediate variables, wherein the summation result of the multiple intermediate variables is the same as the operation result of the polynomial with reduced coefficients.

[0155] In one possible implementation, the third value is the sum of the target number to the power of 7, the target number to the power of 3, and 1 minus the target number to the power of 2, and the fourth value is the target number to the power of 8, with the target number being 2 to the power of 32.

[0156] In one possible implementation, the processing module 1002 is specifically used to: perform like-term merging on the polynomial with reduced coefficients to obtain a new polynomial, wherein the coefficients of the new polynomial are successively from the 0th power of the target number to the 7th power of the target number, and the target number is 2 to the 32nd power, and each coefficient of the new polynomial corresponds to multiple variables; and obtain multiple intermediate variables based on the new polynomial.

[0157] In one possible implementation, there are 10 intermediate variables. The first intermediate variable is represented by a first polynomial. The coefficients of the first polynomial are the same as the coefficients of the new polynomial, and the variables corresponding to some coefficients in the first polynomial are the variables corresponding to the coefficients in the new polynomial.

[0158] In one possible implementation, the variable corresponding to the target coefficient in the first polynomial is obtained by performing a negation operation on the variable corresponding to the target coefficient in the new polynomial, and the operator for the variable corresponding to the target coefficient in the new polynomial is a minus sign.

[0159] In one possible implementation, the processing module 1002 is specifically used to: perform a weighted summation operation based on multiple intermediate variables and a fifth value; wherein the weight of the fifth value in the weighted summation operation is negative, and the fifth value is determined based on the difference between the variable corresponding to the target coefficient in the first polynomial and the variable corresponding to the target coefficient in the new polynomial.

[0160] In one possible implementation, the processing module 1002 is specifically used to: compare the summation result with the modulus; if the summation result is less than the modulus, output the summation result as the modular multiplication result; if the summation result is not less than the modulus, subtract the modulus from the summation result, and determine the modular multiplication result based on the obtained difference.

[0161] In one possible implementation, one of the multiple intermediate variables is represented using 256 bits.

[0162] Please see Figure 11 , Figure 11 This is a schematic diagram of an execution device provided in this application. The execution device 1100 can specifically be a mobile phone, tablet, laptop, smart wearable device, server, etc., and is not limited thereto. Specifically, the execution device 1100 includes: a receiver 1101, a transmitter 1102, a processor 1103, and a memory 1104 (wherein the execution device 1100 may have one or more processors 1103). Figure 11(Taking a processor as an example), processor 1103 may include application processor 11031 and communication processor 11032. In some embodiments of this application, receiver 1101, transmitter 1102, processor 1103 and memory 1104 may be connected via bus or other means.

[0163] Memory 1104 may include read-only memory and random access memory, and provides instructions and data to processor 1103. A portion of memory 1104 may also include non-volatile random access memory (NVRAM). Memory 1104 stores processor and operation instructions, executable modules, or data structures, or subsets thereof, or extended sets thereof, wherein the operation instructions may include various operation instructions for implementing various operations.

[0164] Processor 1103 controls the operation of the execution device. In specific applications, the various components of the execution device are coupled together through a bus system, which may include not only the data bus, but also power buses, control buses, and status signal buses. However, for clarity, all buses are referred to as the bus system in the diagram.

[0165] The methods disclosed in the embodiments of this application described above can be applied to processor 1103, or implemented by processor 1103. Processor 1103 can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit in the hardware of processor 1103 or by instructions in the form of software. The processor 1103 described above can be a general-purpose processor, a digital signal processor (DSP), a microprocessor or a microcontroller, and may further include an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0166] The processor 1103 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory 1104. The processor 1103 reads information from memory 1104 and, in conjunction with its hardware, completes the steps of the above methods.

[0167] Receiver 1101 can be used to receive input digital or character information, and to generate signal inputs related to the settings and function control of the execution device. Transmitter 1102 can be used to output digital or character information through the first interface; transmitter 1102 can also be used to send instructions to the disk group through the first interface to modify the data in the disk group; transmitter 1102 may also include a display device such as a display screen.

[0168] This application also provides a chip, comprising a processing unit and a communication unit. The processing unit may be, for example, a processor, and the communication unit may be, for example, an input / output interface, pins, or circuits. The processing unit can execute computer execution instructions stored in a storage unit to cause the chip within the execution device to perform the methods described in the above embodiments. Optionally, the storage unit can be an in-chip storage unit, such as a register or cache. Alternatively, the storage unit can be an external storage unit located within a wireless access device, such as a read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions, such as random access memory (RAM).

[0169] Please refer to Figure 12 , Figure 12 This is a schematic diagram of a computer-readable storage medium provided in this application. This application also provides a computer-readable storage medium in some embodiments, wherein the above-described... Figure 3 The disclosed method can be implemented as computer program instructions encoded in a machine-readable format on a computer-readable storage medium or on other non-transitory media or articles of art.

[0170] Figure 12 A conceptual partial view of an example computer-readable storage medium arranged according to at least some of the embodiments shown herein is illustrated schematically. The example computer-readable storage medium includes a computer program for executing computer processes on a computing device.

[0171] In one embodiment, the computer-readable storage medium 1200 is provided using a signal bearer medium 1201. The signal bearer medium 1201 may include one or more program instructions 1202, which, when executed by one or more processors, can provide the above-mentioned... Figure 3 The described function or part of the function.

[0172] In some examples, signal carrying medium 1201 may include computer-readable medium 1203, such as, but not limited to, hard disk drive, compact disc (CD), digital video disc (DVD), digital magnetic tape, memory, ROM or RAM, etc.

[0173] In some embodiments, the signal-bearing medium 1201 may comprise a computer-recordable medium 1204, such as, but not limited to, a memory, a read / write (R / W) CD, a R / W DVD, etc. In some embodiments, the signal-bearing medium 1201 may comprise a communication medium 1205, such as, but not limited to, digital and / or analog communication media (e.g., fiber optic cables, waveguides, wired communication links, wireless communication links, etc.). Therefore, for example, the signal-bearing medium 1201 may be transmitted by a wireless communication medium 1205 (e.g., a wireless communication medium conforming to the IEEE 802.X standard or other transmission protocols).

[0174] One or more program instructions 1202 may be, for example, computer-executable instructions or logical implementation instructions. In some examples, the computing device may be configured to provide various operations, functions, or actions in response to one or more program instructions 1202 conveyed to the computing device via a computer-readable medium 1203, a computer-recordable medium 1204, and / or a communication medium 1205.

[0175] It should also be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. In addition, in the accompanying drawings of the device embodiments provided in this application, the connection relationship between modules indicates that they have a communication connection, which can be implemented as one or more communication buses or signal lines.

[0176] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware, or it can be implemented by special-purpose hardware including application-specific integrated circuits, special-purpose CPUs, special-purpose memory, special-purpose components, etc. Generally, any function performed by a computer program can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be diverse, such as analog circuits, digital circuits, or special-purpose circuits. However, for this application, software program implementation is more often the preferred implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a readable storage medium, such as a computer floppy disk, USB flash drive, mobile hard disk, ROM, RAM, magnetic disk, or optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, training equipment, or network device, etc.) to execute the methods of the various embodiments of this application.

[0177] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0178] A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, computer instructions may be transferred from one website, computer, training device, or data center to another website, computer, training device, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives (SSDs)).

Claims

1. A modular multiplication optimization method, characterized in that, include: To obtain the first and second values ​​that require modular multiplication in the SM2 elliptic curve public-key cryptography algorithm; The product of the first value and the second value is analyzed to obtain multiple intermediate variables. These intermediate variables are obtained by decomposing the product into polynomials and reducing the coefficients of the polynomials based on the modulus in the modular multiplication operation. The coefficients of the polynomials are 2 to the power of n. Based on the multiple intermediate variables, a weighted summation operation is performed to obtain a summation result, wherein the summation result and the modulo operation result of the modulo are the same as the product and the modulo operation result, and the summation result is less than the product; Based on the summation result and the modulus, a modulo operation is performed to obtain the modular multiplication result of the first value and the second value.

2. The method according to claim 1, characterized in that, The analysis of the product of the first and second values ​​yields several intermediate variables, including: The product is decomposed into a polynomial, wherein multiple coefficients of the polynomial are all powers of 2 and the values ​​of the multiple coefficients are different; The third value is used to replace the fourth value in the polynomial to obtain a polynomial with reduced coefficients. The result of the modulo operation of the third value and the modulus is the same as the result of the modulo operation of the fourth value and the modulus, and the third value is less than the fourth value. The fourth value is a power of 2. Based on the polynomial with reduced coefficients, the plurality of intermediate variables are obtained, and the summation result corresponding to the plurality of intermediate variables is the same as the operation result of the polynomial with reduced coefficients.

3. The method according to claim 2, characterized in that, The third value is the sum of the target number to the power of 7, the target number to the power of 3, and 1, minus the target number to the power of 2. The fourth value is the target number to the power of 8, and the target number is 2 to the power of 32.

4. The method according to claim 2 or 3, characterized in that, The plurality of intermediate variables obtained based on the polynomial with reduced coefficients include: The polynomial with reduced coefficients is subjected to like term merging to obtain a new polynomial, wherein the coefficients of the new polynomial are successively from the 0th power of the target number to the 7th power of the target number, the target number is 2 to the 32nd power, and the coefficients of the new polynomial correspond to multiple variables. Based on the new polynomial, the plurality of intermediate variables are obtained.

5. The method according to claim 4, characterized in that, The plurality of intermediate variables consists of 10 intermediate variables. The first intermediate variable among the plurality of intermediate variables is represented by a first polynomial. The coefficients of the first polynomial are the same as the coefficients of the new polynomial, and the variables corresponding to some coefficients in the first polynomial are the variables corresponding to the coefficients in the new polynomial.

6. The method according to claim 5, characterized in that, The variable corresponding to the target coefficient in the first polynomial is obtained by performing a negation operation on the variable corresponding to the target coefficient in the new polynomial, and the operator for the variable corresponding to the target coefficient in the new polynomial is a minus sign.

7. The method according to claim 6, characterized in that, The weighted summation operation based on the multiple intermediate variables includes: Based on the aforementioned intermediate variables and the fifth numerical value, a weighted summation operation is performed; The fifth value has a negative weight in the weighted summation operation, and the fifth value is determined based on the difference between the variable corresponding to the target coefficient in the first polynomial and the variable corresponding to the target coefficient in the new polynomial.

8. The method according to any one of claims 1-7, characterized in that, The step of performing a modulo operation based on the summation result and the modulus includes: Compare the summation result with the modulus; If the summation result is less than the modulus, output the summation result as the modular multiplication result; If the summation result is not less than the modulus, the summation result is subtracted from the modulus, and the modular multiplication result is determined based on the obtained difference.

9. The method according to any one of claims 1-8, characterized in that, One of the multiple intermediate variables is represented using 256 bits.

10. A modular multiplication optimization device, characterized in that, include: The acquisition module is used to obtain the first and second values ​​that need to be modularly multiplied in the SM2 elliptic curve public key cryptography algorithm; The processing module is used to analyze the product of the first value and the second value to obtain multiple intermediate variables. The multiple intermediate variables are obtained by decomposing the product into polynomials and reducing the coefficients of the polynomials based on the modulus in the modular multiplication operation. The coefficients of the polynomials are 2 to the power of n. The processing module is further configured to perform a weighted summation operation based on the plurality of intermediate variables to obtain a summation result, wherein the summation result and the modulo operation result of the modulo are the same as the product and the modulo operation result, and the summation result is less than the product; The processing module is further configured to perform a modulo operation based on the summation result and the modulus to obtain the modulo multiplication result of the first value and the second value.

11. The apparatus according to claim 10, characterized in that, The processing module is specifically used for: The product is decomposed into a polynomial, wherein multiple coefficients of the polynomial are all powers of 2 and the values ​​of the multiple coefficients are different; The third value is used to replace the fourth value in the polynomial to obtain a polynomial with reduced coefficients. The result of the modulo operation of the third value and the modulus is the same as the result of the modulo operation of the fourth value and the modulus, and the third value is less than the fourth value. The fourth value is a power of 2. Based on the polynomial with reduced coefficients, the plurality of intermediate variables are obtained, and the summation result corresponding to the plurality of intermediate variables is the same as the operation result of the polynomial with reduced coefficients.

12. The apparatus according to claim 11, characterized in that, The third value is the sum of the target number to the power of 7, the target number to the power of 3, and 1, minus the target number to the power of 2. The fourth value is the target number to the power of 8, and the target number is 2 to the power of 32.

13. The apparatus according to claim 11 or 12, characterized in that, The processing module is specifically used for: The polynomial with reduced coefficients is subjected to like term merging to obtain a new polynomial, wherein the coefficients of the new polynomial are successively from the 0th power of the target number to the 7th power of the target number, the target number is 2 to the 32nd power, and the coefficients of the new polynomial correspond to multiple variables. Based on the new polynomial, the plurality of intermediate variables are obtained.

14. The apparatus according to claim 13, characterized in that, The plurality of intermediate variables consists of 10 intermediate variables. The first intermediate variable among the plurality of intermediate variables is represented by a first polynomial. The coefficients of the first polynomial are the same as the coefficients of the new polynomial, and the variables corresponding to some coefficients in the first polynomial are the variables corresponding to the coefficients in the new polynomial.

15. The apparatus according to claim 14, characterized in that, The variable corresponding to the target coefficient in the first polynomial is obtained by performing a negation operation on the variable corresponding to the target coefficient in the new polynomial, and the operator for the variable corresponding to the target coefficient in the new polynomial is a minus sign.

16. The apparatus according to claim 15, characterized in that, The processing module is specifically used for: Based on the aforementioned intermediate variables and the fifth numerical value, a weighted summation operation is performed; The fifth value has a negative weight in the weighted summation operation, and the fifth value is determined based on the difference between the variable corresponding to the target coefficient in the first polynomial and the variable corresponding to the target coefficient in the new polynomial.

17. The apparatus according to any one of claims 10-16, characterized in that, The processing module is specifically used for: Compare the summation result with the modulus; If the summation result is less than the modulus, output the summation result as the modular multiplication result; If the summation result is not less than the modulus, the summation result is subtracted from the modulus, and the modular multiplication result is determined based on the obtained difference.

18. The apparatus according to any one of claims 10-17, characterized in that, One of the multiple intermediate variables is represented using 256 bits.

19. A modular multiplication optimization device, characterized in that, The device includes a memory and a processor; the memory stores code, and the processor is configured to execute the code, wherein when the code is executed, the device performs the method as described in any one of claims 1 to 9.

20. A computer storage medium, characterized in that, The computer storage medium stores instructions that, when executed by the computer, cause the computer to perform the method according to any one of claims 1 to 9.

21. A computer program product, characterized in that, The computer program product stores instructions that, when executed by a computer, cause the computer to perform the method according to any one of claims 1 to 9.

Images