CN113660087B - SM9 identification cipher algorithm hardware realization system based on finite field - Google Patents

Abstract

The invention belongs to the field of information security and discloses a limited domain-based SM9 identification cryptographic algorithm hardware implementation system, including a register module, a data path module, a bottom control module, a memory module, an auxiliary function module, a random number module and an algorithm function module; The underlying operation of this system implements a modular design, with multiple computing functions and flexible interfaces. While supporting the SM9 upper-layer operation implementation, it can also support the core operation steps of public key cryptography algorithms such as SM2 national cryptographic algorithm and ECDSA. All the computing steps of this system are implemented by hardware, with a small total area and high computing performance. Compared with software implementation, the performance is greatly improved.

Description

A hardware implementation system of SM9 identification cryptographic algorithm based on finite fields

Technical field

The invention belongs to the field of information security, and in particular relates to a hardware implementation system of SM9 identification cryptographic algorithm based on a limited domain.

Background technique

In 1984, the concept of identity cryptographic algorithms was first proposed. In the identification cryptographic algorithm system, the user's private key is calculated by the key generation center based on the master key and user ID, and the user's public key is uniquely determined by the user ID, so the user does not need to use a third party to ensure the authenticity of his public key. sex. The National Secret SM9 algorithm is a public key cryptographic algorithm based on elliptic curve pairs. Its security is based on the bilinear properties of elliptic curve pairs. When the elliptic curve discrete logarithm problem and the extended domain discrete logarithm problem are equally difficult to solve, Elliptic curve pairs can be used to construct an identity cryptographic algorithm that balances security and efficiency.

The SM9 logo cryptographic algorithm is a public key cryptographic algorithm based on bilinear pairing, which eliminates the need for certificate authentication by a third-party organization and is also highly secure. However, since it involves the calculation of elliptic curves and finite fields, the calculation complexity is large and the calculation is slow, which restricts the application of the algorithm. Therefore, it is of great significance to improve the operation speed of SM9 algorithm.

Contents of the invention

In order to solve the above problems, the present invention designs a hardware implementation system of the SM9 identification cryptographic algorithm based on a finite field while complying with the national secret SM9 algorithm standard to realize the fast operation of the SM9 algorithm. The specific technical solution of the present invention's finite field-based SM9 identification cryptographic algorithm hardware implementation system is as follows:

A hardware implementation system for the SM9 identification cryptographic algorithm based on finite fields, including a register module, a data path module, a bottom-level control module, a memory module, an auxiliary function module, a random number module and an algorithm function module;

The register module is used to read the user's configuration information and control information;

The data path module is used to complete various operations on the data involved in the operation, realize the transmission of data between the register and the memory, and perform simple operations on the data, including writing data from the register to the memory and reading data from the memory. , the initial parameters, identification and plaintext data written by the user to the register are transmitted to the memory through the data path module;

The memory module is used to store various types of calculation data, including initial parameters, calculation intermediate values and calculation results;

The underlying control module is used to call the underlying algorithm module to complete various finite field calculations, elliptic curve calculations and encryption operations;

The auxiliary function module is used to implement the cryptographic functions H1/H2 and the key derivation function KDF in the SM9 algorithm, and the key derivation function is used to generate the encryption and decryption keys in the SM9 algorithm;

The random number module is used to generate random numbers between 1 and (N-1) required by the algorithm;

The algorithm function module is used to call other modules to implement various algorithm functions in the SM9 algorithm.

Further, the specific functions of the register module include: the user writes control information and configuration information into the register module, the register module transmits the initial parameters, identification and plaintext data written by the user to the memory module, and then starts the corresponding program according to the control information. Algorithm function operation; if the operation is successful, the register module reads the calculation result from the memory module and transmits it to the user; if the operation fails, the register module transmits the calculation failure signal to the user.

Furthermore, the data path module can realize data transfer operations between different addresses in the memory, including comparing two data, splicing two data head to tail, and shifting the data.

Further, the underlying algorithm module includes a bilinear pairing module, an SM3 operation module and an SM4 operation module. The bilinear pairing module includes the functions of finite field calculation, elliptic curve calculation and bilinear pairing calculation; The SM3 operation module is a hardware-implemented SM3 algorithm function module. The SM3 algorithm is a hash algorithm, suitable for digital signature and verification in SM9 algorithm applications and the generation and verification of message authentication codes; the SM4 operation module is a hardware-implemented SM4 algorithm function module, the SM4 algorithm is a block cipher algorithm, used for public key encryption and decryption in the SM9 algorithm.

Further, the bilinear pairing module includes a prime domain calculation module, a quadratic extended domain operation module, a fourth extended domain operation module, a twelfth extended domain operation module, a quadratic extended domain elliptic curve operation module, and a line function operation. module, the final power operation module and the bilinear pairing calculation state machine;

The prime domain calculation module is used to complete modular operations and elliptic curve point operations in the prime domain;

The secondary expansion operation module is used to implement various operations in the secondary expansion of the prime field after the second expansion, including: modular addition, modular subtraction, modular multiplication, modular inversion and quadratic field element frobenius operations. ;

The quadruple domain expansion operation module is used to implement various operations in the four domain expansions obtained after four expansions of the prime field, including: modular addition, modular subtraction, modular multiplication, modular inversion, and quadratic domain element frobenius operations. ;

The twelve-fold field expansion operation module is used to implement various operations in the twelve-fold field expansion obtained after twelve expansions of the prime field, including: modular multiplication, modular inversion, modular exponentiation and twelve-fold field element frobenius operation; operation

The quadratic extended domain elliptic curve operation module is used to implement various operations of elliptic curves under quadratic extended domain, including: coordinate system conversion of quadratic domain points, quadratic domain point addition, quadratic domain doubling point, quadratic domain point doubling Domain point multiplication and frobenius operation of quadratic domain points; the coordinate transformation of the quadratic domain point refers to the conversion of elliptic curve points in the quadratic domain between the affine coordinate system and the projective coordinate system;

The line function operation module is used to realize the operation of the function g _{U, V} (Q) calculated by R-ate, that is, the calculation of the connecting equation of two elliptic curve points; the calculation process of the function g _{U, V} (Q) Implemented in accordance with the definition defined in the SM9 algorithm standard general principles; during calculation, if the two elliptic curve points are different points and are not infinite points, the result is the equation of a straight line passing through the two points; if the two elliptic curve points are the same point and are not If there is an infinity point, the result is the tangent equation of the elliptic curve passing through that point; if one of the elliptic curve points is the infinity point, the result is the equation of the perpendicular to the x-axis passing through another point;

The final exponentiation module is used to implement the last step in the R-ate pair calculation step, that is

The bilinear pairing calculation state machine is used to control and call each module to complete the calculation of bilinear pairing.

Further, the prime domain calculation module includes a modular addition and subtraction calculation hardware module, a Montgomery modular multiplication hardware module, a modular inverse calculation hardware module and a prime domain elliptic curve calculation module; the modular addition and subtraction calculation hardware module is used to implement the prime domain Modular addition, modular subtraction, and modular operations in the operation; the Montgomery modular multiplication hardware module is used to implement modular multiplication operations in the prime domain, and the Montgomery modular multiplication hardware module is implemented based on the optimized Montgomery modular multiplication algorithm; the modular multiplication hardware module is used to implement modular multiplication operations in the prime domain. The inverse calculation hardware module is used to implement modular inverse operations in the prime domain; the prime domain elliptic curve calculation module is used to implement point addition, point multiplication and check point operations in the prime domain.

Further, the operation steps of the cryptographic function H1/H2 and the key derivation function KDF of the auxiliary function module are all implemented according to the steps in the SM9 algorithm standard; the cryptographic hash function Hv needs to be called in the cryptographic function H1/H2 and the key derivation function KDF. (), the cryptographic hash function Hv() is implemented through the SM3 operation module.

Further, the algorithm functions of the SM9 algorithm include: digital signature generation, digital signature verification, key exchange protocol, public key encryption and public key decryption; the algorithm functions are calculated according to the steps in the SM9 algorithm standard.

The present invention's SM9 identification cryptographic algorithm hardware implementation system based on finite fields has the following advantages:

1. The underlying operation of this system implements a modular design, with multiple computing functions and flexible interfaces. While supporting the SM9 upper-layer operation implementation, it can also support the core operation steps of public key cryptography algorithms such as SM2 national cryptographic algorithm and ECDSA.

2. All the computing steps of this system are implemented by hardware, with a small total area and high computing performance. Compared with software implementation, the performance is greatly improved.

Description of the drawings

Figure 1 is a flow chart of the SM9 digital signature generation algorithm;

Figure 2 is a flow chart of the SM9 digital signature verification algorithm;

Figure 3 is a flow chart of the SM9 key exchange protocol;

Figure 4 is a flow chart of the SM9 public key encryption algorithm;

Figure 5 is a flow chart of the SM9 decryption algorithm;

Figure 6 is an architectural diagram of a hardware implementation system for the limited field-based SM9 identification cryptographic algorithm of the present invention;

Figure 7 is an architectural diagram of a bilinear alignment module of the present invention.

Detailed ways

The present invention will be further described below with reference to specific examples. The present invention provides a hardware implementation system of the SM9 identification cryptographic algorithm based on a finite field to realize the fast operation of the SM9 algorithm while complying with the national secret SM9 identification cryptographic algorithm standard. The embodiment of the present invention demonstrates the architecture of a hardware implementation system for the SM9 identification cryptographic algorithm in a limited domain. This hardware implementation system embodiment follows the national secret SM9 algorithm standard and uses the 256-bit BN curve and R-ate pair recommended by the algorithm standard.

The embodiments of the present invention will be described more clearly below with reference to the accompanying drawings. Of course, the above-mentioned embodiments are only used to explain the present invention and do not limit the scope of the present invention.

As shown in Figure 6, a finite field-based SM9 identification cryptographic algorithm hardware implementation system includes a register module, a data path module, a bottom-level control module, a memory module, an auxiliary function module, a random number module and an algorithm function module.

The register module is used to read the user's configuration information and control information. The user writes control information such as the selection of algorithm functions and configuration information such as data to be calculated into the register module. The register module transmits the initial parameters, identification, plain text data, etc. written by the user to the memory module, and then starts the corresponding algorithm based on the control information. Functional operation; if the operation is successful, the register module reads the calculation result from the memory module and transmits it to the user; if the operation fails, the register module transmits the calculation failure signal to the user.

The data path module is used to complete various operations on the data involved in the operation, realize the transmission of data between the register and the memory, and perform simple operations on the data, including writing data from the register to the memory and reading data from the memory. , the initial parameters, logos, plain text data, etc. written by the user into the register are transmitted to the memory through the data path module. The data path module can also implement data transfer operations between different addresses in the memory, including comparing two data, splicing two data head to tail, shifting data, etc.

The memory module is used to store various types of calculation data, including initial parameters, calculation intermediate values and calculation results;

The underlying control module is used to call the underlying algorithm module to complete various finite field calculations, elliptic curve calculations and encryption operations; the underlying algorithm module includes the functions of a bilinear pairing module, an SM3 operation module, and an SM4 operation module. Among them, the bilinear pairing module is the core calculation module of the SM9 algorithm, including finite field calculation, elliptic curve calculation and bilinear pairing calculation; the SM3 operation module is a hardware-implemented SM3 algorithm function module. The SM3 algorithm is a hash algorithm suitable for It is used for digital signature and verification as well as the generation and verification of message authentication codes in the application of SM9 algorithm; the SM4 operation module is a hardware-implemented SM4 algorithm function module. The SM4 algorithm is a block cipher algorithm used for public key encryption and Decrypt.

The bilinear pairing module is used to implement finite field calculations, elliptic curves and bilinear pairing calculations, and is the core calculation module of the SM9 algorithm. The embodiment of the present invention provides a hardware architecture of a bilinear pairing module, as shown in Figure 7. The bilinear pairing module in this embodiment includes a prime domain calculation module, a quadratic domain expansion operation module, and a quadratic domain expansion module. Operation module, twelfth expansion domain operation module, quadratic expansion elliptic curve operation module, line function operation module, final power operation module and bilinear pair calculation state machine.

The prime domain calculation module is used to complete modular operations and elliptic curve point operations in the prime domain. The prime domain calculation module includes a modular addition and subtraction calculation hardware module, a Montgomery modular multiplication hardware module, a modular inverse calculation hardware module, and a prime domain elliptic curve calculation module. The modular addition and subtraction calculation hardware module is used to implement modular addition, modular subtraction, and modular operations in prime field operations. The Montgomery modular multiplication hardware module is used to implement modular multiplication operations in the prime domain. The Montgomery modular multiplication hardware module is implemented based on the optimized Montgomery modular multiplication algorithm and has higher computing efficiency. The modular inversion calculation hardware module is used to implement modular inversion operations in the prime domain. The prime domain elliptic curve calculation module is used to implement point addition, point multiplication, and check point operations in the prime domain.

The secondary expansion operation module is used to implement various operations in the secondary expansion of the prime field after the second expansion, including: modular addition, modular subtraction, modular multiplication, modular inversion and quadratic field element frobenius operations. .

The quadruple domain expansion operation module is used to implement various operations in the four domain expansions obtained after four expansions of the prime field, including: modular addition, modular subtraction, modular multiplication, modular inversion, and quadratic domain element frobenius operations. .

The twelve-fold field expansion operation module is used to implement various operations in the twelve-fold field expansion obtained after twelve expansions of the prime field, including: modular multiplication, modular inversion, modular exponentiation and twelve-fold field element frobenius Operation.

The quadratic extended domain elliptic curve operation module is used to implement various operations of elliptic curves under quadratic extended domain, including: coordinate system conversion of quadratic domain points, quadratic domain point addition, quadratic domain doubling point, quadratic domain point doubling Domain point multiplication and frobenius operation of quadratic domain points. The coordinate system transformation of quadratic domain points refers to the transformation of elliptic curve points in the quadratic domain between the affine coordinate system and the projective coordinate system.

The line function calculation module is used to implement the R-ate calculation of the functions g _{U, V} (Q) in the calculation, that is, the calculation of the line equation of the two elliptic curve points. The calculation process of function g _{U, V} (Q) is implemented in accordance with the definition in the SM9 algorithm standard general principles; during calculation, if the two elliptic curve points are different points and are not infinite points, the result is a straight line equation passing through the two points; If the elliptic curve points are the same point and are not infinity points, the result is the tangent equation of the elliptic curve passing through that point; if one of the elliptic curve points is an infinity point, the result is the equation of the x-axis perpendicular to the other point. equation.

The final exponentiation module is used to implement the last step in the R-ate pair calculation step, that is

The bilinear pairing calculation state machine is used to control and call each module to complete the calculation of bilinear pairing.

The calculation of bilinear pairs in this embodiment uses the calculation of R-ate pairs on the BN curve. The calculation process is as follows:

π _q is a Frobenius automorphism, π _q : E→E, π _q (x, y)=(x ^q , y ^q ).

E→E,/>

Calculation of R-ate pairs:

Input: point P in the prime field F _p , point Q in the quadratic extended field F _p2 , a=6t+2

Output: element f in the twelve-fold expansion field F _p12 .

Step 1: Set a _L-1 = 1;

Step 2: Set T=Q, f=1;

Step 3: To reduce i from L-2 to 0, execute:

a) Calculate f=f ² ·g _{T, T} (P), T=[2]T;

b) If a _i = 1, calculate f = f·g _{T, Q} (P), T = T + Q;

Step 4: Calculate Q ₁ =π _q (Q),

Step 5: Calculate T＝T+Q ₁ ;

Step 6: Calculate T= _TQ2 ;

Step 7: Calculate

Step 8: Output f.

The auxiliary function module is used to implement the cryptographic function H ₁ /H ₂ and the key derivation function KDF in the SM9 algorithm. The key derivation function KDF is used to generate the encryption and decryption keys in the SM9 algorithm. The operation steps of the cryptographic function H ₁ /H ₂ and the key derivation function KDF are all implemented in accordance with the steps in the SM9 algorithm standard. The cryptographic function H ₁ /H ₂ and the key derivation function KDF need to call the cryptographic hash function H _v (). The SM9 algorithm standard stipulates the use of the cryptographic hash function H _v () approved by the national cryptography management department, such as the SM3 cryptographic hash algorithm. In the embodiment of the invention, it is implemented through the SM3 computing module.

The random number module is used to generate random numbers between 1 and (N-1) required by the algorithm.

The algorithm function module is used to call other modules to implement various algorithm functions in the SM9 algorithm. The algorithm functions of the SM9 algorithm include: digital signature generation, digital signature verification, key exchange protocol, public key encryption, and public key decryption. The algorithm function is calculated according to the steps in the SM9 algorithm standard. The calculation steps of each algorithm are as follows:

1) Digital signature generation algorithm, as shown in Figure 1,

The message to be signed is a bit string M. In order to obtain the digital signature (h, S) of the message M, user A as the signer should implement the following operation steps:

Step 1: Calculate the element g=e(P ₁ ,P _pub-s ) in the group G _T by calling the bilinear pairing module;

Step 2: Generate random number r∈[1,N-1] through the random number module;

Step 3: Calculate the element w= ^gr in the group G _T through the bilinear pairing module, and convert the data type of w into a bit string;

Step 4: Calculate the integer h = H ₂ (M||w,N) through the auxiliary function module, where H ₂ is the cryptographic function in the SM9 algorithm;

Step 5: Calculate the integer l=(r-h)mod N through the prime field calculation module of the sub-module of the bilinear alignment module. If l=0, return to step 2;

Step 6: Calculate the element S=[l]d _SA in group G ₁ through the prime field calculation module;

Step 7: Convert S and h into byte strings, and the signature of message M is (h, S).

2) Digital signature verification algorithm, as shown in Figure 2,

In order to verify the received message M’ and its digital signature (h’, S’), user B as the verifier should implement the following operation steps:

Step 1: Check whether h’∈[1,N-1] is established. If not, the verification fails;

Step 2: Convert the data type of S' to a point on the elliptic curve, and check whether S'∈G ₁ is established. If not, the verification fails;

Step 3: Calculate the element g=e(P ₁ ,P _pub-s ) in the group G _T by calling the bilinear pairing module;

Step 4: The calculation module calculates the element t=g ^h' in the group G _T ;

Step 5: Calculate the integer h ₁ =H ₁ (ID _A ||hid,N) through the auxiliary function module, where H ₁ is the cryptographic function in the SM9 algorithm;

Step 6: Calculate the element P in group G ₂ = [h ₁ ]P ₂ +P _pub-s ;

Step 7: Calculate the element u=e(S',P) in the group G _T by calling the bilinear pairing module;

Step 8: Calculate the element w'=u·t in the group G _T , and convert the data type of w' into a bit string;

Step 9: Calculate the integer h ₂ =H ₂ (M'||w',N) through the auxiliary function module, and check whether h ₂ =h' is true through the data path module. If it is true, the verification passes; otherwise, the verification fails.

3) Key exchange protocol, as shown in Figure 3,

Users A and B negotiate to obtain the length of the key data, which is klen bits. User A is the initiator and user B is the responder. In order to obtain the same key, both users A and B should implement the following operation steps:

User A:

Step A1: Calculate the element Q _B =[H ₁ (ID _B ||hid,N)]P ₁ +P _pub-e in group G ₁ ;

Step A2: Generate random number r _A ∈[1,N-1];

Step A3: Calculate the element _RA = [r _A ]Q _B in group G ₁ ;

Step A4: Send R _A to user B;

User B:

Step B1: Calculate the element Q _A in group G ₁ =[H ₁ (ID _A ||hid,N)]P ₁ +P _pub-e ;

Step B2: Generate random number r _B ∈[1,N-1];

Step B3: Calculate the element R _B =[r _B ]Q _A in group G ₁ ;

Step B4: Verify whether R _A ∈ G ₁ is established. If not, the negotiation fails; otherwise, call the bilinear pairing _module to calculate the elements g ₁ =e(R _A ,de _B ), g ₂ =e(P _pub-e ,P ₂ ) ^rB , g ₃ =g ₁ ^rB , convert the data types of g ₁ , g ₂ , g ₃ into bit strings;

Step B5: Convert the data types of R _A and R _B into bit strings, and calculate SK _B =KDF(ID _A ||ID _B ||R _A ||R _B ||g ₁ ||g ₂ | through the auxiliary function module |g ₃ , klen), KDF is the key derivation function in the SM9 algorithm;

(Optional) Step B6: Calculate S _B =Hash(0x82||g ₁ ||Hash(g ₂ ||g ₃ ||ID _A ||ID _B || _RA ||R _B ) by calling the SM3 operation module );

Step B7: Send _RB and (optional) _SB to user A;

User A:

Step A5: Verify whether R _B ∈G ₁ is established. If not, the negotiation fails; otherwise, call the bilinear pairing module to calculate the element g ₁ '=e(P _pub-e ,P ₂ ) ^rA , g ₂ in the group G _T '=e(R _B ,de _A ), g ₃ '=(g ₂ ') ^rA , convert the data types of g ₁ ', g ₂ ', g ₃ ' into bit strings;

Step A6: Convert the data types of R _A and R _B into bit strings, (optional) calculate S ₁ =Hash(0x82||g ₁ '||Hash(g ₂ '||g ₃ ' by calling the SM3 operation module ||ID _A ||ID _B ||R _A ||R _B )), and check whether S ₁ = S _B is established through the data path module. If the equation is not established, the key confirmation from B to A fails;

Step A7: Calculate SK _A =KDF(ID _A ||ID _B ||RA ||R _B ||g ₁ '||g ₂ '||g ₃ ' _, klen) through the auxiliary function module;

(Optional) Step A8: Calculate S _A =Hash(0x83||g ₁ '||Hash(g ₂ '||g ₃ '||ID _A ||ID _B || _RA || by calling the SM3 operation module) R _B )), and sends S _A to user B.

User B:

(Optional) Step B8: Calculate S ₂ =Hash(0x83||g ₁ ||Hash(g ₂ ||g ₃ ||ID _A ||ID _B || _RA ||R _B ) by calling the SM3 operation module ), and check S ₂ through the data path module

=S Whether _A is established. If the equation is not established, the key confirmation from A to B fails.

4) Public key encryption algorithm, as shown in Figure 4,

The message to be sent is a bit string M, mlen is the bit length of M, K ₁ _len is the bit length of the key K ₁ in the block cipher algorithm, K ₂ _len is the key K ₂ in the function MAC(K ₂ ,Z) Bit length.

In order to encrypt plaintext M to user B, user A as the encryptor should implement the following operation steps:

Step 1: Calculate the element Q _B =[H ₁ (ID _B ||hid,N)]P ₁ +P _pub-e in group G ₁ ;

Step 2: Generate random number r∈[1,N-1];

Step 3: Calculate element C ₁ =[r]Q _B in group G ₁ and convert the data type of C ₁ into a bit string;

Step 4: Calculate the element g=e(P _pub-e ,P ₂ ) in the group G _T by calling the bilinear pairing module;

Step 5: Calculate the element w= ^gr in the group G _T and convert the data type of w into a bit string;

Step 6: Calculate according to the method of encrypting plaintext:

a) If the method of encrypting plaintext is a sequence cipher algorithm based on a key derivation function, then

1) Calculate the integer klen=mlen+K ₂ _len, and calculate K=KDF(C ₁ ||w||ID _B ,klen) through the auxiliary function module. Let K ₁ be the leftmost mlen bit of K, and K ₂ be the remaining K ₂ _len bits. Use the data path module module to determine whether K ₁ is an all-0 bit string. If so, return to step 2;

2) Calculate C ₂ =M⊕K ₁ through the data path module.

b) If the method of encrypting the plaintext is a block cipher algorithm combined with a key derivation function, then

1) Calculate the integer klen=K ₁ _len+K ₂ _len, and calculate K=KDF(C ₁ ||w||ID _B ,klen) through the auxiliary function. Let K ₁ be the leftmost K ₁ _len of K

bits, K ₂ is the remaining K ₂ _len bits, and the data path module module determines whether K ₁ is an all-0 bit string. If so, return to step 2;

2) Call the SM4 operation module to calculate C ₂ =Enc(K ₁ ,M).

Step 7: Call the SM3 operation module to calculate C ₃ =MAC (K ₂ ,C ₂ );

Step 8: Output the ciphertext C=C ₁ ||C ₃ ||C ₂ .

5) Decryption algorithm, as shown in Figure 5,

mlen is the bit length of C ₂ in ciphertext C=C ₁ ||C ₃ ||C ₂ , K ₁ _len is the bit length of key K ₁ in the block cipher algorithm, K ₂ _len is the function MAC (K ₂ ,Z ) the bit length of key K ₂ .

In order to decrypt C, user B as the decryptor should implement the following operation steps:

Step 1: Get the bit string C ₁ from C, convert the data type of C ₁ to a point on the elliptic curve, verify whether C ₁ ∈ G ₁ is true, if not, report an error and exit;

Step 2: Calculate the element w'=e(C ₁ , de _B ) in group T through the bilinear pairing module, and convert the data type of w' into a bit string;

Step 3: Calculate according to the method of encrypting plaintext:

a) If the method of encrypting plaintext is a sequence cipher algorithm based on a key derivation function, then

1) Calculate the integer klen=mlen+K ₂ _len, and calculate K'=KDF(C ₁ ||w'||ID _B ,klen) through the auxiliary function. Let K ₁ ' be the leftmost mlen of K'

bits, K ₂ ' is the remaining K ₂ _len bits, and the data path module determines whether K ₁ ' is an all-0 bit string. If so, an error is reported and exits;

2) Calculate M'=C ₂ ⊕K ₁ ' through the data path module.

b) If the method of encrypting the plaintext is a block cipher algorithm combined with a key derivation function, then

1) Calculate the integer klen=K ₁ _len+K ₂ _len, and calculate K' through the auxiliary function

=KDF(C ₁ ||w'||ID _B ,klen). Let K ₁ ' be the leftmost K ₁ _len of K'

bits, K ₂ ' is the remaining K ₂ _len bits, and the data path module determines whether K ₁ ' is an all-0 bit string. If so, an error is reported and exits;

2) Call the SM4 operation module to calculate M'=Dec(K ₁ ',C ₂ ).

Step 4: Call the SM3 operation module to calculate u=MAC(K ₂ ',C ₂ ), take out the bit string C ₃ from C, and use the data path module to determine whether u=C ₃ is true. If not, an error will be reported and exit;

Step 5: Output plaintext M’.

System parameter selection:

The selection of system parameters in the embodiment follows the system parameter selection rules in the standard GM/T 0044.1-2016SM9 general principles of identification cryptographic algorithms. The elliptic curve used in the embodiment of the present invention is a 256-bit BN curve recommended by the algorithm standard. The curve equation of the selected BN curve is as follows:

E: y ² = x ³ + b;

Among them, x and y are the abscissa and ordinate of the elliptic curve respectively, and b is a constant parameter that is not 0. This parameter can be customized. The embedding degree of the curve k=12, and the order N of the curve is also a prime number. The main parameters of the curve include the base domain feature q, the curve order N, and the trace tr of Frobenius mapping. The above parameters can be determined by the parameter t:

q(t)＝36t ⁴ +36t ³ +24t ² +6t+1;

N(t)＝36t ⁴ +36t ³ +18t ² +6t+1;

tr(t)=6t ² +1;

Since the embedding degree of the elliptic curve is selected k = 12, the bilinear pairing operation must be calculated in twelve expansions. The present invention performs tower expansion on the finite field according to the method described in the SM9 algorithm standard. The tower expansion method is as follows:

The base domain is expanded twice into a quadratic extended domain, and the reduced polynomial is: x ² -α, α=-2;

The quadratic expansion domain is expanded into a fourth expansion domain after quadratic expansion, and the reduced polynomial is: x ² -u, u ² =α;

The quadruple expansion field is expanded into a twelfth expansion field through three expansions, and the reduced polynomial is: x ³ -v, v ² =u;

All the numbers involved in the calculation in the SM9 algorithm must be in the constructed finite field and its extended domain, and the points involved in the calculation must be on the constructed BN curve. During the operation, the generator P ₁ of group G ₁ and the generator P ₂ of group G ₂ need to be given.

The embodiment of the present invention is implemented through Verilog HDL. The SM9 algorithm hardware accelerator implemented according to the SM9 identification cryptographic algorithm hardware implementation system architecture provided by the present invention has been tested and found to be consistent with the SM9 algorithm standard and the provided calculation examples. Table 1 shows the comparison between the computational efficiency of the software implementation of the SM9 algorithm and the tested computational efficiency of this embodiment.

Table 1 Comparison of computational efficiency between SM9 software and this embodiment

According to the data in Table 1, it can be seen that the SM9 algorithm hardware implementation provided by the present invention requires only about 1/10 to 1/9 of the calculation time required for algorithm function calculation, and the calculation speed is significantly improved compared to the software implementation. .

It is understood that the present invention has been described through some embodiments. Those skilled in the art know that various changes or equivalent substitutions can be made to these features and embodiments without departing from the spirit and scope of the present invention. In addition, the features and embodiments may be modified to adapt a particular situation and material to the teachings of the invention without departing from the spirit and scope of the invention. Therefore, the present invention is not limited to the specific embodiments disclosed here, and all embodiments falling within the scope of the claims of the present application are within the scope of protection of the present invention.

Claims (5)

1. A hardware implementation system for the SM9 identification cryptographic algorithm based on finite fields, including a register module, a data path module, a bottom-level control module, a memory module, an auxiliary function module, a random number module and an algorithm function module; it is characterized by: The register module is used to read the user's configuration information and control information; The data path module is used to complete various operations on the data involved in the operation, realize the transmission of data between the register and the memory, and perform simple operations on the data, including writing data from the register to the memory and reading data from the memory. , the initial parameters, identification and plaintext data written by the user to the register are transmitted to the memory through the data path module; The memory module is used to store various types of calculation data, including initial parameters, calculation intermediate values and calculation results; The underlying control module is used to call the underlying algorithm module to complete various finite field calculations, elliptic curve calculations and encryption operations; The underlying algorithm module includes a bilinear pairing module, an SM3 operation module and an SM4 operation module. The bilinear pairing module includes the functions of finite field calculation, elliptic curve calculation and bilinear pairing calculation; the SM3 operation module It is a hardware-implemented SM3 algorithm function module. The SM3 algorithm is a hash algorithm, suitable for digital signature and verification in SM9 algorithm applications and the generation and verification of message authentication codes; the SM4 operation module is a hardware-implemented SM4 algorithm. Function module, the SM4 algorithm is a block cipher algorithm, used for public key encryption and decryption in the SM9 algorithm; The bilinear pairing module includes a prime field calculation module, a quadratic extended domain operation module, a fourth extended domain operation module, a twelfth extended domain operation module, a quadratic extended domain elliptic curve operation module, and a line function operation module. Finally, Power operation module and bilinear pairing calculation state machine; The prime domain calculation module is used to complete modular operations and elliptic curve point operations in the prime domain; The prime domain calculation module includes a modular addition and subtraction calculation hardware module, a Montgomery modular multiplication hardware module, a modular inverse calculation hardware module and a prime domain elliptic curve calculation module; the modular addition and subtraction calculation hardware module is used to implement prime domain operations. Modular addition, modular subtraction, and modular operations; the Montgomery modular multiplication hardware module is used to implement modular multiplication operations in the prime domain, and the Montgomery modular multiplication hardware module is implemented based on the optimized Montgomery modular multiplication algorithm; the modular inverse calculation hardware The module is used to implement modular inverse operations in the prime domain; the prime domain elliptic curve calculation module is used to implement point addition, point multiplication and check point operations in the prime domain; The secondary expansion operation module is used to implement various operations in the secondary expansion of the prime field after the second expansion, including: modular addition, modular subtraction, modular multiplication, modular inversion and quadratic field element frobenius operations. ; The quadratic domain expansion operation module is used to implement various operations in the four domain expansions obtained after four expansions of the prime field, including: modular addition, modular subtraction, modular multiplication, modular inversion and quartic domain element frobenius Operation; the twelve-fold field expansion operation module is used to implement various operations in the twelve-fold field expansion obtained after twelve expansions of the prime field, including: modular multiplication, modular inversion, modular exponentiation and twelve-fold field Element frobenius operation; The quadratic extended domain elliptic curve operation module is used to implement various operations of elliptic curves under quadratic extended domain, including: coordinate system conversion of quadratic domain points, quadratic domain point addition, quadratic domain doubling point, quadratic domain point doubling Domain point multiplication and frobenius operation of quadratic domain points; the coordinate transformation of the quadratic domain point refers to the conversion of elliptic curve points in the quadratic domain between the affine coordinate system and the projective coordinate system; The line function operation module is used to realize the operation of R-ate on the functions g _{U, V} (Q) in the calculation, that is, the calculation of the line equation of the two elliptic curve points; the calculation process of the function g _{U, V} (Q) is as follows The implementation is defined in the SM9 algorithm standard general principles; during calculation, if the two elliptic curve points are different points and neither are infinite points, the result is the equation of a straight line passing through the two points; if the two elliptic curve points are the same point and neither are infinite If there is a far point, the result is the tangent equation of the elliptic curve passing through that point; if one of the elliptic curve points is an infinity point, the result is the equation of the perpendicular to the x-axis passing through another point; The final exponentiation module is used to implement the last step in the R-ate pair calculation step, that is The bilinear pairing calculation state machine is used to control and call each module to complete the calculation of bilinear pairing; The auxiliary function module is used to implement the cryptographic function H ₁ /H ₂ and the key derivation function KDF in the SM9 algorithm, and the key derivation function is used to generate the encryption and decryption keys in the SM9 algorithm; The random number module is used to generate random numbers between 1 and (N-1) required by the algorithm; The algorithm function module is used to call other modules to implement various algorithm functions in the SM9 algorithm. 2. The SM9 identification cryptographic algorithm hardware implementation system based on limited fields according to claim 1, characterized in that the specific functions of the register module include: the user writes control information and configuration information into the register module, and the register module writes the user The written initial parameters, identification and plain text data are transferred to the memory module, and then the corresponding algorithm function operation is started based on the control information; if the operation is successful, the register module reads the calculation result from the memory module and transmits it to the user; if the operation fails, the register module The module transmits the calculation failure signal to the user. 3. The SM9 identification cryptographic algorithm hardware implementation system based on finite fields according to claim 1, characterized in that the data path module can realize data transfer operations between different addresses in the memory, including transferring two data. Compare, splice the two data head to tail and shift the data. 4. The finite field-based SM9 identification cryptographic algorithm hardware implementation system according to claim 1, characterized in that the operation steps of the cryptographic functions H1/H2 and the key derivation function KDF of the auxiliary function module are all in accordance with the SM9 algorithm standard. Implementation in steps; the cryptographic function H1/H2 and the key derivation function KDF need to call the cryptographic hash function Hv(), and the cryptographic hash function Hv() is implemented through the SM3 operation module. 5. The finite field-based SM9 identification cryptographic algorithm hardware implementation system according to claim 1, characterized in that the algorithm functions of the SM9 algorithm include: digital signature generation, digital signature verification, key exchange protocol, public key encryption and public key decryption; the algorithm function implements the calculation according to the steps in the SM9 algorithm standard.