Remainder arithmetic unit and memory system

Abstract

To provide a remainder arithmetic unit and memory system that are small in circuit size and capable of performing calculations at high speed. [Solution] In the modulo arithmetic unit, the first shift circuit obtains the first intermediate value by shifting the dividend a to the right by a shift amount w associated with the bit length of the divisor q. The first multiplier circuit obtains the second intermediate value by multiplying the first intermediate value by the value m. The second shift circuit obtains the third intermediate value by shifting the second intermediate value to the right by a shift amount (2k-w). The second multiplier circuit obtains the fourth intermediate value by multiplying the third intermediate value by q. The subtraction circuit obtains the fifth intermediate value by subtracting the fourth intermediate value from the dividend a. The processing circuit obtains the remainder by subtracting a value of n times the divisor q (where n is a non-negative integer) from the fifth intermediate value. The shift amount w is less than or equal to the bit length of the divisor q. The parameter value k is greater than or equal to the bit length of the divisor q.

Description

[Technical Field]

[0001] This embodiment relates to a modulo arithmetic unit and a memory system. [Background technology]

[0002] In cryptographic schemes such as digital signatures, modulo operations are used. When these cryptographic schemes are implemented in memory systems, the circuit responsible for modulo operations is desirable to be small in size and fast in its operation speed. [Prior art documents] [Patent Documents]

[0003] [Patent Document 1] U.S. Patent Application Publication No. 2020 / 0004506 [Overview of the Initiative] [Problems that the invention aims to solve]

[0004] One embodiment aims to provide a remainder arithmetic unit and memory system that are small in circuit size and capable of performing calculations at high speed. [Means for solving the problem]

[0005] According to one embodiment, the modulo arithmetic unit calculates the modulo by bitwise operations using a dividend a and a divisor q. The modulo arithmetic unit comprises a first shift circuit, a first multiplier circuit, a second shift circuit, a second multiplier circuit, a subtraction circuit, and a processing circuit. The first shift circuit obtains a first intermediate value by shifting the dividend a to the right by a shift amount w associated with the bit length of the divisor q. The first multiplier circuit obtains a second intermediate value by multiplying the first intermediate value by a value m. The second shift circuit obtains a third intermediate value by shifting the second intermediate value to the right by a shift amount (2k-w). The second multiplier circuit obtains a fourth intermediate value by multiplying the third intermediate value by q. The subtraction circuit obtains a fifth intermediate value by subtracting the fourth intermediate value from the dividend a. The processing circuit obtains the modulo by subtracting a value of n times the divisor q (where n is a non-negative integer) from the fifth intermediate value. The shift amount w is less than or equal to the bit length of the divisor q. The parameter value k takes a value greater than or equal to the bit length of the divisor q. [Brief explanation of the drawing]

[0006] [Figure 1] A diagram showing an example of the configuration of a memory system including a remainder arithmetic unit according to the first embodiment. [Figure 2] A diagram illustrating an example of a modulo operation according to the first embodiment. [Figure 3] A diagram showing an example of the correspondence between the bit length of the value q and various values ​​including the shift amount w according to the first embodiment. [Figure 4] A diagram illustrating the range of possible values ​​for the shift amount w and parameter value k according to the first embodiment. [Figure 5] A figure showing another example of the correspondence between the bit length of the value q and various values ​​including the shift amount w according to the first embodiment. [Figure 6] A diagram showing an example of the configuration of a remainder arithmetic unit according to the first embodiment. [Figure 7] A diagram showing an example of the configuration of the first shift circuit block according to the first embodiment. [Figure 8] A diagram showing an example of the configuration of the second shift circuit block according to the first embodiment. [Figure 9] A flowchart illustrating an example of the operation of the modulo arithmetic unit according to the first embodiment. [Figure 10] A diagram illustrating the possible ranges of the shift amount w and parameter value k according to the second embodiment. [Figure 11] A diagram showing an example of the correspondence between the bit length of the value q and various values ​​including the shift amount w according to the second embodiment. [Figure 12] A diagram showing an example of the correspondence between the bit length of the value q and various values ​​including the shift amount w according to the third embodiment. [Figure 13] A diagram showing an example of the configuration of a remainder arithmetic unit according to the third embodiment. [Figure 14] A diagram showing an example of the configuration of the first shift circuit block according to the third embodiment. [Figure 15] A diagram showing an example of the configuration of the second shift circuit block according to the third embodiment. [Figure 16] A diagram showing an example of the configuration of a modulo arithmetic unit according to the fourth embodiment. [Modes for carrying out the invention]

[0007] For example, memory systems such as SSDs (Solid State Drives) sometimes implement encryption methods for tasks such as signature processing. However, it is said that some existing encryption methods will become vulnerable once quantum computers become practical.

[0008] In response, the National Institute of Standards and Technology (NIST) has begun preparations for new cryptographic methods. These new methods include ML-DSA (Module-Lattice-Based Digital Signature Algorithm) and ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism). These new cryptographic methods are referred to as post-quantum cryptography. Post-quantum cryptography utilizes modulo operations.

[0009] The typical modular operations used in quantum - resistant computer cryptography are described below. When values x, y, and q that satisfy the following equations (1) and (2) are given, the remainder b is obtained by the operation shown in the following equation (3). Here, the value q is the divisor. "*" is an operator representing multiplication. "%" is an operator representing modular operation. 0≦x<q ···(1) 0≦y<q ···(2) b=(x*y)%q ···(3)

[0010] The value of q varies depending on the cryptographic method. For example, in ML - DSA, the value of q is 8380417. In ML - KEM, the value of q is 7681.

[0011] As an algorithm for performing the modular operation described using (1), (2), and (3), there is Barrett reduction. The outline of Barrett reduction is described below. For the sake of simplicity of explanation, in addition to the values x, y, and q, a value a is introduced as shown in the following equation (4). The value a is the dividend in the modular operation. a=x*y ···(4)

[0012] Note that as shown in equations (1) and (2), both values x and y are smaller than q. Therefore, the value a is smaller than the value q 2 by a smaller amount.

[0013] In Barrett reduction, parameter values k and value m that satisfy the following equation (5) are used. m / 2 2k ≒1 / q ···(5)

[0014] From equation (5), equation (6) can be derived.

Number

[0015] As shown in equation (7), a shift operation is performed on the value a, shifting it to the right by k bits. In equation (7), ">>" is the operator that represents the shift operation. a'=a>>k ···(7)

[0016] Next, the value a' is updated using the following equation (8). a'=a-((a'*m)>>k)*q ···(8)

[0017] The value obtained by calculating ((a'*m)>>k) on the right-hand side of equation (8) represents an approximate value of the quotient when the value a is divided by the value q. Therefore, the value a' after being updated by equation (8) is either the remainder when the value a is divided by the value q (i.e., the value b in equation (3)) or the value of b plus a multiple of the value q. Thus, it is determined whether the value a' is greater than or equal to the value q.

[0018] If the value a' is greater than the value q, the process in equation (9) below is executed. a'=a'-q ···(9)

[0019] Equation (9) is repeated until the value a' becomes less than the value q. If the value a' is less than the value q, then the value a' is the remainder b, as shown in equation (10) below. b=a' ···(10)

[0020] A comparison of the embodiment with other technologies will be described. Technologies compared with the embodiment will be referred to as comparative examples. According to the comparative examples, the Barrett reduction process described above is performed by a hardware circuit.

[0021] Specifically, the hardware circuit in the comparative example executes each process in the following order. (S201) Obtain values ​​a, q, and m. (S202) The parameter value k is obtained using the following formula (11).

number

[0022] In this specification, the process in step S207 is referred to as the correction process.

[0023] Generally, division requires a high computational cost. In the comparative example, the calculation of equation (6), which includes division, is performed outside the hardware circuit. Therefore, it is possible to implement modulo operations with a low computational cost.

[0024] However, according to the comparative example, the shift operation is performed in steps S203 and S205. And, as is clear from equation (11), the parameter value k used as the shift amount is a variable amount that depends on the bit length of the value q. For example, if the bit length of the value q can be from 1 to 32, the parameter value k can take 32 different values. In other words, according to the comparative example, the number of variations of the shift amount in the shift operation is 32.

[0025] Regarding circuits that handle shift operations, the more variations in shift amounts they can handle, the larger the circuit becomes, and the longer the time required for the shift operation. The series of processes performed by the hardware circuit in the comparative example involves shift operations with a relatively large number of shift amount variations. Therefore, the hardware circuit in the comparative example is large in scale and requires a lot of time for the modulo operation.

[0026] According to this embodiment, the number of variations in the shift amount in the shift operation is reduced compared to the comparative example. This provides a hardware circuit that is smaller in scale and can perform modulo operations at high speed compared to the comparative example. Here, the hardware circuit may be implemented by at least one of the following: a register, memory, adder, multiplier, selector, and other arithmetic units. The register is implemented by a sequential circuit such as a flip-flop. The adder, multiplier, selector, and other arithmetic units are implemented by combinational logic circuits, for example.

[0027] The modulo arithmetic unit and the memory system including the modulo arithmetic unit, which are hardware circuits according to the embodiments, will be described in detail below with reference to the attached drawings. In the following, a modulo arithmetic unit implemented in a memory system will be described as an example of a modulo arithmetic unit according to the embodiments. Note that the modulo arithmetic unit according to the embodiments can be implemented in any system other than a memory system. Furthermore, the present invention is not limited by these embodiments.

[0028] (First embodiment) Figure 1 shows an example of the configuration of a memory system including a remainder arithmetic unit 1 according to the first embodiment.

[0029] The memory system 300 is connectable to the host 400. The host 400 may be, for example, a server, a personal computer, or a mobile information processing device. The memory system 300 functions as an external storage device for the host 400.

[0030] The memory system 300 includes a controller 100 and a semiconductor memory 200. The controller 100 includes a main control circuit 101, a signature processing circuit 102, and a buffer memory 103. The signature processing circuit 102 includes a modulo arithmetic unit 1, which is a hardware circuit that performs modulo operations. The semiconductor memory 200 is a non-volatile semiconductor memory (e.g., NAND flash memory) and has a storage area 201 and a management information storage area 202. User data may be stored in the storage area 201. Firmware (FW) 501 and signatures 502 are stored in the management information storage area 202. Signatures 502 are digital signatures. The signature processing circuit 102 generates signatures 502 according to a predetermined cryptographic scheme.

[0031] The above encryption methods are ML-DSA or ML-KEM. However, the encryption methods applicable to the memory system 300 are not limited to these.

[0032] In the memory system 300, when the controller 100 starts the firmware 501, it temporarily stores the firmware 501 and signature 502 in the buffer memory 103, and performs signature verification processing of the firmware 501 in the signature processing circuit 102. In the signature verification process, the hash value of the firmware 501 is obtained, and a value based on the public key is extracted from the signature 502. Using the hash value of the firmware 501 and the extracted value, it is determined whether predetermined conditions are met.

[0033] The signature processing circuit 102 outputs an approval result if the predetermined conditions are met, indicating that there has been no unauthorized tampering. In response, the controller 100 starts the firmware 501 and loads the firmware 501 function module into, for example, the buffer memory 103. Then, the controller 100 starts data transfer between the host 400 and the storage area 201 in response to a command from the host 400. If the predetermined conditions are not met, the signature processing circuit 102 outputs a rejection result, indicating that there is a possibility of unauthorized tampering. In response, the controller 100 does not start the firmware 501. As a result, the memory system 300 can detect and prevent unauthorized tampering of the firmware 501 at startup.

[0034] The signature processing circuit 102 performs a modulo operation using the modulo arithmetic unit 1 in the process of generating the signature 502 and verifying the signature.

[0035] Figure 2 is a diagram illustrating an example of a modulo operation according to the first embodiment.

[0036] The signature processing circuit 102 generates values ​​x, y, m, and q. The values ​​x, y, and q satisfy equations (1) and (2).

[0037] In the example shown in Figure 2, the bit width of the data path through which each of the values ​​x, y, and q is transmitted is assumed to be 32 bits. From the relationship between equations (1) and (2), each of the values ​​x and y is the lower bit of the 32 bits of the bit width of the data path through which they are transmitted. n We can assume that significant data exists within the range of bits. However, S n This is expressed by the following equation (12).

number

[0038] The signature processing circuit 102 multiplies the value x by the value y (S1). The value a obtained by this multiplication is transmitted through a data path with a 64-bit width. The value a obtained by multiplying the value x by the value y has significant values within the lower 2*S bits of the 64 bits, which is the bit width of the data path for transmitting it. n There are significant values within the range of the lower 2*S bits.

[0039] According to the comparative example, due to the first right shift operation, the lower S bits within the range of these 2*S bits where there are significant values are discarded. That is, the upper S bits within the range of these 2*S bits where there are significant values are the necessary bits, and the lower S bits can be considered unnecessary bits. n Among the lower S bits within the range of these 2*S bits. n Among the lower S bits within the range of these 2*S bits where there are significant values are discarded. That is, n Among the upper S bits within the range of these 2*S bits. n The upper S bits are the necessary bits, and the lower S bits n can be considered unnecessary bits.

[0040] In the embodiment, the remainder arithmetic unit 1 executes the first shift operation while leaving a part of these unnecessary bits (B in FIG. 2 red ). Let the shift amount in the first shift operation be denoted as w. That is, in step S2, the remainder arithmetic unit 1 executes a shift operation to shift the value a to the right by the shift amount w.

[0041] The value of the shift amount w is determined according to the bit length of the value q.

[0042] FIG. 3 is a diagram showing an example of the correspondence between the bit length of the value q according to the first embodiment and various values including the shift amount w.

[0043] In the example shown in FIG. 3, when the bit length of the value q is any one of 1 to 15, the shift amount w is set to 0. When the bit length of the value q is any one of 16 to 23, the shift amount w is set to 16. When the bit length of the value q is any one of 24 to 27, the shift amount w is set to 24. When the bit length of the value q is 28 or 29, the shift amount w is set to 28. When the bit length of the value q is 30 or 31, the shift amount w is set to 30. When the bit length of the value q is 32, the shift amount w is set to 32.

[0044] Furthermore, Figure 3 shows the parameter value k (more precisely, the value of 2k) and the value of (2k-w) according to the embodiment. If the bit length of value q is any of 1 to 15, the value of 2k is 32. If the bit length of value q is any of 16 to 23, the value of 2k is 48. If the bit length of value q is any of 24 to 27, the value of 2k is 56. If the bit length of value q is 28 or 29, the value of 2k is 60. If the bit length of value q is 30 or 31, the value of 2k is 62. If the bit length of value q is 32, the value of 2k is 64. In this way, by setting the combination of possible values ​​for the shift amount w and possible values ​​for the parameter value k, the value of (2k-w) is 32 regardless of the bit length of value q.

[0045] While the number of variations in the bit length of value q is 32, the number of variations in the shift amount w is significantly less than the number of variations in the bit length of value q. Therefore, the circuit size of the circuit responsible for the first shift operation (the first shift circuit block 11 described later) can be reduced, and the time required for the first shift operation can also be reduced.

[0046] The value of (2k-w) indicates the shift amount in the second shift operation. The correspondence between the possible bit lengths of value q, the possible shift amounts w, and the possible parameter values ​​k is set as shown in Figure 3, which limits the number of variations of the shift amount (2k-w) in the second shift operation to one. Therefore, the circuit size of the circuit responsible for the second shift operation (second shift circuit block 13, described later) can be reduced, and the time required for the second shift operation can also be reduced.

[0047] Let's return to the explanation in Figure 2. After the processing in step S2, the modulo arithmetic unit 1 multiplies the value obtained by the first shift operation by the value m (step S3).

[0048] The value m is pre-calculated by an external entity (in this case, the signature processing circuit 102) of the modulo arithmetic unit 1 based on equation (6).

[0049] The right-hand side of equation (6) includes the parameter value k. The signature processing circuit 102 obtains the parameter value k based, for example, on the bit length of the value q and the correspondence shown in Figure 3. Then, the signature processing circuit 102 calculates the value m by substituting the obtained parameter value k and the value q into equation (6), and inputs the calculated value m to the modulo arithmetic unit 1. Note that the value m may be calculated by a circuit other than the signature processing circuit 102.

[0050] By shifting the value obtained in step S3 to the right by (2k-w) bits, a value approximately equivalent to the value obtained in step S204 by the hardware circuit in the comparative example can be obtained. Here, the shift amount w and the value of 2k are determined such that (2k-w) equals 32. Therefore, the modulo arithmetic unit 1 performs a shift operation that shifts the value obtained in step S3 to the right by 32 bits (S4).

[0051] After the processing in step S4, the modulo arithmetic unit 1 performs the same processing as the hardware circuit in the comparative example from step S206 onwards.

[0052] Thus, according to the first embodiment, compared to the comparative example, the number of shift amount variations in the first shift operation is reduced from 32 to 6, and the number of shift amount variations in the second shift operation is reduced from 32 to 1. This significantly reduces the size of the circuit that performs each shift operation and significantly shortens the time required for each shift operation. Consequently, the time required for the modulo operation is also significantly shortened.

[0053] Please note that the correspondence shown in Figure 3 is merely one example.

[0054] For example, the shift amount w and parameter value k are selected such that the precision of the modulo operation is higher than a predetermined level. Therefore, constraints are imposed on the shift amount w and parameter value k as shown in equations (13) and (14) below.

number

[0055] Equation (13) means that the shift amount w is less than or equal to the bit length of the value q. Equation (14) means that the parameter value k is greater than or equal to the bit length of the value q. If the constraint of equation (13) is not met, an underflow occurs, reducing the precision of the modulo operation. If equation (14) is not met, required bits are lost, reducing the precision of the modulo operation.

[0056] Figure 4 is a diagram illustrating the range of possible values ​​for the shift amount w and parameter value k in the first embodiment. Each cell in Figure 4 shows the bit length of value q, the shift amount w, and the corresponding value of 2k. The value of 2k is determined such that the value of (2k-w) is a fixed value, in this case 32, regardless of the possible bit length of value q.

[0057] In the following discussion, the combination of a shift amount w and a parameter value k, where (2k-w) is a fixed value, may simply be referred to as a "combination."

[0058] In Figure 4, the combinations included in region RA do not satisfy the constraint of equation (14). Also, the combinations included in region RB do not satisfy the constraint of equation (13). Therefore, the figures for the values ​​of 2k are omitted for the combinations included in regions RA and RB. From the region not included in either region RA or RB, i.e., region RC, a combination corresponding to the possible bit lengths of value q is selected.

[0059] Furthermore, in order to reduce the number of variations in the shift amount w, the same combination is associated with multiple possible bit lengths of the value q. By associating the same combination with as many possible bit lengths of the value q as possible, the number of variations in the shift amount w can be reduced as much as possible. In the example shown in Figure 4, when the first set 30 and the second set 31, which are sets of combinations, are applied, the number of variations in the shift amount w can be reduced to the minimum value of 6.

[0060] The correspondence shown in Figure 3 represents the correspondence when the first set 30 is applied. When the second set 31 is applied, the correspondence shown in Figure 5 is established.

[0061] Figure 5 shows another example of the correspondence between the bit length of value q and various values ​​including the shift amount w according to the first embodiment.

[0062] As shown in the example in Figure 5, if the bit length of value q is 1, the shift amount w is 0 and the value of 2k is 32. If the bit length of value q is any of 2 to 17, the shift amount w is 2 and the value of 2k is 34. If the bit length of value q is any of 18 to 25, the shift amount w is 18 and the value of 2k is 50. If the bit length of value q is any of 26 to 29, the shift amount w is 26 and the value of 2k is 58. If the bit length of value q is 30 or 31, the shift amount w is 30 and the value of 2k is 62. If the bit length of value q is 32, the shift amount w is 32 and the value of 2k is 64. The value of (2k-w) is constant at 32 regardless of the bit length of value q, as in the example shown in Figure 3.

[0063] Thus, even when the second set 31 is applied, it is possible to limit the number of shift amount variations in the first shift operation to six, and the number of shift amount variations in the second shift operation to one.

[0064] Figure 6 shows an example of the configuration of the remainder calculation device 1 according to the first embodiment. It is assumed that the correspondence shown in Figure 3 is set up in this example.

[0065] The modulo arithmetic unit 1 receives values ​​a, q, and m as input. Value a is input to the modulo arithmetic unit 1 via a 64-bit data path, which is the maximum possible width for a value of 2k. Value q is input to the modulo arithmetic unit 1 via a 32-bit data path, which is the maximum possible width for the parameter value k.

[0066] The modulo arithmetic unit 1 includes a first shift circuit block 11, a first multiplication circuit 12, a second shift circuit block 13, a second multiplication circuit 14, a subtraction circuit 15, and a correction processing circuit 16.

[0067] The first shift circuit block 11 receives values ​​a and q as inputs. The first shift circuit block 11 performs a shift operation to shift value a to the right by a shift amount w. The value of the shift amount w is associated with the bit length of value q according to the correspondence shown in Figure 3. The value obtained by the shift operation in the first shift circuit block 11 is denoted as the intermediate value Iv1.

[0068] The intermediate value Iv1 is input to the first multiplier circuit 12 via a 32-bit wide data bus. The value m obtained by the calculation in equation (6) is also input to the first multiplier circuit 12. The first multiplier circuit 12 multiplies the intermediate value Iv1 by the value m. The value obtained by the multiplication in the first multiplier circuit 12 is denoted as the intermediate value Iv2.

[0069] The intermediate value Iv2 is input to the second shift circuit block 13. The second shift circuit block 13 performs a shift operation that shifts the intermediate value Iv2 to the right by (2k-w) bits. Here, the value of (2k-w) is constant at 32 regardless of the bit length of the value q. Therefore, the second shift circuit block 13 shifts the intermediate value Iv2 to the right by 32 bits. The value obtained by the shift operation in the second shift circuit block 13 is denoted as the intermediate value Iv3.

[0070] The intermediate value Iv3 is input to the second multiplier circuit 14. The value q is also input to the second multiplier circuit 14. The second multiplier circuit 14 multiplies the intermediate value Iv3 by the value q. The value obtained by the multiplication in the second multiplier circuit 14 is denoted as the intermediate value Iv4.

[0071] The intermediate value Iv4 is input to the subtraction circuit 15 via a 64-bit wide data bus. The value a is also input to the subtraction circuit 15. The subtraction circuit 15 subtracts the intermediate value Iv4 from value a. The value obtained by subtraction by the subtraction circuit 15 is denoted as the intermediate value Iv5.

[0072] The intermediate value Iv5 is input to the correction processing circuit 16 via a 64-bit wide data path. The correction processing circuit 16 is also input to the value q. The correction processing circuit 16 treats the intermediate value Iv5 as value a' and performs the correction process. In other words, the correction processing circuit 16 performs the calculation of equation (9) on value a' until value a' becomes smaller than value q.

[0073] The correction process can be thought of as subtracting a value n times the value of q from the value a', where n is a non-negative natural number. The correction circuit 16 is an example of a processing circuit.

[0074] The correction processing circuit 16 outputs the value a' after correction processing as the remainder b.

[0075] Figure 7 shows an example of the configuration of the first shift circuit block 11 according to the first embodiment.

[0076] The first shift circuit block 11 comprises a number of shift circuits 111 corresponding to the number of variations in the shift amount w. Specifically, the first shift circuit block 11 comprises a total of six shift circuits 111: shift circuit 111-1, shift circuit 111-2, shift circuit 111-3, shift circuit 111-4, shift circuit 111-5, and shift circuit 111-6. Therefore, it can be considered that the first shift circuit block 11 comprises a number of shift circuits 111 less than the number of variations in the bit length of the value q.

[0077] The value 'a' is input to six shift circuits 111 in common. Each of the six shift circuits 111 performs a shift operation on value 'a' with a different shift amount. The shift amount in the shift operation performed by each of the six shift circuits 111 is one of the six variations of the shift amount 'w'.

[0078] Specifically, shift circuit 111-1 shifts value a to the right by 0 bits. In other words, shift circuit 111-1 outputs value a as is. Shift circuit 111-2 shifts value a to the right by 16 bits. Shift circuit 111-3 shifts value a to the right by 24 bits. Shift circuit 111-4 shifts value a to the right by 28 bits. Shift circuit 111-5 shifts value a to the right by 30 bits. Shift circuit 111-6 shifts value a to the right by 32 bits.

[0079] The first shift circuit block 11 further includes a bit length determination circuit 112 and a selection circuit 113. The six shift circuits 111 are connected to the selection circuit 113.

[0080] The value q is input to the bit length determination circuit 112. The bit length determination circuit 112 determines the bit length of the value q. The bit length of the value q is input to the selection circuit 113 as a selection signal.

[0081] Based on the selection signal and the correspondence shown in Figure 3, the selection circuit 113 selects one of the output values ​​from the six shift circuits 111 and outputs it as the intermediate value Iv1.

[0082] Specifically, if the bit length of value q is any of 1 to 15, the selection circuit 113 outputs the output value of shift circuit 111-1 as the intermediate value Iv1. If the bit length of value q is any of 16 to 23, the selection circuit 113 outputs the output value of shift circuit 111-2 as the intermediate value Iv1. If the bit length of value q is any of 24 to 27, the selection circuit 113 outputs the output value of shift circuit 111-3 as the intermediate value Iv1. If the bit length of value q is 28 or 29, the selection circuit 113 outputs the output value of shift circuit 111-4 as the intermediate value Iv1. If the bit length of value q is 30 or 31, the selection circuit 113 outputs the output value of shift circuit 111-5 as the intermediate value Iv1. If the bit length of value q is 32, the selection circuit 113 outputs the output value of the shift circuit 111-6 as the intermediate value Iv1.

[0083] With the first shift circuit block 11 configured as described above, a shift operation is realized in which the shift amount w corresponds to the bit length of the value q according to the correspondence shown in Figure 3.

[0084] Figure 8 shows an example of the configuration of the second shift circuit block 13 according to the first embodiment.

[0085] The second shift circuit block 13 consists of a shift circuit 131 that shifts the intermediate value Iv2 to the right by 32 bits. The number of variations in the shift amount in the shift operation in the second shift circuit block 13 is one. Therefore, unlike the first shift circuit block 11, which has multiple variations in the shift amount used in the shift operation, the second shift circuit block 13 does not have a selection circuit.

[0086] Figure 9 is a flowchart showing an example of the operation of the modulo arithmetic unit 1 according to the first embodiment.

[0087] First, the modulo arithmetic unit 1 obtains the values ​​a, q, and m (S101).

[0088] In the first shift circuit block 11, six shift circuits 111, each with a different shift amount, shift the value a to the right (S102). Then, the selection circuit 113 selects one of the output values ​​from the six shift circuits 111 based on the bit length of the value q (S103). This obtains the intermediate value Iv1.

[0089] The first multiplication circuit 12 multiplies the intermediate value Iv1 by the value m (S104). This obtains the intermediate value Iv2.

[0090] In the second shift circuit block 13, the shift circuit 131 shifts the intermediate value Iv2 to the right by 32 bits (S105). This obtains the intermediate value Iv3.

[0091] The second multiplication circuit 14 multiplies the intermediate value Iv3 by the value q (S106). This yields the intermediate value Iv4.

[0092] The subtraction circuit 15 subtracts the intermediate value Iv4 from the value a (S107). This obtains the intermediate value Lv5, which is the value a'.

[0093] The correction processing circuit 16 determines whether the value a' is greater than or equal to the value q (S108).

[0094] If value a' is greater than or equal to value q (S108: Yes), the correction processing circuit 16 subtracts value q from value a' and updates value a' based on the subtraction result (S109).

[0095] If value a' is not greater than or equal to value q (S108: No), the modulo arithmetic unit 1 outputs value a' as the result of the modulo arithmetic operation, value b (S110). Then the series of processes ends.

[0096] Thus, according to the first embodiment, the first shift circuit block 11 is configured to perform a shift operation that shifts the value q to the right by a shift amount w associated with the bit length of the value q. The second shift circuit block 13 is configured to perform a shift operation that shifts the intermediate value Iv2 to the right by a shift amount (2k-w). The correspondence between the possible values ​​of the bit length of the value q, the possible values ​​of the shift amount w, and the possible values ​​of the parameter value k is determined so that the constraints that the shift amount w is less than or equal to the bit length of the value q, and the parameter value k is greater than or equal to the bit length of the value q are satisfied.

[0097] Therefore, it becomes possible to reduce the number of variations in the shift amount in the shift calculation compared to the comparative example. By reducing the number of variations in the shift amount in the shift calculation compared to the comparative example, it is possible to realize a remainder arithmetic unit 1 that is smaller in circuit size and can perform calculations at high speed.

[0098] Furthermore, according to the first embodiment, the same combination of the shift amount w value and the parameter value k value is associated with multiple possible values ​​for the bit length of value q. In other words, the correspondence between the possible values ​​for the bit length of value q and the combinations of the possible values ​​for the shift amount w and the parameter value k is set up so that the combination of the shift amount w value and the parameter value k value is the same when the bit length of value q is a first value and when it is a second value different from the first value.

[0099] Therefore, the number of variations in the shift amount w in the first shift operation can be made smaller than the number of variations in the bit length of the value q. Thus, it is possible to realize a modulo arithmetic unit 1 that is small in circuit size and can perform calculations at high speed.

[0100] Furthermore, according to the first embodiment, a correspondence is established between the possible bit lengths of the value q, the possible values ​​of the shift amount w, and the possible values ​​of the parameter value k, such that the value of (2k-w) remains constant regardless of the bit length of the value q.

[0101] Therefore, the number of variations in the shift amount in the second shift calculation is limited to one. Thus, it is possible to realize a remainder calculation device 1 that is small in circuit size and can perform calculations at high speed.

[0102] Furthermore, according to the first embodiment, as explained with reference to Figure 7, the first shift circuit block 11 comprises a plurality of shift circuits 111, fewer than the number of variations in the bit length of the value q, and a selection circuit 113. The plurality of shift circuits 111 are all input to the same value a. The selection circuit 113 selects one output value from among the output values ​​of the plurality of shift circuits 111 based on the bit length of the value q.

[0103] Therefore, the number of variations in the shift amount w in the first shift operation can be made smaller than the number of variations in the bit length of the value q. Thus, it is possible to realize a modulo arithmetic unit 1 that is small in circuit size and can perform calculations at high speed.

[0104] (Second embodiment) In the first embodiment, the configuration of the modulo arithmetic unit 1 when the maximum value of the parameter value k is 32 was described. The maximum value of the parameter value k does not have to be 32. In the second embodiment, as an example of a case where the maximum value of the parameter value k is not 32, the configuration of the modulo arithmetic unit 1 when the maximum value of the parameter value k is 64 will be described. Note that in the second embodiment, matters that differ from the first embodiment will be described. Matters that are the same as in the first embodiment will be omitted or described in a simplified manner.

[0105] Figure 10 is a diagram illustrating the range of possible shift amounts w and parameter values ​​k according to the second embodiment. Each cell in Figure 10 shows the bit length of value q, the shift amount w, and the corresponding value of 2k. The value of 2k is determined such that the value of (2k-w) is a fixed value, in this case 64, regardless of the possible bit length of value q. The illustration of 2k values ​​is omitted for combinations included in regions RA and RB.

[0106] Even when the maximum value of the parameter k is 64, the combination of shift amount w and parameter value k is selected such that the constraints shown in equations (13) and (14) are satisfied. Thus, a combination corresponding to the possible values ​​of the bit length of value q is selected from region RC.

[0107] Furthermore, in order to reduce the number of variations in the shift amount w, the same combination is associated with multiple possible bit lengths of the value q. By associating the same combination with as many possible bit lengths of the value q as possible, the number of variations in the shift amount w can be reduced as much as possible. In the example shown in Figure 10, when the third set 32 ​​is applied, the number of variations in the shift amount w can be reduced to the minimum value of 7. When the third set 32 ​​is applied, the correspondence shown in Figure 11 is established.

[0108] Figure 11 shows an example of the correspondence between the bit length of value q and various values ​​including the shift amount w according to the second embodiment.

[0109] According to the example shown in Figure 11, if the bit length of value q is any of 1 to 31, the shift amount w is set to 0 and the value of 2k is set to 64. If the bit length of value q is any of 32 to 47, the shift amount w is set to 32 and the value of 2k is set to 96. If the bit length of value q is any of 48 to 55, the shift amount w is set to 48 and the value of 2k is set to 112. If the bit length of value q is any of 56 to 59, the shift amount w is set to 120 and the value of 2k is set to 56. If the bit length of value q is 60 or 61, the shift amount w is set to 58 and the value of 2k is set to 122. If the bit length of value q is 62 or 63, the shift amount w is set to 62 and the value of 2k is set to 126. If the bit length of value q is 64, the shift amount w is set to 64, and the value of 2k is set to 128. The value of (2k-w) is constant at 64 regardless of the bit length of value q.

[0110] Therefore, by using the correspondence illustrated in Figure 11, it becomes possible to limit the number of shift amount variations in the first shift operation to seven, and to limit the number of shift amount variations in the second shift operation to one.

[0111] (Third embodiment) According to the first and second embodiments, the same value of (2k-w) is associated with all possible bit lengths of the value q. At a minimum, if the same value of (2k-w) is associated with multiple possible bit lengths of the value q, it is possible to reduce the number of variations of the shift amount (2k-w).

[0112] In the third embodiment, an example of a configuration in which the number of variations of the shift amount (2k-w) is 2 will be described. Note that in the third embodiment, matters that differ from the first embodiment will be described. Matters that are the same as in the first embodiment will be omitted or described in a simplified manner.

[0113] Figure 12 shows an example of the correspondence between the bit length of value q and various values ​​including the shift amount w according to the third embodiment.

[0114] If the bit length of value q is any of 1 to 15, the shift amount w is set to 0 and the value of 2k is set to 32. If the bit length of value q is any of 16 to 23, the shift amount w is set to 16 and the value of 2k is set to 48. If the bit length of value q is any of 24 to 27, the shift amount w is set to 24 and the value of 2k is set to 56. If the bit length of value q is 28 or 29, the shift amount w is set to 28 and the value of 2k is set to 60. If the bit length of value q is 30 or 31, the shift amount w is set to 30 and the value of 2k is set to 62. If the bit length of value q is any of 32 to 47, the shift amount w is set to 32 and the value of 2k is set to 96. If the bit length of value q is any of 48 to 55, the shift amount w is set to 48 and the value of 2k is set to 112. If the bit length of value q is any of 56 to 59, the shift amount w is set to 56 and the value of 2k is set to 120. If the bit length of value q is 60 or 61, the shift amount w is set to 58 and the value of 2k is set to 122. If the bit length of value q is 62 or 63, the shift amount w is set to 62 and the value of 2k is set to 126. If the bit length of value q is 64, the shift amount w is set to 64 and the value of 2k is set to 128. If the bit length of value q is any of 1 to 31, the value of (2k-w) is set to 32. If the bit length of value q is any of 32 to 64, the value of (2k-w) is set to 64.

[0115] In other words, the correspondence shown in Figure 12 has a structure in which a portion of the correspondence shown in Figure 3 concerning the bit length of value q in the range of 1 to 31 and a portion of the correspondence shown in Figure 11 concerning the bit length of value q in the range of 32 to 64 are merged.

[0116] As described above, the correspondence is set up so that the number of variations of the shift amount w in the first shift operation is limited to 11, and the number of variations of the shift amount (2k-w) in the second shift operation is limited to 2.

[0117] Figure 13 shows an example of the configuration of the remainder arithmetic unit 1a according to the third embodiment. Note that the correspondence shown in Figure 12 is assumed to apply here.

[0118] The value a is input to the modulo arithmetic unit 1a via a 128-bit wide data path. The value q is input to the modulo arithmetic unit 1a via a 64-bit wide data path.

[0119] The modulo arithmetic unit 1a includes a first shift circuit block 11a, a first multiplication circuit 12, a second shift circuit block 13a, a second multiplication circuit 14, a subtraction circuit 15, and a correction processing circuit 16.

[0120] The first shift circuit block 11a performs a shift operation that shifts value a to the right by a shift amount w. The value of the shift amount w is associated with the bit length of value q by the correspondence shown in Figure 12. The intermediate value Iv1 is obtained by the shift operation in the first shift circuit block 11a.

[0121] The second shift circuit block 13a performs a shift operation that shifts the intermediate value Iv2 to the right by (2k-w) bits. Here, the value of (2k-w) corresponds to the bit length of the value q according to the correspondence illustrated in Figure 12. The intermediate value Iv3 is obtained by the shift operation in the second shift circuit block 13a.

[0122] Figure 14 shows an example of the configuration of the first shift circuit block 11a according to the third embodiment.

[0123] The first shift circuit block 11a comprises a number of shift circuits 111a corresponding to the number of variations in the shift amount w. That is, the first shift circuit block 11a comprises a total of 11 shift circuits 111a: shift circuit 111a-1, shift circuit 111a-2, shift circuit 111a-3, shift circuit 111a-4, shift circuit 111a-5, shift circuit 111a-6, shift circuit 111a-7, shift circuit 111a-8, shift circuit 111a-9, shift circuit 111a-10, and shift circuit 111a-11. Some of these shift circuits 111a are not shown in the diagram.

[0124] The value 'a' is input to 11 shift circuits 111a in common. Each of the 11 shift circuits 111a performs a shift operation on value 'a' with a different shift amount. The shift amount in the shift operation performed by each of the 11 shift circuits 111a is one of the 11 variations of the shift amount 'w'.

[0125] Specifically, shift circuit 111a-1 shifts the value a to the right by 0 bits. In other words, shift circuit 111a-1 outputs the value a as is. Shift circuit 111a-2 shifts the value a to the right by 16 bits. Shift circuit 111a-3 shifts the value a to the right by 24 bits. Shift circuit 111a-4 shifts the value a to the right by 28 bits. Shift circuit 111a-5 shifts the value a to the right by 30 bits. Shift circuit 111a-6 shifts the value a to the right by 32 bits. Shift circuit 111a-7 shifts the value a to the right by 48 bits. Shift circuit 111a-8 shifts the value a to the right by 56 bits. Shift circuit 111a-9 shifts the value a to the right by 58 bits. Shift circuits 111a-10 shift the value a to the right by 62 bits. Shift circuits 111a-11 shift the value a to the right by 64 bits.

[0126] The first shift circuit block 11a further includes a bit length determination circuit 112 and a selection circuit 113a. The 11 shift circuits 111a are connected to the selection circuit 113a.

[0127] The value q is input to the bit length determination circuit 112. The bit length determination circuit 112 determines the bit length of the value q. The bit length of the value q obtained by the determination is input to the selection circuit 113a as a selection signal.

[0128] The selection circuit 113a selects one of the output values ​​from the 11 shift circuits 111 based on the selection signal and the correspondence shown in Figure 12, and outputs it as the intermediate value Iv1.

[0129] Specifically, if the bit length of value q is any of 1 to 15, the selection circuit 113a outputs the output value of shift circuit 111a-1 as the intermediate value Iv1. If the bit length of value q is any of 16 to 23, the selection circuit 113a outputs the output value of shift circuit 111a-2 as the intermediate value Iv1. If the bit length of value q is any of 24 to 27, the selection circuit 113a outputs the output value of shift circuit 111a-3 as the intermediate value Iv1. If the bit length of value q is 28 or 29, the selection circuit 113a outputs the output value of shift circuit 111a-4 as the intermediate value Iv1. If the bit length of value q is 30 or 31, the selection circuit 113a outputs the output value of shift circuit 111a-5 as the intermediate value Iv1. If the bit length of value q is any of 32 to 47, the selection circuit 113a outputs the output value of shift circuit 111a-7 as the intermediate value Iv1. If the bit length of value q is any of 48 to 55, the selection circuit 113a outputs the output value of shift circuit 111a-8 as the intermediate value Iv1. If the bit length of value q is any of 56 to 59, the selection circuit 113a outputs the output value of shift circuit 111a-9 as the intermediate value Iv1. If the bit length of value q is 60 or 61, the selection circuit 113a outputs the output value of shift circuit 111a-10 as the intermediate value Iv1. If the bit length of value q is 62 or 63, the selection circuit 113a outputs the output value of shift circuit 111a-11 as the intermediate value Iv1. If the bit length of value q is 64, the selection circuit 113a outputs the output value of the shift circuit 111a-12 as the intermediate value Iv1.

[0130] With the first shift circuit block 11a configured as described above, a shift operation is realized in which the shift amount w corresponds to the bit length of the value q according to the correspondence shown in Figure 12.

[0131] Figure 15 shows an example of the configuration of the second shift circuit block 13a according to the third embodiment.

[0132] The second shift circuit block 13a comprises a number of shift circuits 131a corresponding to the number of variations of the shift amount (2k-w). That is, the second shift circuit block 13a comprises a total of two shift circuits 131: shift circuit 131a-1 and shift circuit 131a-2. Therefore, it can be considered that the second shift circuit block 13a comprises a number of shift circuits 131a that is less than the number of variations of the bit length of the value q.

[0133] The intermediate value Iv2 is input to the two shift circuits 131a. The two shift circuits 131a perform a shift operation on the intermediate value Iv2 with different shift amounts. The shift amount in the shift operation performed by each of the two shift circuits 131a is one of two variations of the shift amount (2k-w). Shift circuit 131a-1 shifts the intermediate value Iv2 to the right by 32 bits. Shift circuit 131a-2 shifts the intermediate value Iv2 to the right by 64 bits.

[0134] The second shift circuit block 13a further includes a bit length determination circuit 132 and a selection circuit 133.

[0135] The value q is input to the bit length determination circuit 132. The bit length determination circuit 132 determines the bit length of the value q. The bit length of the value q obtained by the determination is input to the selection circuit 133 as a selection signal.

[0136] Based on the selection signal and the correspondence illustrated in Figure 12, the selection circuit 133 selects one of the output values ​​from the two shift circuits 131 and outputs it as the intermediate value Iv3.

[0137] Specifically, if the bit length of value q is any of 1 to 31, the selection circuit 133 outputs the output value of shift circuit 131a-1 as the intermediate value Iv3. If the bit length of value q is any of 32 to 64, the selection circuit 133 outputs the output value of shift circuit 131a-2 as the intermediate value Iv3.

[0138] With the second shift circuit block 13a configured as described above, a shift operation is realized in which the shift amount (2k-w) corresponds to the bit length of the value q according to the correspondence shown in Figure 12.

[0139] Thus, according to the third embodiment, the same value of (2k-w) is associated with multiple possible values ​​for the bit length of value q. In other words, the correspondence between the possible values ​​for the bit length of value q, the possible values ​​for the shift amount w, and the possible values ​​for the parameter value k is set up so that the value of (2k-w) is the same when the bit length of value q is the third value and when it is a fourth value different from the third value.

[0140] Therefore, the number of variations in the shift amount (2k-w) in the second shift operation can be made smaller than the number of variations in the bit length of the value q. Thus, it is possible to realize a modulo arithmetic unit 1a that is small in circuit size and can perform calculations at high speed.

[0141] Furthermore, according to the third embodiment, as explained with reference to Figure 15, the second shift circuit block 13a comprises a plurality of shift circuits 131a, fewer than the number of variations in the bit length of the value q, and a selection circuit 133. An intermediate value Iv2 is commonly input to each of the plurality of shift circuits 131a. The selection circuit 133 selects one output value from the plurality of shift circuits 131a based on the bit length of the value q.

[0142] Therefore, the number of variations in the shift amount (2k-w) in the second shift operation can be made smaller than the number of variations in the bit length of the value q. Thus, it is possible to realize a modulo arithmetic unit 1a that is small in circuit size and can perform calculations at high speed.

[0143] (Fourth embodiment) In the first embodiment, the calculation of value a was performed in the signature processing circuit 102. In the fourth embodiment, the modulo arithmetic unit performs the calculation of value a. The fourth embodiment will be described in relation to the differences from the first embodiment. Note that the fourth embodiment is applicable to any of the modulo arithmetic units 1 and 1a according to the first to third embodiments.

[0144] Figure 16 shows an example of the configuration of the modulo arithmetic unit 1b according to the fourth embodiment. The configuration of the modulo arithmetic unit 1b differs from the configuration of the modulo arithmetic unit 1 according to the first embodiment in that a third multiplication circuit 17 is added.

[0145] The modulo arithmetic unit 1b receives values ​​x and y from an external source (e.g., the signature processing circuit 102). Value x is input to the modulo arithmetic unit 1b via a 32-bit data path, which is the maximum possible width of the parameter value k. Similarly, value y is input to the modulo arithmetic unit 1b via a 32-bit data path, which is the maximum possible width of the parameter value k.

[0146] The third multiplication circuit 17 obtains the value a by multiplying the value x by the value y. The value a is input to other circuits in the modulo arithmetic unit 1b (the first shift circuit block 11 and the subtraction circuit 15, which are not shown in Figure 16) via a 64-bit wide data path.

[0147] Thus, the modulo arithmetic unit 1b may be configured such that the values ​​x and y are input to the modulo arithmetic unit 1b. In the modulo arithmetic unit 1b, the third multiplication circuit 17 obtains the value a by multiplying the value x by the value y.

[0148] While several embodiments of the present invention have been described, these embodiments are presented as examples only and are not intended to limit the scope of the invention. These novel embodiments can be carried out in a variety of other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their variations are included in the scope and spirit of the invention, as well as in the claims of the invention and its equivalents. [Explanation of Symbols]

[0149] 1,1a,1b Remainder arithmetic unit, 11,11a First shift circuit block, 12 First multiplication circuit, 13,13a Second shift circuit block, 14 Second multiplication circuit, 15 Subtraction circuit, 16 Correction processing circuit, 17 Third multiplication circuit, 30 First set, 31 Second set, 32 Third set, 100 Controller, 101 Main control circuit, 102 Signature processing circuit, 103 Buffer memory, 111, 111-1, 111-2, 111-3, 111-4, 111-5, 111-6, 111a, 111a-1, 111a-2, 111a-3, 111a-4, 111a-5, 111a-6, 111a-7, 111a-8, 111a-9, 111a-10, 111a-11, 111a-12, 131, 131a, 131a-1, 131a-2 shift circuit, 112, 132 bit length determination circuit, 113, 113a, 133 selection circuit, 200 semiconductor memory, 201 storage area, 202 management information storage area, 300 memory system, 400 host, 501 firmware (FW), 502 signature.

Claims

1. A remainder arithmetic unit that calculates the remainder by bitwise operations using dividend a and divisor q, A first shift circuit that obtains a first intermediate value by shifting the dividend a to the right by a shift amount w corresponding to the bit length of the divisor q, A first multiplication circuit that obtains a second intermediate value by multiplying the first intermediate value by m, A second shift circuit obtains a third intermediate value by shifting the aforementioned second intermediate value to the right by a shift amount (2k-w), A second multiplication circuit obtains a fourth intermediate value by multiplying the third intermediate value by q, A subtraction circuit that obtains a fifth intermediate value by subtracting the fourth intermediate value from the dividend a, A processing circuit that obtains the remainder by subtracting a value that is n times the divisor q (where n is an integer greater than or equal to 0) from the fifth intermediate value, Equipped with, The shift amount w takes a value less than or equal to the bit length of the divisor q. The parameter value k takes a value greater than or equal to the bit length of the divisor q. Remainder arithmetic unit.

2. The correspondence between the possible values ​​of the bit length of the divisor q and the possible values ​​of the shift amount w and the parameter value k is set such that the combination of the shift amount w and the parameter value k is the same when the bit length of the divisor q is a first value and when it is a second value different from the first value. The modulo arithmetic device according to claim 1.

3. The correspondence between the possible values ​​of the bit length of the divisor q, the possible values ​​of the shift amount w, and the possible values ​​of the parameter value k is set up such that the value of the shift amount (2k-w) is the same when the bit length of the divisor q is a third value and when it is a fourth value different from the third value. A modulo arithmetic device according to claim 1 or claim 2.

4. The correspondence is set such that the value of the shift amount (2k-w) remains constant regardless of the bit length of the divisor q. The modulo arithmetic device according to claim 3.

5. The first shift circuit comprises a plurality of shift circuits, each with a different shift amount, where the dividend a is a common input and the number of shift circuits is less than the number of possible bit lengths of the divisor q, and a selection circuit. The selection circuit selects one output value from among the output values ​​of the plurality of shift circuits based on the bit length of the divisor q. The first intermediate value is the single output value selected by the selection circuit. The modulo arithmetic device according to claim 2.

6. The second shift circuit comprises a plurality of shift circuits, each with a different shift amount, the second intermediate value being a common input, and a number of these shift circuits being less than the number of possible bit lengths for the divisor q, and a selection circuit. The selection circuit selects one output value from among the output values ​​of the plurality of shift circuits based on the bit length of the divisor q. The third intermediate value is the one output value selected by the selection circuit. The modulo arithmetic device according to claim 3.

7. A value x and a value y that are smaller than the aforementioned divisor q are input. The system further comprises a third multiplication circuit that obtains the dividend a by multiplying the value x by the value y. The modulo arithmetic device according to claim 1.

8. Non-volatile memory containing firmware, A controller configured to control the non-volatile memory, the controller configured to perform a firmware signature verification process, which includes calculating the remainder using a bitwise operation with a dividend a and a divisor q, It is equipped with, The aforementioned controller, The first intermediate value is obtained by shifting the dividend a to the right by a shift amount w corresponding to the bit length of the divisor q. The second intermediate value is obtained by multiplying the first intermediate value by m. The third intermediate value is obtained by shifting the aforementioned second intermediate value to the right by a shift amount (2k-w). The fourth intermediate value is obtained by multiplying the third intermediate value by q. The fifth intermediate value is obtained by subtracting the fourth intermediate value from the dividend a. The remainder is calculated by subtracting a value that is n times the divisor q (where n is an integer greater than or equal to 0) from the fifth intermediate value. The shift amount w is a value less than or equal to the bit length of the divisor q. The parameter value k is greater than or equal to the bit length of the divisor q. Memory system.

Images