Arithmetic device and arithmetic method

Abstract

An arithmetic device according to one aspect of the present disclosure, which calculates a multiplication remainder of two integers a and b satisfying 0 ≤ a, b < q, using an integer of the form q = 2n – 1 (where n is a predetermined integer) as a divisor, comprises: a multiplication unit that calculates the multiplication of integers a and b represented by n-bit bit strings; an addition unit that calculates the addition of the upper n bits and the lower n bits of a 2n-bit bit string representing the result of the multiplication; and a memory unit that stores a bit value representing the presence or absence of carry from the addition, and an n-bit bit string representing the result of the addition. The addition unit further calculates, as the result of the calculation of said multiplication remainder, the addition of the bit value representing the presence or absence of the carry from the previous addition and the n-bit bit string representing the result of the previous addition.

Description

Calculation device and calculation method

[0001] The present disclosure relates to a computing device and a computing method.

[0002] In cryptographic algorithms such as RSA (Rivest-Shamir-Adleman) cryptography and elliptic curve cryptography, it is necessary to obtain a modular multiplication remainder with respect to a certain characteristic (for example, Non-Patent Document 1).

[0003] Yi Ge, Takao Sakurai, Shuichi Sakai, Hidehiko Tanaka, "Arithmetic Circuits and Their Applications to Cryptographic Processing Hardware," February 2004

[0004] However, when calculating the multiplication remainder of an n-bit integer using a general arithmetic logic unit (ALU), a 2n-bit register for holding the multiplication result and a division circuit that generally requires complex operations and large gate size are required.

[0005] The present disclosure has been made in view of the above points, and aims to realize efficient modular multiplication.

[0006] According to one aspect of the present disclosure, the arithmetic device ｎ An arithmetic device that calculates a modular multiplication remainder of two integers a and b that satisfy 0≦a, b<q, using an integer in the format of −1 (where n is a predetermined integer) as a divisor, the device having: a multiplication unit that calculates the multiplication of integers a and b represented by an n-bit bit string; an addition unit that calculates the addition of the most significant n bits and the least significant n bits of a 2n-bit bit string that represents the result of the multiplication; and a storage unit that stores a bit value that represents the presence or absence of a carry in the addition and an n-bit bit string that represents the result of the addition, wherein the addition unit further calculates the addition of the bit value that represents the presence or absence of a carry in the addition and the n-bit bit string that represents the result of the addition, as the calculation result of the modular multiplication remainder.

[0007] An efficient modular multiplication operation can be realized.

[0008] FIG. 1 is a diagram illustrating an example of the configuration of a modular multiplication device according to the present embodiment; FIG. 2 is a diagram illustrating an example of the configuration of a modular multiplication circuit according to Example 1; FIG. 3 is a diagram illustrating an example of the flow of modular multiplication processing according to Example 1; FIG. 4 is a diagram illustrating an example of the operation of a register according to Example 1; FIG. 5 is a diagram illustrating an example of the configuration of a modular multiplication circuit according to Example 2; FIG. 6 is a diagram illustrating an example of the flow of modular multiplication processing according to Example 2; and FIG. 7 is a diagram illustrating an example of the operation of a register according to Example 2.

[0009] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described in detail below with reference to the accompanying drawings. In the following embodiment, a modular multiplication device 10 capable of implementing efficient modular multiplication operations will be described.

[0010] Hereinafter, n is an integer equal to or greater than 1 that represents a predetermined number of bits, and q is q=2. ｎ Let a and b be integers expressed in the form of -1, and two n-bit integers satisfying 0≦a, b<q. In this case, assume that the multiplication remainder r:=a×b mod q of the two integers a and b is calculated using q as the divisor. Hereinafter, the integers a and b and various calculation results are represented as bit strings. Note that n can be any integer greater than or equal to 1, but is set to the number of bits used in cryptographic algorithms such as RSA cryptography and elliptic curve cryptography, for example.

[0011] <Configuration Example of Modular Multiplication Device 10> A configuration example of the modular multiplication device 10 according to this embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram showing an example of the configuration of the modular multiplication device 10 according to this embodiment.

[0012] As shown in FIG. 1 , a modular multiplication device 10 according to this embodiment includes a modular multiplication circuit 100. The modular multiplication circuit 100 is an electronic circuit that receives two n-bit integers a and b as input and calculates a modular multiplication remainder r. The modular multiplication remainder r is used, for example, in cryptographic algorithms. The modular multiplication circuit 100 may exist as dedicated hardware, or may be incorporated into cryptographic processing hardware that executes cryptographic algorithms, for example.

[0013] Hereinafter, examples 1 and 2 of the modular multiplication circuit 100 will be described.

[0014] First Embodiment First, a first embodiment of the modular multiplication circuit 100 will be described.

[0015] <Configuration Example of Modular Multiplication Circuit 100 According to First Embodiment> A configuration example of the modular multiplication circuit 100 according to the first embodiment will be described with reference to Fig. 2. Fig. 2 is a diagram illustrating an example of the configuration of the modular multiplication circuit 100 according to the first embodiment.

[0016] As shown in Fig. 2, the modular multiplication circuit 100 according to the first embodiment includes a multiplication circuit 111, a selection circuit 112, an addition circuit 113, and a register 114. Hereinafter, the time when integers a and b are provided to the modular multiplication circuit 100 is defined as the 0th clock. Also, it is assumed that the register 114 is initialized to all 0s at the 0th clock. Note that a clock is a signal for synchronizing the transmission and reception of signals representing bit strings between electronic circuits. The clock is generated at a certain predetermined cycle, and each time a clock is generated, the number of clock generation times increases to the first clock, second clock, third clock, etc.

[0017] The multiplication circuit 111 is a combinational circuit that inputs two n-bit integers a and b at the first clock and calculates and outputs the multiplication result ab. The multiplication result ab is represented by a 2n-bit bit string, and the most significant n bits are output to a register 114 and the least significant n bits are output to a selection circuit 112.

[0018] The selection circuit 112 is a combinational circuit that outputs two of a plurality of inputs to the addition circuit 113 in accordance with the current number of clock generation times. Specifically, at the second clock, the selection circuit 112 outputs the bit string of the lowest n bits of the multiplication result ab and the bit string of the lowest n bits of the bit string held in the register 114 to the addition circuit 113. At the third clock, the selection circuit 112 outputs the bit string of the lowest n bits of the bit string held in the register 114 and the bit string of n bits whose least significant bit has the bit value of the most significant bit held in the register 114 to the addition circuit 113.

[0019] The adder circuit 113 is a combinational circuit that inputs two bit strings, calculates the addition result, and outputs the result of their addition. Specifically, at the second clock, the adder circuit 113 adds the n least significant bits of the multiplication result ab to the n least significant bits of the bit string held in the register 114, and outputs the addition result to the register 114. At the third clock, the adder circuit 113 adds the n least significant bits of the bit string held in the register 114 to the n least significant bit of the bit string held in the register 114, and outputs the addition result to the register 114.

[0020] The register 114 is a storage circuit that holds a bit string of n+1 bits. At the fourth clock, the lowest n bits of the bit string held in the register 114 are output as a bit string representing the multiplication remainder r.

[0021] <Flow of modular multiplication processing according to embodiment 1> The flow of modular multiplication processing according to embodiment 1 will be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of the flow of modular multiplication processing according to embodiment 1. It is assumed that n-bit integers a and b are provided to the modular multiplication circuit 100, and that the register 114 is initialized to all 0s (i.e., the register 114 holds a bit string of n+1 bits, all of which are 0s).

[0022] The multiplication circuit 111 of the modular multiplication circuit 100 receives two n-bit integers a and b and calculates the multiplication result ab (step S101). The most significant n bits of the 2n-bit bit string representing the multiplication result ab are output to the register 114, and the least significant n bits are output to the selection circuit 112.

[0023] Next, the adder circuit 113 of the modular multiplication circuit 100 adds the bit string of the lowest n bits of the multiplication result ab to the bit string of the lowest n bits of the bit string held in the register 114 (i.e., the bit string of the highest n bits of the multiplication result ab) (step S102). The bit string representing this addition result is output to the register 114. Here, the bit string representing the addition result in this step is represented by n bits if no carry occurs, and by n+1 bits including the carry bit if a carry occurs. However, since the carry bit indicates whether a carry occurs or not, the bit string representing the addition result in this step may be represented by n+1 bits including the carry bit regardless of whether a carry occurs. Note that both the bit string of the lowest n bits of the multiplication result ab and the bit string of the lowest n bits of the bit string held in the register 114 are output from the selection circuit 112 to the adder circuit 113 at the second clock.

[0024] Next, the adder circuit 113 of the modular multiplication circuit 100 adds the n least significant bits of the bit string held in the register 114 to an n bit string having the bit value of the most significant bit held in the register 114 as its least significant bit (step S103). In other words, the adder circuit 113 adds the n least significant bits of the bit string held in the register 114 to a bit string obtained by shifting the n+1 bit string held in the register 114 to the right by n bits. Note that both the n least significant bits of the bit string held in the register 114 and the n bit string having the bit value of the most significant bit held in the register 114 as its least significant bit are output from the selector circuit 112 to the adder circuit 113 at the third clock.

[0025] Finally, the register 114 of the modular multiplication circuit 100 outputs the bit string of the lower n bits as a bit string representing the multiplication remainder r (step S104), thereby obtaining the calculation result r=a×b mod q.

[0026] <Example of Operation of Register 114 According to First Embodiment> An example of operation of the register 114 according to the first embodiment will now be described with reference to Fig. 4. Fig. 4 is a diagram illustrating an example of operation of the register according to the first embodiment.

[0027] 4 , the register 114 according to the first embodiment is initialized to all 0s at the 0th clock. First, in step S101 described above, in the first clock, the most significant n bits of the 2n-bit bit string representing the multiplication result ab are held in the register 114. Next, in step S102 described above, in the second clock, a bit string representing the addition result of the most significant n bits of the 2n-bit bit string representing the multiplication result ab and the least significant n bits of the 2n-bit bit string representing the multiplication result ab is held in the register 114. Note that in the second clock, as a result of adding the most significant n bits and the least significant n bits of the 2n-bit bit string representing the multiplication result ab, if a carry occurs, the most significant bit (i.e., the n+1th bit) holds 1, and if a carry does not occur, the most significant bit remains 0. Next, in step S103, at the third clock, a bit string representing the addition result of the n least significant bits of the register 114 and a bit string obtained by shifting the n+1 bit string held in the register 114 to the right by n bits is held in the register 114. Then, in step S104, the n least significant bits of the n+1 bit string held in the register 114 are output as a bit string representing the multiplication remainder r.

[0028] In step S103, the n+1-bit bit string held in register 114 is shifted right by n bits and then added. This eliminates the need for the process of adding the two's complement of q (q subtraction) required in conventional modular multiplication operations, and as a result, eliminates the need for conditional branching.

[0029] Summary of First Embodiment As described above, the modular multiplication circuit 100 according to the first embodiment can obtain the modular multiplication remainder r:=a×b mod q (where q=2) for two n-bit integers a and b in the n+1-bit register 114 without using a division circuit, which generally requires complex calculations and has a large gate scale. ｎTherefore, by using the modular multiplication circuit 100 according to the first embodiment, efficient modular multiplication can be realized.

[0030] In the first embodiment, in step S101, the most significant n bits of the 2n-bit bit string representing the multiplication result ab are output to the register 114, and the least significant n bits are output to the selection circuit 112. However, this may be reversed. That is, the most significant n bits of the 2n-bit bit string representing the multiplication result ab may be output to the selection circuit 112, and the least significant n bits may be output to the register 114.

[0031] Second Embodiment Next, a second embodiment of the modular multiplication circuit 100 will be described.

[0032] <Configuration Example of Modular Multiplication Circuit 100 According to Second Embodiment> A configuration example of the modular multiplication circuit 100 according to the second embodiment will be described with reference to Fig. 5. Fig. 5 is a diagram illustrating an example of the configuration of the modular multiplication circuit 100 according to the second embodiment.

[0033] 5, the modular multiplication circuit 100 according to the second embodiment includes a multiplication circuit 121, an addition circuit 122, an addition circuit 123, and a register 124. As in the first embodiment, the time when integers a and b are given to the modular multiplication circuit 100 is defined as the 0th clock, and it is assumed that the register 124 is all initialized to 0 at the 0th clock.

[0034] The multiplication circuit 121 is a combinational circuit that inputs two n-bit integers a and b at the first clock and calculates and outputs the multiplication result ab. The multiplication result ab is represented by a 2n-bit bit string, and the most significant n bits are output to the register 124 and the least significant n bits are output to the adder circuit 122.

[0035] At the second clock, the adder circuit 122 adds the bit string of the lowest n bits of the multiplication result ab to the bit string of the lowest n bits of the bit string held in the register 124 (i.e., the bit string of the highest n bits of the multiplication result ab), and outputs the addition result and a carry bit to the adder circuit 123. The carry bit is 0 if no carry occurs in the addition operation, and 1 if a carry occurs.

[0036] At the second clock, the adder circuit 123 adds an n-bit bit string representing the addition result of the adder circuit 122 to an n-bit bit string having the carry bit as the least significant bit, and outputs the addition result to the register 124.

[0037] The register 124 is a storage circuit that holds an n-bit string. At the third clock, the n-bit string held in the register 124 is output as a bit string representing the multiplication remainder r.

[0038] <Flow of Modular Multiplication Processing According to Second Embodiment> The flow of modular multiplication processing according to the second embodiment will be described with reference to Fig. 6. Fig. 6 is a diagram showing an example of the flow of modular multiplication processing according to the second embodiment. It is assumed that n-bit integers a and b are provided to the modular multiplication circuit 100, and the register 124 is initialized to all 0s (i.e., the register 124 holds an n-bit bit string of all 0s).

[0039] The multiplication circuit 121 of the modular multiplication circuit 100 receives two n-bit integers a and b and calculates the multiplication result ab (step S201). The most significant n bits of the 2n-bit bit string representing the multiplication result ab are output to the register 124, and the least significant n bits are output to the adder circuit 122.

[0040] Next, the adder circuit 122 of the modular multiplication circuit 100 adds the n least significant bits of the multiplication result ab to the n least significant bits of the bit string held in the register 124 (i.e., the n most significant bits of the multiplication result ab) (step S202). The bit string representing this addition result and the carry bit used in this addition are output to the adder circuit 123.

[0041] Next, the adder circuit 123 of the modular multiplication circuit 100 adds the n-bit bit string representing the addition result of the adder circuit 122 to the n-bit bit string having the carry bit as the least significant bit (step S203). The bit string representing this addition result is output to the register 124.

[0042] Finally, the register 124 of the modular multiplication circuit 100 outputs the n-bit bit string held therein as a bit string representing the multiplication remainder r (step S204), thereby obtaining the calculation result r=a×b mod q.

[0043] <Example of Operation of Register 124 According to Second Embodiment> Here, the operation of the register 124 according to the second embodiment will be described with reference to Fig. 7. Fig. 7 is a diagram showing an example of operation of the register 124 according to the second embodiment.

[0044] 7, the register 124 according to the second embodiment is initialized to all 0s at the 0th clock. First, in step S201 described above, the most significant n bits of the 2n-bit bit string representing the multiplication result ab are held in the register 124 at the first clock. Next, in steps S202 and S203 described above, in the second clock, a bit string representing the addition result of the most significant n bits of the 2n-bit bit string representing the multiplication result ab, the least significant n bits of the 2n-bit bit string representing the multiplication result ab, and an n-bit bit string having a carry bit as the least significant bit is held in the register 124. Then, in step S204 described above, the n-bit bit string held in the register 124 is output as a bit string representing the multiplication remainder r.

[0045] As described above, the modular multiplication circuit 100 according to the second embodiment has one more adder circuit than the modular multiplication circuit 100 according to the first embodiment, but it is possible to reduce the size of the register 124 and the number of clocks required for the modular multiplication operation. Therefore, by using the modular multiplication circuit 100 according to the second embodiment, it is possible to realize an efficient modular multiplication operation.

[0046] In the second embodiment, in step S201, the most significant n bits of the 2n-bit bit string representing the multiplication result ab are output to the register 124, and the least significant n bits are output to the adder circuit 122. However, this may be reversed. That is, the most significant n bits of the 2n-bit bit string representing the multiplication result ab may be output to the adder circuit 122, and the least significant n bits may be output to the register 124.

[0047] In the second embodiment, the upper n bits of the multiplication result ab by the multiplication circuit 121 are output to the register 124. However, the upper n bits and the lower n bits of the multiplication result ab may be output to the addition circuit 122 without outputting the upper n bits to the register 124. This makes it possible to execute one multiplication and two additions in one clock.

[0048] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0049] 10 Modular multiplication device 100 Modular multiplication circuit 111 Multiplication circuit 112 Selection circuit 113 Addition circuit 114 Register 121 Multiplication circuit 122 Addition circuit 123 Addition circuit 124 Register

Claims

1. q = 2 ｎ An arithmetic device for calculating a modular multiplication remainder of two integers a and b that satisfy 0≦a, b<q, using an integer in the format of -1 (where n is a predetermined integer) as a divisor, the arithmetic device comprising: a multiplication unit that calculates the multiplication of integers a and b represented by an n-bit bit string; an addition unit that calculates the addition of the most significant n bits and the least significant n bits of a 2n-bit bit string that represents the result of the multiplication; and a storage unit that stores a bit value that represents the presence or absence of a carry in the addition and an n-bit bit string that represents the result of the addition, wherein the addition unit further calculates the addition of the bit value that represents the presence or absence of a carry in the addition and the n-bit bit string that represents the result of the addition, as the calculation result of the modular multiplication remainder.

2. q = 2 ｎ An arithmetic device for calculating a modular multiplication remainder of two integers a and b that satisfy 0≦a, b<q, using an integer in the format of -1 (where n is a predetermined integer) as a divisor, the arithmetic device having: a multiplication unit that calculates the multiplication of integers a and b expressed by an n-bit bit string; a first addition unit that calculates the addition of the most significant n bits and the least significant n bits of a 2n-bit bit string that represents the result of the multiplication; and a second addition unit that calculates the addition of a bit value that represents the presence or absence of a carry in the addition and an n-bit bit string that represents the result of the addition, as the calculation result of the modular multiplication remainder.

3. q = 2 ｎ An arithmetic device that calculates a modular multiplication remainder of two integers a and b that satisfy 0≦a, b<q, using an integer in the format of -1 (where n is a predetermined integer) as a divisor, executes the following operations: a multiplication step that calculates the multiplication of integers a and b represented by an n-bit bit string; an addition step that calculates the addition of the most significant n bits and the least significant n bits of a 2n-bit bit string that represents the result of the multiplication; and a storage step that stores a bit value that represents the presence or absence of a carry in the addition and the n-bit bit string that represents the result of the addition, wherein the addition step further calculates the addition of the bit value that represents the presence or absence of a carry in the addition and the n-bit bit string that represents the result of the addition, as the calculation result of the modular multiplication remainder.

4. q = 2 ｎ An arithmetic device that calculates a modular multiplication remainder of two integers a and b that satisfy 0≦a, b<q, using an integer in the format of -1 (where n is a predetermined integer) as a divisor, executes the following arithmetic method: a multiplication step that calculates the multiplication of integers a and b expressed by an n-bit bit string; a first addition step that calculates the addition of the most significant n bits and the least significant n bits of a 2n-bit bit string that represents the result of the multiplication; and a second addition step that calculates the addition of a bit value that represents the presence or absence of a carry in the addition and an n-bit bit string that represents the result of the addition, as the result of the modular multiplication remainder.

Images