|Publication number||US20070198824 A1|
|Application number||US 11/622,011|
|Publication date||Aug 23, 2007|
|Filing date||Jan 11, 2007|
|Priority date||Jan 12, 2006|
|Also published as||CN100454257C, CN100476719C, CN100578473C, CN101000497A, CN101000539A, CN101000553A, CN101004719A, US7480744, US7602655, US20070174495, US20070180165|
|Publication number||11622011, 622011, US 2007/0198824 A1, US 2007/198824 A1, US 20070198824 A1, US 20070198824A1, US 2007198824 A1, US 2007198824A1, US-A1-20070198824, US-A1-2007198824, US2007/0198824A1, US2007/198824A1, US20070198824 A1, US20070198824A1, US2007198824 A1, US2007198824A1|
|Inventors||Chia-Ping Chen, Ying-Che Hung, Li-Lien Lin|
|Original Assignee||Mediatek Inc.|
|Export Citation||BiBTeX, EndNote, RefMan|
|Referenced by (5), Classifications (16), Legal Events (1)|
|External Links: USPTO, USPTO Assignment, Espacenet|
This application claims the benefit of U.S. Provisional Application No. 60/743,126, filed Jan. 12, 2006.
1. Field of the Invention
The invention relates to Elliptic Curve Cryptography (ECC), and in particular, to arithmetic circuits for EC operations.
2. Description of the Related Art
Elliptic Curve Cryptography (ECC) is an approach to public-key cryptography based on the algebraic structure of elliptic curves over finite fields. The use of elliptic curves in cryptography was suggested independently by Neal Koblitz and Victor S. Miller in 1985. Elliptic curves are also used in several integer factorization algorithms that have applications in cryptography, such as, for instance, Lenstra elliptic curve factorization, but this use of elliptic curves is not usually referred to as “elliptic curve cryptography.”
In ECC, a finite field, also referred to as a Galois field (GF), defines a field that contains only finitely many elements. The GF is typically categorized into two types, a prime field GF(p) and a binary field GF(2m). The prime field GF(p) is a finite field with p elements, usually labelled 0, 1, 2, . . . p−1, where arithmetic is performed with modulo p. Most of the ECC schemes are related to the prime field GF(p). Often seen examples are, the Elliptic Curve Diffie-Hellman (ECDH) key agreement scheme based on the Diffie-Hellman algorithm, the Elliptic Curve Digital Signature Algorithm (ECDSA) based on the Digital Signature Algorithm, and the ECMQV key agreement scheme based on the MQV key agreement scheme.
Conventionally, for a software based system, the ECC schemes are executed by a CPU cooperated with memory. The memory is accessed rapidly, thus a costly wide-width bus is requested. Specifically designed circuits are proposed to accelerate the EC operations. For example, prior arts in US patents U.S. Pat. No. 6,963,644, U.S. Pat. No. 6,820,105, U.S. Pat. No. 6,691,143 are hardware implementations for various ECC calculations, in which a plurality of multipliers and adders are utilized. Circuits in the published disclosures, however, are designed for particular operations, and the components therein can not be reused or shared by other algorithms. Thus, redundant components are used with considerable costs, and an improvement is therefore desirable.
An exemplary embodiment of a cryptographic system is disclosed to implement an Elliptic Curve operation method. A memory stores a program and data. A central processor unit (CPU) dispatches requests to the program. The program is converted into an equivalent substitution sequence comprising only arithmetic addition, subtraction and shift operations. A register pool stores program data associated with the substitution sequence. An arithmetic logic unit (ALU) is controlled by the ASIC flow controller or the CPU to execute the substitution sequence to output an execution result.
In the ALU, an adder adds or subtracts two input numbers based on an adder trigger signal to generate the execution result. Two selectors controlled by a selection signal, pass values from the register pool to the adder as the input numbers. The adder trigger signal and selection signal are delivered from the ASIC flow controller based on the substitution sequence.
In the register pool, a plurality of registers store the program data associated with the substitution sequence. A dispatcher selectively stores the execution result or program data to one of the registers based on a storage signal. The storage signal is delivered from the ASIC flow controller based on the substitution sequence.
The shift operation may be performed by the register pool. The ASIC flow controller delivers a shift signal to one of the registers when a shift operation is requested, and the register shifts its stored data leftwards or rightwards accordingly. Each selector is coupled to outputs of the registers, selecting one of them to pass an input number to the adder. The registers may be at least 160 bit, the adder is a 32 bit full adder, and the input numbers are 32 bit individually obtained from the registers based on the selection signal.
Specifically, the program is an Elliptic Curve (EC) related application comprising point multiplication and addition operations, and prime field multiplication, inversion, addition, and subtraction operations.
The ASIC flow controller converts the point multiplication operations to a sequence comprising only prime field operations and shift operations. Furthermore, the ASIC flow controller converts prime field multiplication and inversion operations to an equivalent sequence comprising only arithmetic addition, subtraction and shift operations, such that the substitution sequence equivalent to the program is generated. The conversion of the prime field multiplication and inversion operations is a Montgomery domain transfer.
Another embodiment is an Elliptic Curve operation method, for use in an apparatus only capable of performing arithmetic addition, subtraction and shift operations. A program to be executed is firstly provided. The program is converted into an equivalent substitution sequence comprising only arithmetic addition, subtraction and shift operations. The substitution sequence is then executed and an execution result is output. A detailed description is given in the following embodiments with reference to the accompanying drawings.
The invention can be more fully understood by reading the subsequent detailed description and examples with references made to the accompanying drawings, wherein:
The following description is of the best-contemplated mode of carrying out the invention. This description is made for the purpose of illustrating the general principles of the invention and should not be taken in a limiting sense. The scope of the invention is best determined by reference to the appended claims.
Furthermore, EC point addition is convertible to a sequence of operations in Prime field GF(p), such as multiplication/inversion and addition/subtraction. Thus, multiplication (as well as inversion) in Prime field GF(p) is performed in state 207, serving as sub-functions for the aforementioned state blocks 201, 203 and 205. More than that, multiplication in Prime field GF(p) is also convertible to a sequence of arithmetic addition/subtraction operations. For example, by transferring into Montgomery domain, multiplication/inversion in Prime field GF(p) can be accomplished by only adders and bit shifters respectively associated within states 209. In view of the states classification, a generalized hardware is provided in the embodiment to perform all EC operations and operations over Prime field GF(p).
The ALU 220 comprises the adder 308, adding or subtracting two input numbers based on an adder trigger signal #addsub to generate the execution result. The two numbers are selected from the registers 304 by two selectors 306 according to a selection signal #select. The adder trigger signal #addsub and selection signal #select are delivered from the ASIC flow controller 120 or the CPU 102 when required. In the embodiment, the registers 304 are of 160 bit-width, and the adder 308 may be a 32 bit-width full adder. Each input number is 32 bit with an extra bit indicating carry or borrow. The output of the adder 308 is coupled to the dispatcher 302, thus the execution result #SUM can be feedback to the registers 304. If a 160 bit addition is requested, the adder 308 loops for five cycles with 32 bits processed per cycle. The execution result #SUM also comprises an extra bit to indicate carry or borrow. Through the control signals, the register pool 210 and ALU 220 flexibly solve all EC related operations by only addition, subtraction and shift operations.
|Citing Patent||Filing date||Publication date||Applicant||Title|
|US7602655 *||Oct 6, 2006||Oct 13, 2009||Mediatek Inc.||Embedded system|
|US7991154 *||May 14, 2008||Aug 2, 2011||Univeristy of Castilla-La Mancha||Exponentiation method using multibase number representation|
|US7991162 *||Sep 14, 2007||Aug 2, 2011||University Of Ottawa||Accelerating scalar multiplication on elliptic curve cryptosystems over prime fields|
|US8615080 *||Jun 27, 2012||Dec 24, 2013||Blackberry Limited||Method and apparatus for performing elliptic curve scalar multiplication in a manner that counters power analysis attacks|
|US20120275594 *||Nov 1, 2012||Research In Motion Limited||Method and Apparatus for Performing Elliptic Curve Scalar Multiplication in a Manner that Counters Power Analysis Attacks|
|Cooperative Classification||H04L9/3066, H04L2209/12, G06F21/57, G11B2220/2562, G11B20/00086, G11C7/24, G06F7/725, G11C17/18, G11B2220/213|
|European Classification||G11C7/24, G11C17/18, G06F21/57, H04L9/30, G06F7/72F1|
|Feb 12, 2007||AS||Assignment|
Owner name: MEDIATEK INC., TAIWAN
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:CHEN, CHIA PING;HUNG, YING-CHE;LIN, LI-LIEN;REEL/FRAME:018880/0118;SIGNING DATES FROM 20070110 TO 20070115