Montgomery multiplier and memory system

Abstract

To realize a Montgomery multiplier and memory system that can efficiently compute multiplication over finite fields. [Solution] The Montgomery multiplication device is A × B × R for prime number q and integers A and B. -1 Calculate modulo q. q = 2 K - 2 w It is expressed as + 1, and R is a value that satisfies the condition 1 < R < q, and R = 2 w It is represented by: The Montgomery multiplier divides C, obtained by calculating A × B, into S, T, U, and V, (S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) The first process is executed to calculate (+ S). If the result of the first process is negative, the Montgomery multiplier outputs the value obtained by adding q to the result of the first process, and if the result of the first process is greater than or equal to q, it subtracts q from the result of the first process.

Description

[Technical Field]

[0001] Embodiments of the present invention relate to a Montgomery multiplier and memory system for computing multiplication over a finite field. [Background technology]

[0002] In recent years, memory systems equipped with non-volatile memory have become widely adopted. One such memory system is the solid-state drive (SSD), which includes NAND flash memory and a controller.

[0003] Memory system controllers sometimes perform signature verification processing on firmware stored in non-volatile memory. In this case, it is desirable to efficiently compute multiplication over finite fields. [Prior art documents] [Patent Documents]

[0004] [Patent Document 1] U.S. Patent No. 6,546,104 [Patent Document 2] U.S. Patent Application Publication No. 2011 / 0013768 [Patent Document 3] U.S. Patent Application Publication No. 2015 / 0277855 Specification [Non-patent literature]

[0005] [Non-Patent Document 1] Ahmet Can Mert, et al., "Design and Implementation of a Fast and Scalable NTT-Based Polynomial Multiplier Architecture", [online], [Retrieved June 4, 2024], Internet<URL:https: / / eprint.iacr.org / 2019 / 109.pdf> [Overview of the project]

Problems to be Solved by the Invention

[0006] The problem to be solved by one embodiment of the present invention is to provide a Montgomery multiplication device and a memory system capable of efficiently calculating multiplication over a finite field.

Means for Solving the Problems

[0007] According to an embodiment, a Montgomery multiplication device calculates A × B × R -1 mod q for prime number q and integers A, B. q is represented by q = 2 K - 2 w + 1, each of A and B is a K-bit integer satisfying 0 ≦ A, B < q, R is a value satisfying 1 < R < q, and R is represented by R = 2 w . The Montgomery multiplication device divides a 2K-bit integer C obtained by calculating A × B into S, T, U, and V. S is the first (K - w) bits of C, T is the w bits following S, U is the (K - w) bits following T, and V is the w bits following U. The Montgomery multiplication device executes a first process of calculating (S · 2 w + V) + (T · 2 (K - w) + U) - (V · 2 (K - w) + S). When the calculation result of the first process is negative, the Montgomery multiplication device outputs, as the calculation result of A × B × R -1 mod q, a value obtained by adding q to the calculation result of the first process. When the calculation result of the first process belongs to the range from 0 to (q - 1), the Montgomery multiplication device outputs the calculation result of the first process as the calculation result of A × B × R -1 mod q. When the calculation result of the first process is q or more, the Montgomery multiplication device outputs, as the calculation result of A × B × R -1 mod q, a value obtained by subtracting q from the calculation result of the first process. The Montgomery multiplication device executes a second process including these processes.

Brief Description of the Drawings

[0008] [Figure 1] A block diagram showing an example configuration of a memory system to which a controller including a Montgomery multiplier according to the embodiment is applied. [Figure 2] A diagram illustrating an example of the Montgomery multiplication algorithm, including the Montgomery reduction. [Figure 3] A diagram showing the functional configuration of a Montgomery multiplier. [Figure 4] A circuit diagram showing an example configuration of a Montgomery multiplier according to the first embodiment. [Figure 5] A diagram illustrating the process of generating the value of (S·2w + V) by concatenating S and V. [Figure 6] This diagram illustrates the process of generating the value of (T·2(K - w)+U) by concatenating T and U. [Figure 7] A diagram illustrating the process of generating the value of (V·2(K - w)+ S) by concatenating V and S. [Figure 8] A circuit diagram showing a modified version of the Montgomery multiplier. [Figure 9] A flowchart illustrating the Montgomery multiplication procedure. [Modes for carrying out the invention]

[0009] The embodiments will be described below with reference to the drawings.

[0010] The Montgomery multiplier 1 according to this embodiment is a device that computes multiplication over a finite field and can be used for digital signature processing in a memory system. The memory system 300 to which the controller 100 including the Montgomery multiplier 1 is applied is configured as shown in Figure 1. Figure 1 is a diagram showing the configuration of the memory system 300 to which the controller 100 including the Montgomery multiplier 1 is applied.

[0011] The memory system 300 is implemented as a storage device such as an SSD (Solid State Drive). The memory system 300 includes a controller 100 and non-volatile memory 200.

[0012] The controller 100 has a circuit and is implemented as an LSI such as a system-on-a-chip (SoC). The controller 4 is electrically connected to the non-volatile memory 200. The controller 100 processes I / O commands (write commands and read commands) received from the host 400, and performs data read operations to read data from the non-volatile memory 200 and data write operations to write data to the non-volatile memory 200.

[0013] For example, a toggle NAND flash interface or an open NAND flash interface (ONFI) can be used as the physical interface connecting the controller 100 and the non-volatile memory 200. Each function of the controller 100 can be implemented by dedicated hardware, a processor that executes programs, or a combination thereof.

[0014] The controller 100 verifies the signature of the firmware stored in the non-volatile memory 200 when the memory system 300 is powered on. The controller 100 also verifies the signature of the updated firmware when it is updated. Furthermore, the controller 100 may send and receive data to and from an external device such as the host 400 using the secure protocol SPDM (Security Protocol and Data Model). In this case, the controller 100 generates a signature for the data to be sent.

[0015] Thus, the controller 100 has the functionality to perform digital signature processing, including signature generation and signature verification.

[0016] The controller 100 includes a main control circuit 101, a quantum-resistant computer signature processing circuit 102, and a buffer memory 103.

[0017] The main control circuit 101 includes, for example, a CPU (not shown). The CPU is a processor. The CPU included in the main control circuit 101 performs various processes, including data writing, data reading, and digital signature processing, by executing firmware stored in the non-volatile memory 200.

[0018] The post-quantum signature processing circuit 102 performs calculations for signature generation and signature verification. The post-quantum signature processing circuit 102 supports digital signature processing based on post-quantum digital signatures. Post-quantum cryptography (PQC) and post-quantum digital signatures are general terms for encryption and digital signatures that remain secure even after quantum computers are put into practical use, and the NIST (National Institute of Standards and Technology) is working to standardize post-quantum cryptography and post-quantum digital signatures. NIST's standardization is expected to standardize a digital signature scheme called ML-DSA (Module Lattice Digital Signature Algorithm). ML-DSA requires a large number of multiplication calculations over finite fields. To efficiently (highly) calculate multiplication over finite fields, the post-quantum signature processing circuit 102 includes a Montgomery multiplier 1. The Montgomery multiplier 1 can be implemented within the controller 100 as a Montgomery multiplier circuit. Details of the Montgomery multiplier 1 will be described later.

[0019] The non-volatile memory 200 is, for example, a NAND flash memory. The non-volatile memory 200 includes a storage area 201 and a management information storage area 202. The storage area 201 is a storage area for storing user data. The user data is data received from the host 400. The management information storage area 202 is a storage area for storing firmware (FW) 501 and signature 502. Signature 502 is a signature (digital signature) attached to firmware (FW) 501 stored in the non-volatile memory 200. Signature 502 may be a signature generated by the quantum-resistant signature processing circuit 102, or it may be a signature generated outside the memory system 300.

[0020] In the memory system 300, when the memory system 300 is powered on, the controller 100 reads the firmware 501 and signature 502 from the non-volatile memory 200, temporarily stores the read firmware 501 and signature 502 in the buffer memory 104, and performs signature verification of the firmware 501 using the quantum-resistant signature processing circuit 102.

[0021] In verifying the signature of firmware 501, the controller 100 calculates the hash value of firmware 501 and extracts a value based on the public key from signature 502. Then, the controller 100 uses the hash value of firmware 501 and the extracted value to determine whether predetermined conditions are met.

[0022] If the predetermined conditions are met, the controller 100 determines that the firmware 501 has not been tampered with and starts the process to start the firmware 501.

[0023] On the other hand, if the predetermined conditions are not met, the controller 100 determines that the firmware 501 has been tampered with and prohibits the startup of the firmware 501.

[0024] Furthermore, the controller 100 also performs signature verification of the updated firmware when the firmware 501 is updated.

[0025] In the memory system 300, each process is required to be completed within a limited time. The signature verification of firmware 501 is also required to be completed within a certain time. Therefore, it is necessary to perform the signature verification of firmware 501 at high speed.

[0026] In ML-DSA, a large number of operations are required to calculate multiplications over finite fields during digital signature processing. The controller 100 performs digital signature processing based on ML-DSA, for example, the signature verification processing of firmware 501. That is, the controller 100 performs the signature verification processing of firmware 501, which includes the calculation of multiplications over finite fields using the Montgomery multiplier 1 of the quantum-resistant signature processing circuit 102.

[0027] Multiplication over a finite field, i.e., the remainder of multiplication, is expressed as A × B mod q, where A and B are integers and q is the prime number used as the modulus. In ML-DSA, the representation of modulus q is unique, and modulus q is given by q = 2 23 - 2 13 Defined by + 1.

[0028] Multiplication over a finite field, i.e., A × B mod q, requires a significant amount of computation in the modulo q part. Montgomery reduction allows multiplication over a finite field without using computationally expensive division. The Montgomery reduction for a given integer C is C × R -1 mod q = C × 2 -K It is expressed modulo q. That is, C mod q requires division for its calculation, whereas C × 2 -K Mod q can be calculated without division.

[0029] In Montgomery reduction, generally, R = 2 K> R = 2 that satisfies q K However, C×2 -K Used for calculating modulo q. -1 is the reciprocal of R modulo q, and R × R -1 ≡ Satisfies 1 mod q.

[0030] Alternatively, in Montgomery reduction, C×2 -H The calculation modulo q is repeated L times, where H and L are integers satisfying H × L ≥ K.

[0031] Non-patent document 1 (Design and Implementation of a Fast and Scalable NTT-Based Polynomial Multiplier Architecture) states that q = k × 2 w + 1 = C × 2 -w By taking advantage of the fact that modulo q can be easily calculated, C × 2 -w The Montgomery reduction is calculated by repeating the calculation modulo q L times. In other words, Non-Patent Literature 1 states C × 2 -(w×L) The modulo q is calculated as the Montgomery reduction. However, 2 (w×L) > It is q.

[0032] In this embodiment, the Montgomery multiplier 1 uses an integer K and w to calculate q = 2 K - 2 w When expressed by + 1, use a value R that satisfies the condition 1 < R < q, and perform the Montgomery reduction A × B × R -1 mod q = C × R -1 We calculate modulo q. Here, R is R = 2 w It can be used.

[0033] Thus, in this embodiment, q = 2 K - 2 w Use + 1 modulo q and find a value that satisfies the condition 1 < R < q, for example 2 w By using R, Montgomery reduction C × R-1 mod q = C × 2 -w The modulo q is calculated. As a result, the Montgomery reduction can be calculated quickly using only addition, subtraction, and multiplexers. In this embodiment, C×2 -w The calculation modulo q only needs to be performed once. By speeding up the Montgomery reduction calculation, the calculation of multiplication over a finite field, i.e., A × B mod q, can be accelerated. Therefore, it becomes possible to efficiently (and quickly) perform signature verification of firmware 501 based on ML-DSA, a post-quantum digital signature that requires a large number of calculations of multiplication over a finite field.

[0034] Next, the details of the Montgomery multiplier 1 of this embodiment will be described. Prior to the detailed description of the Montgomery multiplier 1, an overview of the Montgomery multiplication algorithm, which is widely used to calculate the multiplication remainder, will be provided.

[0035] The Montgomery multiplication algorithm is an algorithm that optimizes (speeds up) the computationally expensive modulo operation. The Montgomery multiplication algorithm performs modulo operations using the Montgomery representation.

[0036] Here, we illustrate the multiplication x over a finite field represented by the following equation (m1).

[0037] x = a·b mod q …(m1) The symbol "·" represents multiplication. Furthermore, in the following, the symbol "·" also represents multiplication. Also, in the following, multiplication is represented by either the symbol "·" or the symbol "×". a and b are integers. q is the prime number used as the modulus.

[0038] In the Montgomery multiplication algorithm, an integer a is converted to a Montgomery representation (denoted here as Montgomery representation A), and an integer b is converted to a Montgomery representation (denoted here as Montgomery representation B). Then, the multiplication result X is obtained by multiplying Montgomery representation A and Montgomery representation B. The multiplication result X is then converted back to an integer x. This allows us to compute the multiplication x over a finite field without performing costly division.

[0039] More specifically, the Montgomery multiplication algorithm uses Montgomery reduction to achieve division-free operations. The Montgomery reduction MontRed(C) for integers C is defined as shown in equation (m2) below.

[0040] MontRed(C) = C·R -1 mod q …(m²) At this time, R is raised to a power of 2 (here, R = 2 K If we assume that, we obtain the following equation (m3).

[0041] MontRed(C) = C·2 -K mod q …(m3) Furthermore, when using Montgomery multiplication (MontMul) to calculate multiplication x over a finite field, R is given by the following equation (m4). 2 This is required in advance.

[0042] R 2 = 2 2K mod q …(m4) Figure 2 shows (A) an example of the result X obtained by multiplying Montgomery representation A and Montgomery representation B, and (B) an example of the calculation of Montgomery reduction.

[0043] The conversion from an integer a to a Montgomery representation A is performed using Montgomery reduction. As shown in Figure 2(A), the conversion from an integer a to a Montgomery representation A using Montgomery reduction is expressed by the following equation (m5).

[0044] A = MontMul(a, R2 ) = a·2 2K ·2 -K mod q = a·2 K mod q …(m5) The conversion from an integer b to a Montgomery representation B is also performed using Montgomery reduction. The conversion from an integer b to a Montgomery representation B using Montgomery reduction is expressed by the following equation (m6).

[0045] B = MontMul(b, R 2 ) = b·2 2K ·2 -K mod q = b·2 K mod q …(m6) The result X obtained by multiplying Montgomery representation A and Montgomery representation B is then expressed by the following equation (m7) using Montgomery reduction.

[0046] X = MontMul(A, B) = ((a·2 K )·(b·2 K ))·2 -K mod q = a·b·2 K mod q …(m7) Furthermore, the inverse transformation from the result of multiplication X to an integer x can also be performed using Montgomery reduction. The inverse transformation from the result of multiplication X to an integer x can be expressed using Montgomery reduction as follows (m8).

[0047] x = MontMul(X, 1) = (a·b·2 K )·2 -K mod q = a·b mod q …(m8) Figure 2(B) shows an example of the calculation of the Montgomery reduction when C = A·B in MondRed(C) shown in equation (m3) (i.e., when C is the product A·B of Montgomery representations A and B). In this case, C is a 2K bit string. In the calculation example shown in Figure 2(B), a multiple of q is added to C to make the lower K bits 0. Then, by right-shifting the addition result by K bits, C·2 -K To obtain.

[0048] Let u·q be the multiple of q that is added to C. Here, let q' be defined as q' = -q -1 mod 2 K If u is an integer such that the following holds, then u can be expressed by the following equation (m9).

[0049] u = C·q' mod 2 K …(m9) in this case, (C + u·q) mod 2 K = (C + C·q'·q) mod 2 K = (C + C·(-q -1 )·q) mod 2 K = (C - C) mod 2 K = 0 Therefore, (C + u·q) is 2 K It is a multiple of . In other words, (C + u·q) is a value in which the lower K bits are 0, as shown in Figure 2(B).

[0050] Then, we calculate T = (C + u·q) >> K by right-shifting (C + u·q) by K bits. However, since 0 ≤ T < 2q, if T is greater than or equal to q, we calculate S = T - q by subtracting q from T. In other words, if T is less than q, x = T, and if T is greater than or equal to q, x = S.

[0051] As described above, multiplication x over a finite field can be calculated without performing division in effect by using the Montgomery multiplication algorithm, which includes the Montgomery reduction.

[0052] Next, the details of the Montgomery multiplier 1 of this embodiment will be described.

[0053] Below, modulo q is q = 2 K - 2 wWhen expressed by + 1, by using a value for R that satisfies 1 < R < q, the Montgomery reduction A × B × R -1 This section describes an example of a process for quickly calculating modulo q.

[0054] In the following explanation, q represents the prime number used modulo. q is defined as q = 2, where K is an integer and w is an integer. K - 2 w It is represented by + 1. K satisfies the condition 1 < K, and W satisfies the conditions 1 < w and w < K.

[0055] q = 2 K - 2 w The modulo q form + 1 is used in ML-DSA with q=2 23 - 2 13 This corresponds to the modulo q form + 1.

[0056] Therefore, q = 2 K - 2 w + 1 is a suitable modulus form for computation of multiplication over a finite field performed in digital signature processing based on quantum-resistant digital signatures.

[0057] Each of A and B is a K-bit integer satisfying the conditions 0 ≤ A and B < q.

[0058] C is a 2K-bit integer obtained by calculating the product of A and B (A × B).

[0059] R is a value that satisfies the condition 1 < R < q. In this embodiment, R = 2 w However, it can be used as R that satisfies the condition 1 < R < q.

[0060] The Montgomery multiplier 1 of this embodiment performs Montgomery reduction A × B × R for a prime number q and an integer C. -1 mod q = C × R -1 mod q = C × 2 -w The modulo q is calculated as follows. Here, R -1is the reciprocal of R on the law q, and R×R -1 ≡ 1 mod q is satisfied. As described above, q is q = 2 K - 2 w + 1, and each of A and B is a K-bit integer satisfying the condition 0 ≦ A, B < q. Therefore, C is 0 ≦ C ≦ (q - 1) 2 < q 2 < q×2 K is an integer satisfying the condition.

[0061] The Montgomery multiplication device 1 divides a C that is a 2K-bit value into (K - w) bits + w bits + (K - w) bits + w bits. That is, the first (K - w) bits of C are S, the w bits following S are T, the (K - w) bits following T are U, and the w bits following U are V. As a result, the 2K bits from the MSB to the LSB of C are divided into (K - w)-bit S, w-bit T, (K - w)-bit U, and w-bit V.

[0062] Each of S and U is a (K - w)-bit value. Therefore, for S, 0 ≦ S < 2 (K - w) holds, and for U, 0 ≦ U < 2 (K - w) also holds.

[0063] Each of T and V is a w-bit value. Therefore, for T, 0 ≦ T < 2 w holds, and for V, 0 ≦ V < 2 w also holds.

[0064] The bit string of S is located on the MSB side by the bit length of T (w bits) more than the bit string of T. For this reason, the K-bit value including S and T following S is represented by (S·2 w + T).

[0065] The bit string of U is located on the MSB side by the bit length (w bits) of V more than the bit string of V. Therefore, the K-bit value including U and V following U is represented by (U·2 w + V).

[0066] The K-bit value including S and T is located on the MSB side by K bits more than the K-bit value including U and V. Therefore, C is represented by the following formula (m11).

[0067] C = (S·2 w + T)·2 K + (U·2 w + V) …(m11) In addition, when the Montgomery multiplication device 1 of the present embodiment is implemented by hardware, the values of S, T, U, and V can be obtained by a wiring connection that extracts only a part of the bits from C. The wiring connection is a wiring that connects between the outside and the arithmetic logic in the Montgomery multiplication device 1 or between the arithmetic logics in the Montgomery multiplication device 1, and at least includes internal wiring in the Montgomery multiplication device 1. Therefore, the Montgomery multiplication device 1 can divide C into S, T, U, and V without specific arithmetic logic. In other words, the Montgomery multiplication device 1 can extract S, T, U, and V from C using one or more wiring connections (internal wiring of the Montgomery multiplication device 1) corresponding to each of S, T, U, and V.

[0068] In the present embodiment, the modulus q is represented by q = 2 K - 2 w + 1 using the integers K and w. Therefore, the following formula (m12) holds.

[0069] 2 K - 2 w + 1 ≡ 0 (mod q) …(m12) The left side of the formula (m12) indicates the modulus q itself.

[0070] Noting the formula (m12), C = (S·2 w+ T)·2 K + (U·2 w + V) …(m11) C ≡ (S·2 w + T)(2 w - 1) + (U·2 w + V) (mod q) …(m13) C ≡ (S·2 w + T)(2 w - 1) + (U·2 w (T - V)(2 K - 2 w + 1) (mod q) …(m14) C ≡ ((S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) + S))·2 w (mod q) …(m15) Therefore, the following equation (m16) holds true.

[0071] C·2 -w ≡ (S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) + S) (mod q) …(m16) Thus, using an integer K and an integer w < K, q = 2 K - 2 w Using modulus q expressed in the form + 1, C × 2 -w When calculating modulo q, the value satisfying the condition 1 < R < q (in this case, 2) w By using R as C×2 -w Mod q can be defined as an addition or subtraction operation using the (K - w) bits of S, the w bits of T, the (K - w) bits of U, and the w bits of V, as shown in equation (m16).

[0072] Here, we will explain the derivation process of equation (m16).

[0073] As can be understood from equation (m12), 2 K Under the law of q, 2w - It is congruent to 1. Therefore, equation (m13) is congruent to the 2 contained in the right-hand side of equation (m11). K 2 w - This can be derived by substituting 1. That is, ((S·2) in equation (m11). w + T)·2 K + (U·2 w + V)) is, under modulus q, the equation (m13) ((S·2 w + T)(2 w - 1) + (U·2 w It is congruent to + V)).

[0074] Furthermore, equation (m14) is ((S·2) of equation (m13). w + T)(2 w - 1) + (U·2 w + V)) to a multiple of q (here, (T - V)(2 K - 2 w It is derived by adding ((S·2)) to a certain value and the value obtained by adding a multiple of q to that value are congruent modulo q. Therefore, ((S·2)) in equation (m13) w + T)(2 w - 1) + (U·2 w + V)) is, under modulus q, the equation (m14) ((S·2 w + T)(2 w - 1) + (U·2 w (T - V)(2 K - 2 w It is congruent to + 1).

[0075] In equation (m14), 2 w ((S·2)) w + T)(2 w - 1) + (U·2 w (T - V)(2 K - 2 w It is a common factor found in all elements of (m15 + 1). Therefore, equation (m15) is the common factor of equation (m14) ((S·2 w + T)(2 w - 1) + (U·2 w (T - V)(2K - 2 w + 1)) to 2 w It is derived by enclosing it in quotation marks.

[0076] Equation (m16) is obtained by adding 2 to C on the left side of equation (m15). -w Multiply by ((S·2) on the right side of equation (m15) w + V) + (T·2 (K - w) + U) - (V·2 (K - w) + S))·2 w 2 -w It is derived by multiplying by .

[0077] Therefore, in this embodiment, the Montgomery multiplier 1 is ((S·2) on the right side of equation (m16). w + V) + (T·2 (K - w) + U) - (V·2 (K - w) By calculating + S), Montgomery reduction C·2 -w We can find modulo q.

[0078] In hardware, the right-hand side of equation (m16) is ((S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) + S)) can be calculated using only addition and subtraction.

[0079] Also, S.2 w + V can be obtained by simply concatenating the (K - w) bit value S and the w bit value V. Here, concatenation is the operation of combining one bit sequence with another to produce a single bit sequence.

[0080] Similarly, T·2 (K - w) + U can be obtained by simply concatenating the w-bit value T with the (K - w)-bit value U, and V·2 (K - w) + S can also be obtained by simply concatenating the w-bit value V with the (K - w)-bit value S.

[0081] In hardware, the process of concatenating two different bit sequences to generate a single bit sequence can be performed simply by wiring connections, without any arithmetic logic.

[0082] Also, in equation (m16) ((S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) The range to which the value of + S) belongs is given by the following formula.

[0083] -q < ((S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) + S)) < 2q On the other hand, the value obtained by the modulo operation modulo q falls within the range of 0 to (q - 1).

[0084] Therefore, the Montgomery multiplication apparatus 1 according to this embodiment is ((S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) If the result of the calculation of + S)) is a negative value, add q to the calculation result, and if the calculation result is greater than or equal to q, subtract q from the calculation result. This post-processing is performed as follows: C·2 -w It is possible to find modulo q.

[0085] In other words, the Montgomery multiplication apparatus 1 according to this embodiment is (i) Divide C obtained by calculating the product of A and B (A × B) into S, T, U, and V, (ii)(S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) Perform the first process to calculate (+ S), (iii)(1) If the result of the first process is negative, the value obtained by adding q to the result of the first process is A × B × R -1 The result of the calculation modulo q, i.e., C·2 -w(2) If the calculation result of the first process is in the range of 0 to (q - 1), the calculation result of the first process is A × B × R -1 The result of the calculation modulo q, i.e., C·2 -w The process of outputting the result of the calculation modulo q, and (3) if the result of the first process is greater than or equal to q, the value obtained by subtracting q from the result of the first process is A × B × R -1 The result of the calculation modulo q, i.e., C·2 -w The second process (post-processing) is executed, which includes the process of outputting the result of the calculation modulo q.

[0086] Thus, in this embodiment, q = 2 K - 2 w Using q, which is represented by + 1, as the modulo C × R -1 When calculating modulo q, values ​​less than q (in this case, 2) w By using ) as R, ((S·2 w + V) + (T·2 (K - w) The addition to find the result of (addition result - (V·2) (K - w) The subtraction that calculates + S) and the post-processing result in C × R -1 mod q = C × 2 -w It can efficiently calculate modulo q. Furthermore, in this embodiment, C×2 -w There is no need to repeat the calculation modulo q L times.

[0087] Next, an example of the configuration of the Montgomery multiplier 1 of this embodiment will be described. Figure 3 is a block diagram showing an example of the configuration of the Montgomery multiplier 1 of this embodiment. The Montgomery multiplier 1 includes a multiplication unit that calculates the product of A and B (A × B) and a Montgomery reduction calculation unit that calculates the Montgomery reduction. In the following, the configuration of the Montgomery reduction calculation unit included in the Montgomery multiplier 1 will be mainly described.

[0088] The Montgomery multiplication device 1 includes an S, T, U, V division section 11 and (S·2 w + V) + (T·2 (K - w) + U) - (V·2(K - w) + S) Includes a calculation unit 12 and an output processing unit 13.

[0089] The S, T, U, V splitting unit 11 divides C, which is the product of A and B (A × B), into S, T, U, and V. If the Montgomery multiplier is implemented in hardware, the S, T, U, V splitting unit 11 can be realized by only a few wiring connections.

[0090] (S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) + S) The calculation unit 12 calculates the right-hand side of the above equation (m16) (S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) Calculate + S) by addition and subtraction.

[0091] The output processing unit 13 is (S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) + S) Value calculated by calculation unit 12 ((S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) Determine whether + S)) belongs to range 1, range 2, or range 3.

[0092] Range 1: - q < ((S 2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) + S)) < 0 Range 2: 0 ≦ (S 2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) + S) ≤ q - 1 Range 3: q ≦ (S 2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) + S) < 2q (S·2 w+ V) + (T·2 (K - w) + U) - (V·2 (K - w) + S) ((S·2) calculated by the calculation unit 12 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) If the value of (S)) falls within the range 1, that is, (S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) If the calculation result of ((S·2) is negative, the output processing unit 13 will output ((S·2) w + V) + (T·2 (K - w) + U) - (V·2 (K - w) The value obtained by adding q to the calculation result of + S)) is C·2 -w Output the result of the calculation modulo q. ((S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) If the result of the calculation + S)) is negative, then this result is a quotient that is 1 greater than the quotient needed to find the correct remainder, and C·2 -w This shows the remainder when divided by . Therefore, by adding q to this calculation result, we obtain the correct remainder, i.e., C·2 -w We can obtain the correct calculation result modulo q.

[0093] (S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) + S) ((S·2) calculated by the calculation unit 12 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) If the value of ((S·2)) falls within range 2, that is, ((S·2) w + V) + (T·2 (K - w) + U) - (V·2 (K - w) If the calculation result of ((S·2)) falls within the range of 0 to (q - 1), the output processing unit 13 will output ((S·2) w + V) + (T·2 (K - w) + U) - (V·2 (K - w) The result of the calculation + S)) is directly C·2-w Output the result of the calculation modulo q.

[0094] (S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) + S) ((S·2) calculated by the calculation unit 12 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) If the value of ((S·2)) falls within range 3, that is, ((S·2) w + V) + (T·2 (K - w) + U) - (V·2 (K - w) If the calculation result of ((S·2)) is greater than or equal to q, the output processing unit 13 will output ((S·2) w + V) + (T·2 (K - w) + U) - (V·2 (K - w) The value obtained by subtracting q from the calculation result of + S)) is C·2 -w Output the result of the calculation modulo q. ((S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) If the result of the calculation + S)) is greater than or equal to q, then this result is a quotient that is 1 less than the quotient needed to find the correct remainder, and C·2 -w This shows the remainder when divided by q. Therefore, by subtracting q from this calculation result, we obtain the correct remainder, i.e., C·2. -w We can obtain the correct calculation result modulo q.

[0095] The Montgomery multiplier 1 shown in Figure 3 can be implemented using either hardware or software.

[0096] In the case where this Montgomery multiplier 1 is implemented by hardware, i.e., using equation (m16), C·2 -w In cases where modulo q is calculated in hardware, only the addition / subtraction circuit and multiplexer are used to calculate C·2. -wIt is possible to calculate modulo q. The process of dividing C into S, T, U, and V can be achieved, for example, by simply connecting wires that extract S, T, U, and V from the bit sequence of C, respectively.

[0097] On the other hand, in the case where the Montgomery multiplication device 1 according to this embodiment is implemented by software, that is, using equation (m16) C·2 -w In cases where modulo q is calculated by the processor, addition, subtraction, shift operations, logical AND operations, and logical OR operations are used in C·2. -w It is possible to compute modulo q. The process of splitting C into S, T, U, and V, that is, the process of extracting each of S, T, U, and V from the bit sequence of C, can be achieved, for example, by a shift operation, or by a combination of a shift operation and a logical AND operation.

[0098] Next, a first embodiment of the Montgomery multiplication apparatus 1 will be described.

[0099] The Montgomery multiplier 1 according to the first embodiment is implemented by hardware. Figure 4 is a circuit diagram showing an example configuration of the Montgomery multiplier 1 according to the first embodiment.

[0100] The Montgomery multiplier 1 according to the first embodiment includes a first adder (ADD) 21, a first subtractor (SUB) 22, a second adder (ADD) 23, a second subtractor (SUB) 24, and a multiplexer (SEL) 25.

[0101] The Montgomery multiplier 1 according to the first embodiment uses a 2K-bit value C and a modulo q of K bits = 2 K - 2 w It receives + 1 and as input. The Montgomery multiplier 1 according to the first embodiment sets the first (K - w) bits of C, starting from the MSB, as S, the next w bit of C as T, the next (K - w) bit of C as U, and the remaining w bit of C as V. That is, the Montgomery multiplier 1 according to the first embodiment divides the 2K bit value C into S, T, U, and V using wiring connections.

[0102] The first adder (ADD) 21 obtains a K-bit value, i.e., (S·2) by connecting S and V through wiring connections. w The K-bit value obtained by concatenating T and U (T·2) + V) is the value obtained by (T·2) (K - w) Add (+ U) and output the first value #1 which represents the result of this addition.

[0103] Here, S and V are concatenated together such that the bit sequence of V is placed immediately after the bit sequence of S, as shown in Figure 5, thereby forming a single K-bit bit sequence containing S and V, i.e., (S·2 w The value of (T·2) is generated. T and U are concatenated together such that the bit sequence of U is placed immediately after the bit sequence of T, as shown in Figure 6, thereby creating a single K-bit bit sequence containing T and U, i.e., (T·2). (K - w) The value of ((S·2)) is generated. Therefore, the first value #1 is ((S·2 w + V) + (T·2 (K - w) This indicates + U)).

[0104] The first subtraction circuit (SUB) 22 calculates the K-bit value obtained by connecting V and S through wiring connections from the first value #1, i.e., (V·2 (K - w) Subtract + S) and output a second value #2 which represents the result of this subtraction.

[0105] Here, V and S are concatenated together such that the bit sequence of S is placed immediately after the bit sequence of V, as shown in Figure 7, thereby forming a single K-bit bit sequence containing V and S, i.e., (V·2 (K - w) The value of ((S·2)) is generated. Therefore, the second value #2 is ((S·2) w + V) + (T·2 (K - w) + U) - (V·2 (K - w) This indicates + S)).

[0106] The second adder (ADD) 23 adds q to the second value #2 and outputs a third value #3, which represents the result of this addition.

[0107] The second subtraction circuit (SUB) 24 subtracts q from the second value #2 and outputs a fourth value #4 that represents the result of this subtraction.

[0108] The multiplexer (SEL) 25 outputs the third value #3 if the second value #2 is negative, outputs the second value #2 if the second value #2 is non-negative and the fourth value #4 is negative, i.e., the second value #2 is in the range of 0 to (q - 1), and outputs the fourth value #4 if the second value #2 is negative and the fourth value #4 is non-negative, i.e., the second value #2 is greater than or equal to q. In this case, the output value of the multiplexer (SEL) 25 is C·2 -w It is equal to modulo q.

[0109] The multiplexer (SEL) 25 may include two selection circuits 251 and 252.

[0110] The selection circuit 251 selects either the second value #2 or the fourth value #4 based on the fourth value #4. Specifically, if the fourth value #4 is non-negative, the selection circuit 251 selects the fourth value #4, and if the fourth value #4 is negative, it selects the second value #2. The selection circuit 252 selects either the third value #3 or the output value of the selection circuit 251 based on the second value #2. Specifically, if the second value #2 is negative, the selection circuit 252 selects the third value #3, and if the second value #2 is non-negative, it selects the output value of the selection circuit 251.

[0111] However, the configuration and calculation order of the Montgomery multiplier are not limited to those described in this first embodiment. The configuration and calculation order of the Montgomery multiplier may be changed so that the Montgomery multiplier calculates the same value as described in the first embodiment.

[0112] Next, a modified example of the Montgomery multiplier 1 will be described.

[0113] The modified Montgomery multiplier 1 is implemented using hardware. Figure 8 is a circuit diagram showing an example configuration of the modified Montgomery multiplier 1.

[0114] The modified Montgomery multiplier 1 includes a first adder (ADD) 31, a first subtractor (SUB) 32, a bit inverter 33, a first multiplexer 34, a second adder (ADD) 35, and first and second multiplexers (SEL) 36.

[0115] The modified Montgomery multiplication device 1 uses a 2K-bit value C and a modulo q of K bits = 2 K - 2 w It takes + 1 and as input. The modified Montgomery multiplier 1 divides a 2K-bit value C (i.e., a 2K-bit bit sequence C) into S, T, U, and V using wiring connections.

[0116] The first adder (ADD) 31 adds the K-bit value obtained by connecting S and V to the K-bit value obtained by connecting T and U, and outputs a first value #11 representing the result of this addition. The process of connecting S and V is performed in the same manner as the process described in Figure 5. The K-bit value obtained by connecting S and V is (S·2 w This represents (T·2). The process of concatenating T and U is performed in the same manner as the process described in Figure 6. The K-bit value obtained by concatenating T and U is (T·2 (K - w) This indicates + U).

[0117] Therefore, the first value #11 is ((S·2 w + V) + (T·2 (K - w) This indicates + U)).

[0118] The first subtraction circuit (SUB) 32 subtracts the K-bit value obtained by connecting V and S from the first value #11 and outputs the second value #12 which represents the result of this subtraction. The process of connecting V and S is performed in the same manner as the process described in Figure 7. The K-bit value obtained by connecting V and S is (V·2 (K - w) This indicates ((S·2). Therefore, the second value #12 is ((S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) This indicates + S)).

[0119] The bit inversion circuit 33 inverts each bit of q and outputs ~q, which is the value obtained by inverting each bit of q.

[0120] The first multiplexer 34 outputs q as the third value #13 if the second value #12 is negative, and outputs ~q as the third value #13 if the second value #12 is non-negative.

[0121] The second adder (ADD) 35 adds the second value #12, the third value #13, and a value corresponding to the sign of the second value #12 (0 if the second value #12 is negative, and 1 if the second value #12 is non-negative), and outputs the fourth value #14, which represents the result of this addition. Therefore, if the second value #12 is non-negative, the second adder (ADD) 35 adds the second value #12, the third value #13, which is ~q, and 1. Adding the value obtained by adding 1 to ~q to the second value #12 is equivalent to subtracting q from the second value #12. Therefore, if the second value #12 is non-negative, (#12 - q) is output as the fourth value #14, and if the second value #12 is negative, (#12 + q) is output as the fourth value #14. The cases in which the second value #12 is non-negative include both the case where the second value #12 falls within the range of 0 to (q - 1) and the case where the second value #12 is greater than or equal to q. Subtracting q from the second value #12 is only necessary when the second value #12 is greater than or equal to q. Therefore, in the case where the second value #12 falls within the range of 0 to (q - 1), subtracting q from the second value #12 makes the fourth value #14 negative. In other words, the fact that the fourth value #14 is negative indicates that the second value #12 falls within the range of 0 to (q - 1).

[0122] The second multiplexer (SEL) 36 outputs the second value #12 if the fourth value #14 is negative, and outputs the fourth value #14 if the fourth value #14 is non-negative. In this case, the output value of the second multiplexer 36 is C·2 -w It is equal to modulo q.

[0123] In the explanation so far, C×2 -w While the explanation mainly focused on the process of calculating modulo q, when calculating A × B modulo q, which is a multiplication over a finite field, we have 0 ≤ A and B < q, so 0 ≤ C = A × B < q. 2 < q·2 K Therefore, C × 2 -wThe calculation method of this embodiment for calculating mod q is applicable to the calculation of A × B mod q, which is a multiplication over a finite field.

[0124] Next, the procedure for Montgomery multiplication in this embodiment will be described. Figure 9 is a flowchart showing the procedure for Montgomery multiplication in this embodiment. The procedure shown in the flowchart of Figure 9 corresponds to the case where the Montgomery multiplier 1 is implemented by software.

[0125] The Montgomery multiplier 1 performs the multiplication A × B to calculate C, and then performs the following processes: extracting S from C, extracting T1 from C, and extracting V from C (step S11). Here, T1 is a K-bit value containing T and U, i.e., (T·2 (K - w) It is + U).

[0126] In the process of extracting S, the Montgomery multiplier 1 extracts S from C by performing a bit shift (C >> (K + w)). Here, C >> (K + w) represents the result of right-shifting C by (K + w) bits.

[0127] In the process of extracting T1, the Montgomery multiplier 1 performs a bit shift (C >> w) and (C >> w) mod 2 K T1 is extracted from C by performing the calculation and . Here, C >> w indicates the result of right-shifting C by w bits. C >> w extracts a (2K - w) bit value from C that contains S, T, and U. (C >> w) mod 2 K The calculation extracts the lower K bits of the (2K - w) bit value containing S, T, and U, i.e., T1. (C >> w) mod 2 K This is the value of (2K - w) bits, and (2 K - This can be obtained by calculating the logical AND bitwise between the bit sequence representing 1) and the bit sequence representing 1).

[0128] In the process of extracting V, the Montgomery multiplier 1 performs C mod 2w By performing the calculation, we extract V from C. C mod 2 w The calculation extracts the value of the lower w bits of C, i.e., V. C mod 2 w This is the bit sequence of C and (2 w - This can be obtained by calculating the logical AND bitwise with the bit sequence representing 1).

[0129] Next, the Montgomery multiplier 1 performs the processes of calculating T0 and T2 (step S12). Here, T0 is a K-bit value containing S and V, i.e., (S·2 w T2 represents the K-bit value containing V and S, i.e., (V·2 (K - w) This indicates + S).

[0130] In the process of calculating T0, the Montgomery multiplier 1 performs the calculation of (S << w) | V, thereby calculating T0, i.e., (S·2 w Calculate S + V). Here, S << w indicates the result of left-shifting S by w bits. Since S << w, S·2 w The result is obtained. (S << w) | V represents the bitwise OR result between the bit string of (S << w) and the bit string of V. (S << w) | V gives (S·2 w + V) is obtained.

[0131] In the process of calculating T2, the Montgomery multiplier 1 performs the calculation of (V << (K - w)) | S, thereby calculating T2, i.e., (V·2 (K - w) We calculate V + S). Here, V << (K - w) represents the result of left-shifting V by (K - w) bits. V << (K - w) gives V·2 (K - w) The result is obtained. (V << (K - w)) | S represents the bitwise OR result between the bit string of (V << (K - w)) and the bit string of S. (V << (K - w)) | S gives (V·2 (K - w) + S) is obtained.

[0132] Next, the Montgomery multiplier 1 performs the processes of calculating T3 and T4 (step S12). Here, T3 is obtained by T3 = T0 + T1 and T4 is obtained by T4 = T3 - T2.

[0133] Specifically, in the process of calculating T3, the Montgomery multiplier 1 adds T0 and T1. T0 is (S·2 w T1 is (T·2) + V) and T1 is (T·2 (K - w) + U) Therefore, by adding T0 and T1, ((S·2 w + V) + (T·2 (K - w) + U)) is calculated as T3. T3 is the same value as the first value #1 output from the first adder (ADD) 21 shown in Figure 4.

[0134] Furthermore, in the process of calculating T4, the Montgomery multiplier 1 subtracts T2 from T3. T3 is ((S·2 w + V) + (T·2 (K - w) + U)) and T2 is (V·2 (K - w) + S) Therefore, by subtracting T2 from T3, we get ((S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) + S)) is calculated as T4. T4 is the same value as the second value #2 output from the first subtraction circuit (SUB) 22 shown in Figure 4.

[0135] Next, the Montgomery multiplier 1 takes either (T4 + q), T4, or (T4 - q) as the result (Res) of the Montgomery reduction calculation process, i.e., C·2 -w The process of outputting the result of the calculation modulo q is executed (steps S14-S20).

[0136] In other words, the Montgomery multiplier 1 determines whether T4 is a negative value or not (step S14).

[0137] When T4 is a negative value (Yes in step S14), the Montgomery multiplication device 1 calculates a value obtained by adding q to T4 as T5 (step S15), and outputs the calculated T5 as the calculation result of C·2 -w mod q (step S16).

[0138] When T4 is a non - negative value (No in step S14), the Montgomery multiplication device 1 calculates a value obtained by subtracting q from T4 as T6 (step S17). The Montgomery multiplication device 1 determines whether T6 is a negative value (step S18).

[0139] When T6 is a negative value (Yes in step S18), the Montgomery multiplication device 1 outputs T4 as the calculation result of C·2 -w mod q (step S19). On the other hand, when T6 is a non - negative value (No in step S18), the Montgomery multiplication device 1 outputs T6 as the calculation result of C·2 -w mod q (step S20).

[0140] (Proof that - q < ((S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) + S)) < 2q) Next, prove that ((S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) + S)) is greater than q and less than 2q. That (S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) + S) is greater than - q and less than 2q can be proved from the following formula.

[0141] (S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) + S) = S·(2 w - 1) + (T·2 (K - w)+ U) - V·(2 (K - w) - 1) C = q·2 K - In case 1 (S·2 w + T) = q - 1 = 2 K - 2 w That is, S = 2 (K - w) - 1, T = 0 0 ≤ S·(2 w - 1) = (2 (K - w) - 1) (2 w - 1) = 2 K - 2 (K - w) - 2 w + 1 = q - 2 (K - w) 0 ≤ T·2 (K - w) + U = U < 2 (K - w) 0 ≤ V·(2 (K - w) - 1) ≤ (2 w - 1)(2 (K - w) - 1) = 2 K - 2 (K - w) - 2 w + 1 < q twist, -q < ((S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) + S)) < q 0 ≤ C < q·2 K - In case 1 S ≤ 2 (K - w) - 2 0 ≤ S·(2 w - 1) ≤ (2 (K - w) - twenty two w - 1) = 2 K - 2 (K - w) - twenty two w + 2 = q - 2 (K - w) - 2 w + 1 0 ≤ T·2 (K - w) + U < 2 K < q + 2 w - 1 0 ≤ V·(2(K - w) - 1) ≤ (2 w - 1)(2 (K - w) - 1) = 2 K - 2 (K - w) - 2 w + 1 < q twist, -q < ((S·2 w + V) + (T·2 (K - w) + U) - (V·2 (K - w) + S)) < 2q As explained above, in this embodiment, using an integer K and an integer w < K, q = 2 K - 2 w Using modulus q expressed in the form + 1, C × 2 -w When calculating modulo q, the value that satisfies the condition 1 < R < q (in this case, 2) w By using R as C×2 -w mod q, ((S·2 w + V) + (T·2 (K - w) The addition to find the result of (addition result - (V·2) (K - w) The calculation can be performed efficiently by subtracting (+ S)) and then adjusting the output value so that the value representing the subtraction result falls within the range of 0 or greater and less than q. A × B × R -1 By efficiently calculating modulo q, it becomes possible to streamline (speed up) multiplication over finite fields.

[0142] Furthermore, in this embodiment, the controller 100, which includes the Montgomery multiplier 1, uses the Montgomery multiplier 1 to perform the calculation of multiplication over a finite field necessary for the signature verification process of the firmware 501. In other words, the controller 100 performs A × B × R for a prime number q and integers A and B. -1 This process executes the signature verification process for firmware 501, including the calculation of modulo q. This makes it possible to streamline (speed up) the signature verification process for firmware 501 using post-quantum digital signatures.

[0143] While several embodiments of the present invention have been described, these embodiments are presented as examples only and are not intended to limit the scope of the invention. These novel embodiments can be carried out in a variety of other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their variations are included in the scope and spirit of the invention, as well as in the claims of the invention and its equivalents. [Explanation of Symbols]

[0144] 1…Montgomery multiplier, 100…Controller, 200…Non-volatile memory, 300…Memory system, 21…First adder (ADD), 22…First subtractor (SUB), 23…Second adder (ADD), 24…Second subtractor (SUB), 25…Multiplexer (SEL).

Claims

1. For prime numbers q and integers A and B, A × B × R -1 A Montgomery multiplication device that calculates modulo q, q is an integer where K and w are integers and q = 2 K - 2 w Represented by + 1, where A and B are K-bit integers satisfying the conditions 0 ≤ A, B < q, R is a value satisfying the conditions 1 < R < q, and R = 2 w Represented by, The 2K-bit integer C obtained by calculating A × B is divided into S, T, U, and V, where S is the first (K - w) bits of C, T is the w bits following S, U is the (K - w) bits following T, and V is the w bits following U. (S・2 w + V) + (T・2 (K - w) + U) - (V・2 (K - w) The first process is executed to calculate (+ S), When the calculation result of the first process is negative, the value obtained by adding q to the calculation result of the first process is output as the calculation result of A×B×R -1 mod q, and when the calculation result of the first process belongs to the range from 0 to (q - 1), the calculation result of the first process is output as the calculation result of A×B×R -1 mod q, and when the calculation result of the first process is q or more, the value obtained by subtracting q from the calculation result of the first process is output as the calculation result of A×B×R -1 mod q, and a Montgomery multiplication device configured to execute a second process including the above processes.

2. (S・2 w + V) and (T・2 (K - w) A first adder circuit that adds + U) and outputs a first value, From the first value above (V・2 (K - w) A first subtraction circuit that subtracts + S) to output a second value #2, A second adder circuit that adds q to the second value and outputs a third value, A second subtraction circuit that subtracts q from the second value to output a fourth value, A multiplexer that outputs the third value if the second value is negative, outputs the second value if the second value is non-negative and the fourth value is negative, and outputs the fourth value if the second value is negative and the fourth value is non-negative, The first process is performed by the first adder circuit and the first subtractor circuit, The Montgomery multiplier according to claim 1, wherein the second process is performed by the second adder, the second subtractor, and the multiplexer.

3. (S・2 w The Montgomery multiplier according to claim 2, wherein (+ V) is obtained by concatenating S and V such that the bit sequence of V is placed immediately after the bit sequence of S.

4. The Montgomery multiplier according to claim 3, wherein the connection between S and V is performed by wiring connections.

5. (T・2 (K - w) The Montgomery multiplier according to claim 2, wherein (+ U) is obtained by concatenating T and U such that the bit sequence of U is placed immediately after the bit sequence of T.

6. The Montgomery multiplier according to claim 5, wherein the connection between T and U is performed by wiring.

7. (V・2 (K - w) The Montgomery multiplier according to claim 2, wherein (+ S) is obtained by concatenating V and S such that the bit sequence of S is placed immediately after the bit sequence of V.

8. The Montgomery multiplier according to claim 7, wherein the connection between V and S is performed by wiring connections.

9. Non-volatile memory containing firmware, A controller configured to control the aforementioned non-volatile memory, wherein for a prime number q and integers A and B, A × B × R -1 A controller configured to perform signature verification processing of the firmware, including the calculation of modulo q, q is an integer where K and w are integers and q = 2 K - 2 w Represented by + 1, where A and B are K-bit integers satisfying the conditions 0 ≤ A, B < q, R is a value satisfying the conditions 1 < R < q, and R = 2 w Represented by, The aforementioned controller, The 2K-bit integer C obtained by calculating A × B is divided into S, T, U, and V, where S is the first (K - w) bits of C, T is the w bits following S, U is the (K - w) bits following T, and V is the w bits following U. (S・2 w + V) + (T・2 (K - w) + U) - (V・2 (K - w) The first process is executed to calculate (+ S), If the calculation result of the first process is negative, the value obtained by adding q to the calculation result of the first process is A × B × R. -1 A process to output the result of the calculation modulo q, and if the calculation result of the first process falls within the range of 0 to (q - 1), the calculation result of the first process is A × B × R -1 The process outputs the result of the calculation modulo q, and if the calculation result of the first process is greater than or equal to q, the value obtained by subtracting q from the calculation result of the first process is A × B × R. -1 A memory system configured to perform a second process, which includes a process that outputs the result of a calculation modulo q.

10. The aforementioned controller, (S・2 w + V) and (T・2 (K - w) A first adder circuit that adds + U) and outputs a first value, From the first value above (V・2 (K - w) A first subtraction circuit that subtracts + S) to output a second value #2, A second adder circuit that adds q to the second value and outputs a third value, A second subtraction circuit that subtracts q from the second value to output a fourth value, A multiplexer that outputs the third value if the second value is negative, outputs the second value if the second value is non-negative and the fourth value is negative, and outputs the fourth value if the second value is negative and the fourth value is non-negative, The first process is performed by the first adder circuit and the first subtractor circuit, The memory system according to claim 9, wherein the second process is performed by the second adder, the second subtractor, and the multiplexer.

Images