CN101739233B - Semi-sequential input Galois multiplier and executing method thereof - Google Patents

Abstract

The invention relates to a semi-sequential input Galois (GF2n) multiplier and an executing method thereof. The GF(2n) multiplier comprises two GF(2m) multipliers of single base field, at least one constant multiplier and a plurality of single GF(2m) summator. High-order and low-order elements of the complex field of one of two operands of the GF(2n) multiplier are respectively parallelly input to the two base field GF(2m) multipliers, but high-order and low-order elements of the complex field of the other operand are sequentially input to the two base field GF(2m) multipliers, and a plurality of GF(2m) part of multiplication results are generated. The plurality of GF(2m) part of multiplication results are calculated by the constant multiplier and the plurality of single GF(2m) summators to generate a high-order element and a low-order element in a multiplication result of GF((2m)2), and then the high-order element and the low-order element are returned to the GF(2n) field by mapping, thereby completing the GF(2n) multiplication.

Description

Galois multiplier and its manner of execution partly imported in proper order

Technical field

The invention relates to the Galois multiplier (Galois Field Multiplier) and its manner of execution of a kind of (Semi-Sequential) partly in proper order input.

Background technology

(Galois Counter Mode-AdvancedEncryption Standard, GCM-AES) technology has been used for Internet Protocol security (IPsec) environment to Galois count mode-advanced encryption standard.Also adopt the GCM-AES algorithm as preset encryption and decryption computing among network (Ethernet) second layer safety standard MACsec very much in second.And used Galois field (Galois Field) GF (2 in the GCM-AES algorithm ¹²⁸) multiplying realize a conspicuous order function (Hash Function), this makes the hardware cost that on hardware is realized, significantly improves GCM-AES.Single GF (2 ¹²⁸) hardware size of multiplier just is equal to one 128 AES core engine.When being incorporated into the Ethernet mac controller to the MACsec controller that has GCM-AES, the cost that GCM-AES influenced is higher than regular meeting.

GF (2 ⁿ) be a finite field (Finite Field), the defined space of original (Primitive) polynomial expression by n rank has 2 ⁿIndividual element, each unit have n position, and this n position is exactly the polynomial coefficient of this element:

b ₀+b ₁x+…+b _n-1x ^n-1

B wherein _iBe the element among the GF (2), just 0 or 1.Suppose to constitute GF (2 ⁿ) the original polynomial expression in space is g (x), then GF (2 ⁿ) the element multiplication can be considered two steps: at first, two elements carry out the general polynomial multiplication earlier; And then the deconv that obtains got its remainder with g (x).And GF (2 ⁿ) the element additive operation, logically just be equal to the XOR computing of n position.

When n is a very big positive integer, for example 128, then GF (2 ⁿ) multiplication need pay very high computing cost.So, can use compound (Composite Field) to reduce computational complexity usually.Compound mathematical symbolism method is GF ((2 ^m) ^k), km=n wherein, m, k are all positive integer.If explain, then be at GF (2 with script with the figure place of element ⁿ) n bit plain, convert k at GF (2 ^m) in the m bit plain because km=n, so still n place value on the whole.And in compound, GF (2 ^m) be exactly a substrate field (Ground Field).Will be with an element from GF (2 ⁿ) the field GF ((2 that videos ^m) ^k), need the polynomial expression of three indispensabilities, be respectively construction GF (2 ⁿ) a required g (x), also need the original polynomial expression p (x) on m rank and the original polynomial expression r (x) on k rank, wherein the polynomial coefficient of p (x) belongs to GF (2), and the coefficient of r (x) belongs to GF (2 ^m).

Then, the theory of utilizing Christof Paar to be proposed again just can find the matrix M of a n * n, with element from GF (2 ⁿ) the space GF ((2 that videos ^m) ^k) space, and its inverse matrix M ^-1Then can be again with element from GF ((2 ^m) ^k) GF (2 videos back ⁿ).In polynomial expression, the A element is at GF (2 ⁿ) space is:

A(x)＝a ₀+a ₁x+…+a _n-1x ^n-1 a _i∈GF(2)，

And the GF ((2 that videos ^m) ²) compound after, A can be expressed as:

A(x)＝a ₀+a ₁x a _i∈GF(2 ^m)。

And compound multiplying also is the same principle, carries out general polynomial multiplication earlier, gets remainder again.

The correlation technique that proposes Galois multiplier has a lot.For example, United States Patent (USP) 4,251,875 disclose a kind of Galois multiplier framework of general usefulness.Adopt single GF (2 ^m) multiplier architecture, import two operands in proper order, accomplish GF (2 ⁿ) multiplying, wherein m is the multiple of n.United States Patent (USP) 7,113, the Galois multiplier framework of 968 exposure is to design with another polynomial expression of two polynomial expression patterns computing (Modulo).

And the Galois multiplier framework that United States Patent (USP) 7,133,889 discloses is as shown in Figure 1, is to adopt single substrate field GF (2 ^m) multiplier architecture, and use the Karatsuba-Ofman operation method to carry out multiplying.United States Patent (USP) 6,957, polynomial method is disassembled in the Galois multiplier framework utilization of 243 exposure, one of them operand A (x) is imported in proper order, i.e. sequence A ₀(x), A ₁(x) ..., A _T-1(x) import in proper order; And another operand b (x) imports abreast, carries out multiplying, and is as shown in Figure 2.

In recent years, Galois field GF (2 ⁿ) in error control coding and the medium field of cryptography by a large amount of uses, error coded partly has Reed-Solomon sign indicating number that masses know, reflected code (Cyclic Code) etc.Cryptography partly then has elliptic curve cipher system, AES and GCM etc.Therefore, the hardware realization framework that need design reduction GCM-AES, keep the processing power of Gigabit level and be applicable to the Galois multiplier of Network Transmission environment is arranged.

Summary of the invention

In the enforcement example that the present invention disclosed, a kind of Galois multiplier and manner of execution of partly importing in proper order can be provided.

Implement in the example one, what disclosed relates to a kind of partly Galois multiplier of input in proper order, is used for carrying out Galois field GF (2 ⁿ) the multiplication of two operands (Operand), n is a positive even numbers.This Galois GF (2 ⁿ) multiplier can comprise the GF (2 of two single substrate fields ^m) multiplier, at least one constant multiplier and a plurality of single GF (2 ^m) totalizer, n=2m, n, m are all positive integer.GF (2 ⁿ) compound the high-order (High-order) of two one of them operand of operand of multiplication distinguishes parallel input two single substrate field GF (2 so far with low order (Low-order) element ^m) multiplier, and compound high-order and low order element of another operand are imported two single substrate field GF (2 so far in proper order ^m) multiplier, and produce a plurality of GF (2 ^m) part multiplication result (Partial Product); And these a plurality of GF (2 ^m) the part multiplication result again through a plurality of therewith GF (2 of at least one constant multiplier thus ^m) totalizer, produce GF ((2 ^m) ²) multiplication result in a higher order element and a low order element, higher order element in this multiplication result and low order element are also got back to GF (2 through reflection ⁿ), and accomplish this GF (2 ⁿ) multiplication.

In another implemented example, what disclosed related to a kind of Galois GF (2 ⁿ) the partly input data method in proper order of multiplication.The method comprises: with GF (2 ⁿ) two operands of multiplication are from GF (2 ⁿ) video to GF ((2 ^m) ²), obtain compound element; And compound the high-order of one of them operand and low order element are parallel respectively inputs to two substrate field GF (2 ^m) multiplier, and compound element of another operand is imported two substrate field GF (2 so far in proper order ^m) multiplier.

Implement in the example manner of execution that relates to a kind of Galois multiplication of partly importing in proper order that is disclosed at another.The method comprises: with GF (2 ⁿ) two operands of multiplication are from GF (2 ⁿ) GF ((2 videos ^m) ²), obtain compound element, compound high-order and the parallel respectively GF (2 that inputs to two substrate fields of low order element of one of them operand ^m) multiplier, and compound high-order and low order element of another operand are imported the GF (2 of two substrate fields so far in proper order ^m) multiplier; With GF (2 ⁿ) multiplication is divided into a plurality of GF (2 ^m) the part multiplying; And with these two substrate field GF (2 ^m) multiplier, at least one constant multiplication (Constant Multiplication) and a plurality of GF (2 ^m) addition carries out this a plurality of GF (2 ^m) the part multiplying, and produce a higher order element and the low order element in the multiplication result.

Description of drawings

Now cooperate the following icon, implement the detailed description and the claim of example, will on address further feature of the present invention and advantage and be specified in after, wherein:

Fig. 1 is an a kind of example schematic of Galois multiplier.

Fig. 2 is an example schematic of another kind of Galois multiplier.

Fig. 3 is an example schematic of the Galois multiplier framework partly imported in proper order, and with disclosed some to implement example consistent.

Fig. 4 is the exemplary flowchart that the Galois multiplication partly imported is in proper order carried out, and consistent with the enforcement example of some exposure of the present invention.

Fig. 5 explains Galois field multiplying how to accomplish a m position with a hard-wired example of Mace Te Weiduo (Mastrivito) multiplier, and consistent with the enforcement example of some exposure of the present invention.

Fig. 6 explains that one of them operand of Galois multiplication is the situation than the low frequency variable, and consistent with the enforcement example of some exposure of the present invention.

Fig. 7 is the substrate field GF (2 among Fig. 3 ^m) an example configuration diagram realizing with Mace Te Weiduo (Mastrivito) multiplier of multiplier, and consistent with the enforcement example of some exposure of the present invention.

Fig. 8 is that computing and the product matrix in compound the space of integration map 7 is an example configuration diagram of the Galois multiplier after the single matrix conversion computing, and consistent with the enforcement example of some exposure of the present invention.

Embodiment

The present invention is directed to and participate in GF (2 ⁿ) one of them element of multiplying is low frequency variable situation, and the low frequency variable is imported in a parallel manner, the high frequency variable is imported with mode in proper order, and utilizes GF ((2 ^m) ²) compound format of field realize a GF (2 ⁿ) multiplier, wherein GF (2 ⁿ) original polynomial expression be g (x), GF (2 ^m) original polynomial expression be p (x).The low frequency variable similarly is the GHASH computing in the GCM pattern, and it participates in the H value of GF multiplying, only can follow secret key K to change, and the renewal frequency of actual application environment secret key K is very low; Wherein, H be via in the expression formula of authenticated encryption with secret key K to be that 0 block is encrypted the value that obtains totally, also be one of them input of three inputs of GHASH computing, n is a positive even numbers.

In the enforcement example of this exposure, to adopt r (x)=r ₀+ x+x ²This polynomial expression is that example forms GF ((2 ^m) ²) space, wherein r ₀Be GF2 ^m) in element, and make r (x) at GF (2 ^m) in satisfy primary characteristic (Primitivity).Suppose that A and B are GF (2 ⁿ) element, at the GF ((2 that videos ^m) ²) after, its polynomial repressentation method is respectively a ₀+ a ₁X and b ₀+ b ₁X, wherein { a ₀, a ₁, b ₀, b ₁∈ GF (2 ^m), and b ₁Be the inferior coefficient of x item, just GF ((2 ^m) ²) in high-order GF (2 ^m) element.And b ₀Be the low order element, a ₁And a ₀Low-order and high-order relation also be like this.Then its multiplication can be expressed as:

A×B＝(a ₀+a ₁x)(b ₀+b ₁x)modr(x)

＝a ₀b ₀+(a ₁b ₀+a ₀b ₁)x+a ₁b ₁x ²modr(x)

＝(a ₀b ₀+a ₁b ₁r ₀)+(a ₁b ₀+a ₁b ₁+a ₀b ₁)x

Following formula a ₁b ₀+ a ₁b ₁+ a ₀b ₁Its value is exactly the higher order element in the multiplication result, and a ₀b ₀+ a ₁b ₁r ₀Its value is the low order element.

Fig. 3 is an example schematic of the Galois multiplier framework partly imported in proper order, and with disclosed some to implement example consistent.With reference to figure 3, this hard-wired Galois multiplier framework is carried out GF (2 ⁿ) two operands in lining, i.e. A and B, multiplying to produce its product (Product) 330.As can beappreciated from fig. 3, this Galois multiplier framework can be used the GF (2 of two single substrate fields ^m) multiplier 301-302, at least one constant multiplier 311 and a plurality of single GF (2 ^m) totalizer, as 321 to 323, realize the multiplying of GF (2n), wherein n=2m.

GF (2 ⁿ) compound the GF ((2 of one of them operand B of two operands of multiplication ^m) ²) high-order and the parallel respectively GF2 that inputs to the substrate field of low order element ^m) multiplier 301-302, and compound the GF ((2 of another operand A ^m) ²) high-order and the low order element GF (2 that inputs to the substrate field in proper order ^m) multiplier 301-302, to produce a plurality of GF (2 ^m) the part multiplication result, for example comprise a ₀b ₀, a ₁b ₁, a ₁b ₀, and a ₀b ₁And these a plurality of GF (2 ^m) the part multiplication result again via constant multiplier 311 and a plurality of GF (2 ^m) totalizer, as 321 to 323, produce GF ((2 ^m) ²) multiplication result in a higher order element and a low order element; Higher order element in this multiplication result and low order element are also got back to GF (2 through reflection ⁿ), and accomplish this GF (2 ⁿ) multiplication.

This Galois multiplier framework also can comprise an input operand projection instrument (Input OperandMapper), with GF (2 ⁿ) each operand GF ((2 that videos earlier ^m) ²) compound in, and obtain two corresponding GF (2 ^m) element, i.e. compound the high-order and low order two elements of this operand.

Below specify the execution of how arranging in pairs or groups of each assembly in this Galois multiplier, to accomplish this GF (2 ⁿ) multiplying.

With reference to figure 3, whole GF (2 ⁿ) the process description carried out of multiplication following.Carry out GF (2 ⁿ) two input operands (Input Operand) of multiplication, i.e. A and B can be earlier through the computing 333a of a reflection to compound, with operand A and operand B from GF (2 ⁿ) compound GF ((2 videos ^m) ²), obtain compound element.Wherein, it (is b that higher order element after operand B changes and low order element are designated as InputB_CF_H respectively ₁) with InputB_CF_L (be b ₀); And after the operand A conversion, the sequence that higher order element and low order element are imported in proper order is designated as the InputA_CF sequence.Higher order element InputB_CF_H and the parallel respectively GF (2 that inputs to the substrate field of low order element InputB_CF_L after the operand B conversion ^m) multiplier 301 and 302; And two compound elements of InputA_CF (are a ₁With a ₀) then be the GF (2 that inputs to the substrate field in proper order ^m) multiplier 301 and 302.

Suppose that the initial value of buffer 341 and 342 content is all 0, and the mode imported in proper order via device 333b in proper order of InputA_CF sequence is input a earlier ₁Import a again ₀, then the execution flow process of computing is at first importing a ₁And via the GF (2 of substrate field ^m) multiplier 301 and 302, calculate a respectively ₁b ₁And a ₁b ₀Then, the GF (2 of substrate field ^m) the output a of multiplier 301 ₁b ₁Via constant multiplier 311, be multiplied by constant r ₀After, obtain a ₁b ₁r ₀Utilize control signal control-2, in the buffer 341 of depositing, in other words, buffer 341 these temporary constantly contents are a ₁b ₁r ₀And a ₁b ₀And a ₁b ₁At process GF (2 ⁿ) element additive operation XOR after, utilize control signal control-1, in the buffer 342 of depositing, promptly these temporary constantly contents of buffer 342 are a ₁b ₀+ a ₁b ₁Then import a ₀And via compound GF ((2 ^m) ²) multiplier 301 and 302, calculate a respectively ₀b ₀And a ₀b ₁

Utilize control signal control-2 then, let a ₀b ₀Previous temporary value a with buffer 341 ₁b ₁r ₀Through GF (2 ⁿ) element additive operation XOR after obtain a ₀b ₀+ a ₁b ₁r ₀And control signal control-1 selects a ₀b ₁Previous value process GF (2 with buffer 342 ⁿ) element additive operation XOR after, obtain a ₁b ₀+ a ₁b ₁+ a ₀b ₁At last, the content of buffer 342 and the content image of buffer 341 are got back to GF (2 ⁿ), shown in label 350, promptly accomplish a GF (2 ⁿ) multiplication.

Hold above-mentionedly, Fig. 4 is the exemplary flowchart that the Galois multiplication partly imported is in proper order carried out, and consistent with the enforcement example of some exposure of the present invention.With reference to the example flow process of figure 4, at first, with GF (2 ⁿ) two operands of multiplication, i.e. A and B are from GF (2 ⁿ) GF ((2 videos ^m) ²), obtain compound element, shown in step 410.One of them operand, B for example, compound high-order and the parallel respectively GF (2 that inputs to two substrate fields of low order element ^m) multiplier; And compound element of another operand is imported the GF (2 of two substrate fields so far in proper order ^m) multiplier, shown in step 420.

In other words, the execution Galois GF (2 of this exposure ⁿ) in the multiplication, the mode of importing two operand data be with partly in proper order input data method 412 carry out, promptly comprise step 410 and step 420.In step 420, input low order element behind the order of input and the unrestricted higher order element of input earlier in proper order, or import higher order element behind the input low order element earlier, the both is applicable to the partly input method in proper order of this exposure.

After the two operand data inputs, with GF (2 ⁿ) multiplication is divided into a plurality of GF (2 ^m) the part multiplying, shown in step 430.GF (2 with two substrate fields ^m) multiplier, at least one constant multiplication and a plurality of GF (2 ^m) addition carries out this a plurality of GF (2 ^m) the part multiplying, and produce a higher order element and the low order element in the multiplication result, shown in step 440.

At last, with the higher order element in this multiplication result therewith low order element reflection get back to GF (2 ⁿ), to accomplish a GF (2 ⁿ) multiplication, shown in step 450.

GF (2 ^m) multiplier can use the framework of Mace Te Weiduo (Mastrivito) multiplier to realize, explain as after.Suppose two GF (2 ^m) m-tuple elements (m-tuple) representation of element be respectively A [m-1:0]=[a ₀a ₁... a _M-1], B [m-1:0]=[b ₀b ₁... b _M-1], then the multiplier computing C=A [m-1:0] of Mace Te Weiduo (Mastrovito) * B [m-1:0] can be expressed as

Z wherein _BBe called product matrix (Product Matrix), and the value of this matrix is z _{I, j}=f _{I, j}(b ₀, b ₁..., b _M-1).

$f_{i,j}=\left\{\begin{array}{ccc}{b}_i& j=0& i=0,...,m-1\\ u(i-j)b_{i-j}+\underset{i=0}{\overset{j-1}{\mathrm{\Σ}}}{q}_{j-1-t,i}{b}_{n-1-t}& j=1,...,m-1& i=0,...,m-1\end{array}\right.---\left(2\right),$ And

$u\left(\mathrm{\&mu;}\right)=\left\{\begin{array}{cc}1& \mathrm{\&mu;}\&GreaterEqual;0\\ 0& \mathrm{\&mu;}<0\end{array}\right..$

Fig. 5 explains Galois field multiplying how to accomplish a m position with a hard-wired example of Mace Te Weiduo (Mastrivito) multiplier, and consistent with the enforcement example of some exposure of the present invention.In the hard-wired example of Mace Te Weiduo (Mastrivito) multiplier of Fig. 5, matrix-vector multiplier (Matrix-Vector Multiplier) 501 is exactly the computing of carrying out formula (1), and product matrix 511 is exactly the computing of carrying out formula (2).After the B operand of m position is changed through f letter formula, obtain the product matrix ZB of a m * m, the value of this matrix multiplies each other with a vector-matrix multiply musical instruments used in a Buddhist or Taoist mass more then, and just the expression formula of formula (1) is promptly accomplished the Galois field multiplying of a m position.

In other words, in Mace Te Weiduo (Mastrivito) multiplier architecture, it is exactly with GF (2 that a characteristic is arranged ^m) multiplying is divided into the Galois field multiplying that two steps are accomplished a m position.First step is the product matrix that earlier one of them operand B is changed into m * m from the m bit vector; Second step is the multiplication that again this matrix and another one operand A is carried out matrix-vector, just can obtain final multiplication result.

In two stage like this framework, as shown in Figure 6 when one of them operand is the low frequency variable, each B just _iOperand all can with a plurality of A _iOperand multiplies each other.Because therefore this kind situation can take the design of pipeline (Pipeline),, obtain the product matrix Z of a m * m with the advanced row matrix conversion of low frequency variable B _B, and store.Because the conversion frequency height next than B of A, therefore all A * B computing before B does not change all only need be carried out the computing of formula (1), and need not carry out formula (2).

Fig. 7 is the GF (2 of two substrate fields among Fig. 3 ^m) an example configuration diagram realizing with two Mace Te Weiduo (Mastrivito) multipliers of multiplier, and consistent with the enforcement example of some exposure of the present invention.So, the GF (2 of substrate field ^m) multiplier 301 realizes the GF (2 of substrate field with matrix-vector multiplier 501 and product matrix 511 ^m) multiplier 302 realizes with matrix-vector multiplier 502 and product matrix 512.Can find from Fig. 7; Part at operand B; Getting into matrix-vector multiplier before can be through two translation operation, a computing that is reflection to compound (MapTo Composite Field), and another is the required product matrix conversion of Mace Te Weiduo (Mastrivito) framework.Reflection to compound computing and product matrix can be integrated into single matrix conversion computing, shown in matrix conversion computing 821 and 822 among Fig. 8, is used for conversion operations respectively to count higher order element and the low order element of B.

The enforcement example with hard-wired Galois multiplier and its manner of execution of above-mentioned exposure can be used in and adopt as in the encrypting and deciphering system of GCM-AES algorithm as the class of preset encryption and decryption computing.Therefore this Galois multiplier can effectively reduce the hardware cost of GCM-AES owing to cooperate the recycling of arithmetic element.

Below to utilize GF ((2 ⁴) ²) compound format of field realize a GF (2 ⁸) multiplier is an example, that is n=8 and m=4, and the Galois multiplier of partly importing in proper order of above-mentioned exposure and the example framework of manner of execution are described.

Suppose to constitute GF (2 ⁸) original polynomial expression g (x) be 1+x ²+ x ³+ x ⁴+ x ⁸, and construction GF (2 ⁴) original polynomial expression p (x) be 1+x+x ⁴And be used for producing GF ((2 ⁴) ²) original polynomial expression be x ²+ x+ α ¹⁴Utilize the theory of Christof Paar can obtain GF (2 ⁸) GF ((2 videos ⁴) ²) matrix do

$\left[\begin{array}{cccccccc}0& 0& 1& 0& 0& 0& 0& 0\\ 0& 1& 1& 0& 0& 1& 0& 0\\ 0& 0& 0& 1& 1& 0& 1& 0\\ 1& 0& 0& 1& 0& 0& 0& 0\\ 0& 0& 1& 0& 0& 1& 1& 0\\ 1& 0& 0& 1& 1& 0& 1& 0\\ 0& 0& 1& 0& 0& 0& 1& 0\\ 0& 0& 0& 0& 1& 0& 1& 1\end{array}\right]$

Suppose that operand B belongs to GF (2 ⁸), its coefficient is [b ₀b ₁b ₂b ₃b ₄b ₅b ₆b ₇b ₈] ^T, then obtain later following formula, just the calculation function of the extremely compound field of reflection among Fig. 3, Fig. 7 and Fig. 8 in conversion.

$\left[\begin{array}{cccccccc}0& 0& 1& 0& 0& 0& 0& 0\\ 0& 1& 1& 0& 0& 1& 0& 0\\ 0& 0& 0& 1& 1& 0& 1& 0\\ 1& 0& 0& 1& 0& 0& 0& 0\\ 0& 0& 1& 0& 0& 1& 1& 0\\ 1& 0& 0& 1& 1& 0& 1& 0\\ 0& 0& 1& 0& 0& 0& 1& 0\\ 0& 0& 0& 0& 1& 0& 1& 1\end{array}\right]\left[\begin{array}{c}{b}_0\\ b_1\\ b_2\\ b_3\\ b_4\\ b_5\\ b_6\\ b_7\end{array}\right]=\left[\begin{array}{c}{b}_2\\ {\mathrm{<figure-callout\; id="1"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00051.png"\; state="\{\{state\}\}">b</figure-callout>}}_1+{\mathrm{<figure-callout\; id="2"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00071.png"\; state="\{\{state\}\}">b</figure-callout>}}_2+b_5\\ {\mathrm{<figure-callout\; id="3"\; label="b"\; filenames="H2008101760622E00061.png"\; state="\{\{state\}\}">b</figure-callout>}}_3+b_4+b_6\\ {\mathrm{<figure-callout\; id="0"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00051.png"\; state="\{\{state\}\}">b</figure-callout>}}_0+b_3\\ {\mathrm{<figure-callout\; id="2"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00071.png"\; state="\{\{state\}\}">b</figure-callout>}}_2+b_5+b_6\\ {\mathrm{<figure-callout\; id="0"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00051.png"\; state="\{\{state\}\}">b</figure-callout>}}_0+{\mathrm{<figure-callout\; id="3"\; label="b"\; filenames="H2008101760622E00061.png"\; state="\{\{state\}\}">b</figure-callout>}}_3+b_4+b_6\\ {\mathrm{<figure-callout\; id="2"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00071.png"\; state="\{\{state\}\}">b</figure-callout>}}_2+b_6\\ b_4+b_6+b_7\end{array}\right]=\left[\begin{array}{c}{b}_{l,0}^{\&prime;}\\ b_{l,1}^{\&prime;}\\ b_{l,2}^{\&prime;}\\ b_{l,3}^{\&prime;}\\ b_{h,0}^{\&prime;}\\ b_{h,1}^{\&prime;}\\ b_{h,2}^{\&prime;}\\ b_{h,3}^{\&prime;}\end{array}\right]$

And the GF (2 of Mace Te Weiduo (Mastrivito) multiplier ⁴) product matrix is from formula (2) and 1+x+x ⁴, the product matrix of low order element and higher order element as shown in the formula

$\left[\begin{array}{cccc}{b}_{l,0}^{\&prime;}& b_{l,3}^{\&prime;}& b_{l,2}^{\&prime;}& b_{l,1}^{\&prime;}\\ b_{l,1}^{\&prime;}& b_{l,0}^{\&prime;}+b_{l,3}^{\&prime;}& b_{l,2}^{\&prime;}+b_{l,3}^{\&prime;}& b_{l,1}^{\&prime;}+b_{l,2}^{\&prime;}\\ b_{l,2}^{\&prime;}& b_{l,1}^{\&prime;}& b_{l,0}^{\&prime;}+b_{l,3}^{\&prime;}& b_{l,2}^{\&prime;}+b_{l,3}^{\&prime;}\\ b_{l,3}^{\&prime;}& b_{l,2}^{\&prime;}& b_{l,1}^{\&prime;}& b_{l,0}^{\&prime;}+b_{l,3}^{\&prime;}\end{array}\right]$ With

$\left[\begin{array}{cccc}{b}_{h,0}^{\&prime;}& b_{h,3}^{\&prime;}& b_{h,2}^{\&prime;}& b_{h,1}^{\&prime;}\\ b_{h,1}^{\&prime;}& b_{h,0}^{\&prime;}+b_{h,3}^{\&prime;}& b_{h,2}^{\&prime;}+b_{h,3}^{\&prime;}& b_{h,1}^{\&prime;}+b_{h,2}^{\&prime;}\\ b_{h,2}^{\&prime;}& b_{h,1}^{\&prime;}& b_{h,0}^{\&prime;}+b_{h,3}^{\&prime;}& b_{h,2}^{\&prime;}+b_{h,3}^{\&prime;}\\ b_{h,3}^{\&prime;}& b_{h,2}^{\&prime;}& b_{h,1}^{\&prime;}& b_{h,0}^{\&prime;}+b_{h,3}^{\&prime;}\end{array}\right].$

The calculation function of Here it is in Fig. 5 and Fig. 7 product matrix.

As preceding shown in Figure 8; Can be integrated into by single matrix conversion calculation function through the conversion and the product matrix of reflection to compound computing, just with

and

be brought into respectively product matrix in.Therefore, with the low order element of operand B, can integrate as follows

$\left[\begin{array}{cccc}{b}_2& {\mathrm{<figure-callout\; id="0"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00051.png"\; state="\{\{state\}\}">b</figure-callout>}}_0+b_3& {\mathrm{<figure-callout\; id="3"\; label="b"\; filenames="H2008101760622E00061.png"\; state="\{\{state\}\}">b</figure-callout>}}_3+b_4+b_6& {\mathrm{<figure-callout\; id="1"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00051.png"\; state="\{\{state\}\}">b</figure-callout>}}_1+{\mathrm{<figure-callout\; id="2"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00071.png"\; state="\{\{state\}\}">b</figure-callout>}}_2+b_5\\ {\mathrm{<figure-callout\; id="1"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00051.png"\; state="\{\{state\}\}">b</figure-callout>}}_1+{\mathrm{<figure-callout\; id="2"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00071.png"\; state="\{\{state\}\}">b</figure-callout>}}_2+b_5& {\mathrm{<figure-callout\; id="0"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00051.png"\; state="\{\{state\}\}">b</figure-callout>}}_0+{\mathrm{<figure-callout\; id="2"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00071.png"\; state="\{\{state\}\}">b</figure-callout>}}_2+b_3& {\mathrm{<figure-callout\; id="0"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00051.png"\; state="\{\{state\}\}">b</figure-callout>}}_0+b_4+b_6& {\mathrm{<figure-callout\; id="1"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00051.png"\; state="\{\{state\}\}">b</figure-callout>}}_1+{\mathrm{<figure-callout\; id="2"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00071.png"\; state="\{\{state\}\}">b</figure-callout>}}_2+{\mathrm{<figure-callout\; id="3"\; label="b"\; filenames="H2008101760622E00061.png"\; state="\{\{state\}\}">b</figure-callout>}}_3+b_4+b_5+b_6\\ {\mathrm{<figure-callout\; id="3"\; label="b"\; filenames="H2008101760622E00061.png"\; state="\{\{state\}\}">b</figure-callout>}}_3+b_4+b_6& {\mathrm{<figure-callout\; id="1"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00051.png"\; state="\{\{state\}\}">b</figure-callout>}}_1+{\mathrm{<figure-callout\; id="2"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00071.png"\; state="\{\{state\}\}">b</figure-callout>}}_2+b_5& {\mathrm{<figure-callout\; id="0"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00051.png"\; state="\{\{state\}\}">b</figure-callout>}}_0+{\mathrm{<figure-callout\; id="2"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00071.png"\; state="\{\{state\}\}">b</figure-callout>}}_2+b_3& {\mathrm{<figure-callout\; id="0"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00051.png"\; state="\{\{state\}\}">b</figure-callout>}}_0+b_4+b_6\\ {\mathrm{<figure-callout\; id="0"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00051.png"\; state="\{\{state\}\}">b</figure-callout>}}_0+b_3& {\mathrm{<figure-callout\; id="3"\; label="b"\; filenames="H2008101760622E00061.png"\; state="\{\{state\}\}">b</figure-callout>}}_3+b_4+b_6& {\mathrm{<figure-callout\; id="1"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00051.png"\; state="\{\{state\}\}">b</figure-callout>}}_1+{\mathrm{<figure-callout\; id="2"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00071.png"\; state="\{\{state\}\}">b</figure-callout>}}_2+b_5& {\mathrm{<figure-callout\; id="0"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00051.png"\; state="\{\{state\}\}">b</figure-callout>}}_0+{\mathrm{<figure-callout\; id="2"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00071.png"\; state="\{\{state\}\}">b</figure-callout>}}_2+{\mathrm{<figure-callout\; id="3"\; label="b"\; filenames="H2008101760622E00061.png"\; state="\{\{state\}\}">b</figure-callout>}}_3\end{array}\right],$

The higher order element of operand B then can be integrated as follows

$\left[\begin{array}{cccc}{\mathrm{<figure-callout\; id="2"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00071.png"\; state="\{\{state\}\}">b</figure-callout>}}_2+b_5+b_6& b_4+b_6+b_7& {\mathrm{<figure-callout\; id="2"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00071.png"\; state="\{\{state\}\}">b</figure-callout>}}_2+b_6& {\mathrm{<figure-callout\; id="0"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00051.png"\; state="\{\{state\}\}">b</figure-callout>}}_0+{\mathrm{<figure-callout\; id="3"\; label="b"\; filenames="H2008101760622E00061.png"\; state="\{\{state\}\}">b</figure-callout>}}_3+b_4+b_6\\ {\mathrm{<figure-callout\; id="0"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00051.png"\; state="\{\{state\}\}">b</figure-callout>}}_0+{\mathrm{<figure-callout\; id="3"\; label="b"\; filenames="H2008101760622E00061.png"\; state="\{\{state\}\}">b</figure-callout>}}_3+b_4+b_6& {\mathrm{<figure-callout\; id="2"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00071.png"\; state="\{\{state\}\}">b</figure-callout>}}_2+b_4+b_5+b_7& {\mathrm{<figure-callout\; id="2"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00071.png"\; state="\{\{state\}\}">b</figure-callout>}}_2+b_4+b_7& {\mathrm{<figure-callout\; id="0"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00051.png"\; state="\{\{state\}\}">b</figure-callout>}}_0+{\mathrm{<figure-callout\; id="2"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00071.png"\; state="\{\{state\}\}">b</figure-callout>}}_2+{\mathrm{<figure-callout\; id="3"\; label="b"\; filenames="H2008101760622E00061.png"\; state="\{\{state\}\}">b</figure-callout>}}_3+b_4\\ {\mathrm{<figure-callout\; id="2"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00071.png"\; state="\{\{state\}\}">b</figure-callout>}}_2+b_6& {\mathrm{<figure-callout\; id="0"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00051.png"\; state="\{\{state\}\}">b</figure-callout>}}_0+{\mathrm{<figure-callout\; id="3"\; label="b"\; filenames="H2008101760622E00061.png"\; state="\{\{state\}\}">b</figure-callout>}}_3+b_4+b_6& {\mathrm{<figure-callout\; id="2"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00071.png"\; state="\{\{state\}\}">b</figure-callout>}}_2+b_4+b_5+b_7& {\mathrm{<figure-callout\; id="2"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00071.png"\; state="\{\{state\}\}">b</figure-callout>}}_2+b_4+b_7\\ b_4+b_6+b_7& {\mathrm{<figure-callout\; id="2"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00071.png"\; state="\{\{state\}\}">b</figure-callout>}}_2+b_6& {\mathrm{<figure-callout\; id="0"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00051.png"\; state="\{\{state\}\}">b</figure-callout>}}_0+{\mathrm{<figure-callout\; id="3"\; label="b"\; filenames="H2008101760622E00061.png"\; state="\{\{state\}\}">b</figure-callout>}}_3+b_4+b_6& {\mathrm{<figure-callout\; id="2"\; label="b"\; filenames="H2008101760622E00031.png,H2008101760622E00071.png"\; state="\{\{state\}\}">b</figure-callout>}}_2+b_4+b_5+b_7\end{array}\right].$

This two matrix is exactly the matrix conversion computing after integrating among Fig. 8, is used for conversion operations to count the matrix of B.

In sum, the enforcement example of this exposure is to use compound principle of Galois, is the situation than the low frequency variable to one of them operand of Galois multiplication, utilizes GF (2 ^m) finite field multiplier realization GF (2 ⁿ) the finite field multiplying, n=2m, and the recycling of cooperation arithmetic element propose one with hard-wired Galois multiplier and its manner of execution of partly importing in proper order.The enforcement example of this exposure if be applied in the GCM-AES algorithm as preset encryption and decryption computing type encrypting and deciphering system in the time, can effectively reduce the hardware cost of GCM-AES.

Only, above-describedly be merely enforcement example of the present invention, when not limiting the scope that the present invention implements according to this.Be that the equalization that every claim of the present invention is done changes and modification, all should still belong to the scope that claim of the present invention contains.

Claims (16)

1. One and half in proper order the input Galois GF (2 ⁿ) multiplier, be used for carrying out Galois field GF (2 ⁿ) the multiplication of two operands, n is a positive even numbers, this Galois GF (2 ⁿ) multiplier comprises:

   An input operand projection instrument is with GF (2 ⁿ) the two operands GF ((2 that videos earlier ^m) ²) compound in, and obtain compound high-order and low order two elements of these two operands respectively;

   The GF (2 of single substrate field ^m) multiplier comprises a GF (2 ^m) multiplier and the 2nd GF (2 ^m) multiplier, distinguish compound high-order and low order element of this one of them operand of two operands of parallel input, and import compound high-order and low order element of another operand in proper order, and produce a plurality of GF (2 ^m) the part multiplication result, n=2m;

   At least one constant multiplier is with a GF (2 of this higher order element of input ^m) multiplier and the 2nd GF (2 ^m) the multiplier connection; And

   A plurality of single GF (2 ^m) totalizer;

   These a plurality of GF (2 ^m) the part multiplication result again via this constant multiplier and these a plurality of GF (2 ^m) totalizer, produce GF ((2 ^m) ²) multiplication result in a higher order element and a low order element, higher order element in this multiplication result and low order element are got back to GF (2 through reflection ⁿ), to accomplish this GF (2 ⁿ) multiplication; Wherein, said these a plurality of GF (2 ^m) the part multiplication result again via this constant multiplier and these a plurality of GF (2 ^m) totalizer, produce GF ((2 ^m) ²) multiplication result in a higher order element and a low order element comprise:

   Compound higher order element b with an operand ₁With low order element b ₀The parallel respectively GF (2 that is input to two substrate fields ^m) a GF (2 in the multiplier ^m) multiplier and the 2nd GF (2 ^m) multiplier, and compound higher order element a of another operand ₁With low order element a ₀Input to a GF (2 of said substrate field in proper order ^m) multiplier and the 2nd GF (2 ^m) multiplier, obtain a GF (2 respectively by the substrate field ^m) a of multiplier output ₀b ₁And a ₁b ₁, and by the 2nd GF (2 of substrate field ^m) a of multiplier output ₀b ₀And a ₁b ₀

   The one GF (2 of substrate field ^m) the output a of multiplier ₁b ₁Via constant multiplier, be multiplied by constant r ₀After obtain a ₁b ₁r ₀, deposit the result in first buffer; And a ₁b ₀And a ₁b ₁At process GF (2 ⁿ) element additive operation XOR after, deposit the result in second buffer;

   Let a then ₀b ₀Previous temporary value a with first buffer ₁b ₁r ₀Through GF (2 ⁿ) element additive operation XOR after obtain a ₀b ₀+ a ₁b ₁r ₀, select a ₀b ₁Previous temporary value process GF (2 with second buffer ⁿ) element additive operation XOR after, obtain a ₁b ₀+ a ₁b ₁+ a ₀b ₁, wherein, a ₀b ₀+ a ₁b ₁r ₀Be the low order element in the multiplication result, a ₁b ₀+ a ₁b ₁+ a ₀b ₁Be the higher order element in the multiplication result.
2. 2. the Galois GF (2 that partly imports in proper order as claimed in claim 1 ⁿ) multiplier, wherein each this single substrate field GF (2 ^m) multiplier is to realize with the framework of a Mace Te Weiduo multiplier.
3. 3. the Galois GF (2 that partly imports in proper order as claimed in claim 2 ⁿ) multiplier, wherein the framework of this Mace Te Weiduo multiplier is to realize with the framework of a matrix-vector multiplier and a product matrix.
4. 4. the Galois GF (2 that partly imports in proper order as claimed in claim 1 ⁿ) multiplier, wherein this Galois field GF (2 ⁿ) this wherein an operand earlier through the computing of a reflection, from GF (2 to compound ⁿ) be mapped to one compound GF ((2 ^m) ²), and compound the high-order of this another operand and GF (2 that the low order element is input to these two single substrate fields respectively ^m) multiplier.
5. 5. the Galois GF (2 that partly imports in proper order as claimed in claim 1 ⁿ) multiplier, wherein this GF ((2 ^m) ²) multiplication result in this higher order element and low order element be temporary in two buffers respectively.
6. 6. the Galois multiplier of partly importing in proper order as claimed in claim 1, this Galois GF (2 ⁿ) multiplier also comprises two control signals, with this GF ((2 ^m) ²) multiplication result in this higher order element and low order element deposit in respectively in two buffers.
7. 7. the Galois multiplier of partly importing in proper order as claimed in claim 1, this GF (2 ⁿ) multiplier comprises the GF (2 of two single substrate fields ^m) multiplier, a constant multiplier and three single GF (2 ^m) totalizer.
8. 8. Galois GF (2 ⁿ) the partly input data method in proper order of multiplication, n is a positive even numbers, this method comprises:

   With GF (2 ⁿ) two operands of multiplication are from GF (2 ⁿ) GF ((2 videos ^m) ²), obtain compound element, n=2m; And

   Compound high-order and the parallel respectively GF (2 that inputs to two substrate fields of low order element of one of them operand ^m) multiplier, and compound the high-order of another operand and GF (2 that the low order element inputs to this two substrates field in proper order ^m) multiplier.
9. 9. Galois GF (2 as claimed in claim 8 ⁿ) the partly input data method in proper order of multiplication, this order of importing in proper order and unrestricted wherein, its low order element of input behind the higher order element of this another operand of input earlier, or its higher order element of input behind the low order element of another operand of input earlier.
10. One and half in proper order the input Galois GF (2 ⁿ) manner of execution of multiplication, be used for carrying out Galois field GF (2 ⁿ) the multiplication of two operands, n is a positive even numbers, this method comprises:

    With GF (2 ⁿ) two operands of multiplication are via a compound reflection computing, from GF (2 ⁿ) GF ((2 videos ^m) ²), obtain compound the high-order and low order two elements of two operands, n=2m respectively;

    Compound high-order and the parallel respectively GF (2 that inputs to two substrate fields of low order element of one of them operand ^m) multiplier comprises a GF (2 ^m) multiplier and the 2nd GF (2 ^m) multiplier, and compound the high-order of another operand and GF (2 that the low order element inputs to this two substrates field in proper order ^m) multiplier;

    With GF (2 ⁿ) multiplication is divided into a plurality of GF (2 ^m) the part multiplying; And

    With this two substrate field GF (2 ^m) multiplier, at least one constant multiplier and a plurality of GF (2 ^m) totalizer carries out this a plurality of GF (2 ^m) the part multiplying, and produce a higher order element and the low order element in the multiplication result;

    Higher order element in this multiplication result and low order element are got back to GF (2 through reflection ⁿ), to obtain this Galois field GF (2 ^m) the multiplication result of two operands;

    Wherein, said with this two substrate field GF (2 ^m) multiplier, at least one constant multiplier and a plurality of GF (2 ^m) totalizer carries out this a plurality of GF (2 ^m) the part multiplying, and the higher order element and the low order element that produce in the multiplication result comprise:

    Compound higher order element b with an operand ₁With low order element b ₀The parallel respectively GF (2 that is input to two substrate fields ^m) a GF (2 in the multiplier ^m) multiplier and the 2nd GF (2 ^m) multiplier, and compound higher order element a of another operand ₁With low order element a ₀Input to a GF (2 of said substrate field in proper order ^m) multiplier and the 2nd GF (2 ^m) multiplier, obtain a GF (2 respectively by the substrate field ^m) a of multiplier output ₀b ₁And a ₁b ₁, and by the 2nd GF (2 of substrate field ^m) a of multiplier output ₀b ₀And a ₁b ₀

    The one GF (2 of substrate field ^m) the output a of multiplier ₁b ₁Via constant multiplier, be multiplied by constant r ₀After obtain a ₁b ₁r ₀, deposit the result in first buffer; And a ₁b ₀And a ₁b ₁At process GF (2 ⁿ) element additive operation XOR after, deposit the result in second buffer;

    Let a then ₀b ₀Previous temporary value a with first buffer ₁b ₁r ₀Through GF (2 ⁿ) element additive operation XOR after obtain a ₀b ₀+ a ₁b ₁r ₀, select a ₀b ₁Previous temporary value process GF (2 with second buffer ⁿ) element additive operation XOR after, obtain a ₁b ₀+ a ₁b ₁+ a ₀b ₁, wherein, a ₀b ₀+ a ₁b ₁r ₀Be the low order element in the multiplication result, a ₁b ₀+ a ₁b ₁+ a ₀b ₁Be the higher order element in the multiplication result.
11. 11. like the claim the 10 described Galois GF (2 that partly import in proper order ⁿ) manner of execution of multiplication, the wherein GF (2 of this two substrates field ^m) multiplier is all Mace Te Weiduo multiplier.
12. 12. the Galois GF (2 that partly imports in proper order as claimed in claim 11 ⁿ) manner of execution of multiplication, wherein this Mace Te Weiduo multiplier is with this GF (2 ^m) multiplying accomplishes the Galois field multiplying of a m position with the following step:

    One of them operand is changed into the product matrix of a m * m from the m bit vector; And

    The multiplication that product matrix and the another one operand of this m * m carried out matrix-vector.
13. 13. the Galois GF (2 that partly imports in proper order as claimed in claim 10 ⁿ) manner of execution of multiplication, this method is divided into four GF (2 with GF (2n) multiplication ^m) the part multiplying.
14. 14. the Galois GF (2 that partly imports in proper order as claimed in claim 13 ⁿ) manner of execution of multiplication, this method is with the GF (2 of this two substrates field ^m) multiplier, a constant multiplication and three GF (2 ^m) addition carries out this four GF (2 ^m) the part multiplying.
15. 15. the Galois GF (2 that partly imports in proper order as claimed in claim 10 ⁿ) manner of execution of multiplication, this method is utilized two control signals, with this GF ((2 ^m) ²) multiplication result in this higher order element and low order element deposit in respectively in two buffers.
16. 16. the Galois GF (2 that partly imports in proper order as claimed in claim 11 ⁿ) manner of execution of multiplication, wherein this compound reflection computing and this product matrix are integrated into a matrix conversion computing.

Images