SPRUJ17H March 2022 – October 2024 AM2631 , AM2631-Q1 , AM2632 , AM2632-Q1 , AM2634 , AM2634-Q1
Complex commands are provided to make the PKA module easier to use and to maximize the performance, that is, to ensure that the internal PKA engines are used as efficiently as possible. Each complex command glues together a sequence of basic commands to create a higher level operation that helps implement public key algorithms such as RSA, ECDSA and [EC]DH.
There are both similarities and differences between basic and complex commands:
The following tables provide an overview of the complex operations. More information on each of the operations is given in subsequent paragraphs and cover details such as:
During execution of a complex operation, the last 96 bytes of the PKA RAM are used as general scratchpad for the Sequencer program execution. This area may not overlap with any of the input vectors, output vectors or WorkSpace areas. These 96 bytes can be used freely when executing basic PKCP operations.
To describe the content/layout of a composite vector, the notation from Table 7-109 is used:
Notation | Description |
---|---|
Name[Len] | A value called Name, consisting of Len words. |
WorkSpace[...] | The area used for storing auxiliary/intermediate values during the operation. |
, | Commas are used to separate the various components of a multi-component vector. |
[α] | Indicates the presence of an optional alignment word, see section 4.2.1. Modular Inversion for Regular Numbers. |
[1] | Indicates the presence of a mandatory buffer word, see section 3.2.2. Buffer Words. |
Function: MODEXP | Operation: ME (mod N) -> R |
---|---|
Vector A | E[ALen] |
Vector B | N[BLen], [1] |
Vector C | M[BLen], [1] |
Shift | # of odd powers to use, >= 1 |
Vector D | R[BLen], [1], [α], Workspace[...…] |
Sequencer Operation Opcode | PKA_FUNCTION[18:16, 14:12] = 000 110 |
Function: MODEXP-CRT | Operation: CRTpq(MpDp mod p, MqDq mod q, qInv) -> R, with: Mp = M mod p, Mq = M mod q, and CRTpq(a, b, qInv) = ((a-b)*qInv mod p)*q + b |
Vector A | Dp[Alen], [α], Dq[Alen] |
Vector B | p[Blen], [1], [α], q[Blen], [1] (Important implementation requirement: p > q) |
Vector C | qInv[Blen] |
Shift | # of odd powers to use, >= 1 |
Vector D (input) | M[2*Blen], [1], [α], WorkSpace[...…] |
Vector D (output) | R[2*BLen] |
Sequencer Operation Opcode | PKA_FUNCTION[18:16, 14:12] = 000 001 |
Sequencer operation opcodes 000 010 and 000 100 map to deprecated MODEXP commands.
Function: MODINVp | Operation: 1 / Z (mod N) -> R, where N must be odd. |
---|---|
Vector A | Z[Alen] |
Vector B | N[BLen] |
Vector D | R[BLen], [α], WorkSpace[…...] |
Sequencer Operation Opcode | PKA_FUNCTION[18:16, 14:12] = 000 111 |
Function: ECpADDxyz | Operation: P1_xyz + P2_xyz -> P0_xyz, on prime curve: y2 = x3 + ax + b (mod p) |
---|---|
Vector A | P1_x[BLen], [1], [1], [α], P1_y[BLen], [1], [1], [α], P1_z[BLen], [1], [1] |
Vector B | p[BLen], [1], [1], [α], a[BLen], [1], [1], [α], b[BLen], [1], [1] |
Vector C | P2_x[BLen], [1], [1], [α], P2_y[BLen], [1], [1], [α], P2_z[BLen], [1], [1] |
Vector D | P0_x[BLen], [1], [1], [α], P0_y[BLen], [1], [1], [α], P0_z[BLen], [1], [1], [α], WorkSpace[...…] |
Sequencer Operation Opcode | PKA_FUNCTION[18:16, 14:12] = 001 000 |
Function: ECpMULxyz | Operation: k * P1_xyz -> P0_xyz, on prime curve: y2 = x3 + ax + b (mod p) |
Vector A | k[ALen] |
Vector B | p[BLen], [1], [1], [α], a[BLen], [1], [1], [α] , b[BLen], [1], [1] |
Vector C | P1_x[BLen], [1], [1], [α], P1_y[BLen], [1], [1], [α], P1_z[BLen], [1], [1] with P1_z = 1 |
Vector D | P0_x[BLen], [1], [1], [α], P0_y[BLen], [1], [1], [α], P0_z[BLen], [1], [1], [α], WorkSpace[...…] |
Sequencer Operation Opcode | PKA_FUNCTION[18:16, 14:12] = 001 001 |
Function: ECpSCALExyz | Operation: P1_xyz -> P0_xyz, with Z0=1, on prime curve: y2 = x3 + ax + b (mod p) |
Vector B | p[BLen], [1], [1], [α], a[BLen], [1], [1], [α] , b[BLen], [1], [1] |
Vector D (input) | X1[BLen], [1], [1], [α], Y1[BLen], [1], [1], [α], Z1[BLen], [1], [1] |
Vector D (output) | X0[BLen], [1], [1], [α], Y0[BLen], [1], [1], [α], Z0[BLen], [1], [1], [α], WorkSpace[...…] |
Sequencer Operation Opcode | PKA_FUNCTION[18:16, 14:12] = 001 010 |
Function: EC2mADDxyz | Operation: P1_xyz + P2_xyz -> P0_xyz, on binary curve: y2 + xy = x3 + ax2 + b (mod p) |
---|---|
Vector A | X1[BLen], [α], Y1[BLen], [α], Z1[BLen] |
Vector B | p[BLen], [α], a[BLen], [α], b[BLen] |
Vector C | X2[BLen], [α], Y2[BLen], [α], Z2[BLen] |
Vector D | X0[BLen], [α], Y0[BLen], [α], Z0[BLen], [α], WorkSpace[...…] |
Sequencer Operation Opcode | PKA_FUNCTION[18:16, 14:12] = 001 100 |
Function: EC2mMULxyz | Operation: k * P1_xyz -> P0_xyz, on binary curve: y2 + xy = x3 + ax2 + b (mod p) |
Vector A | k[ALen] |
Vector B | p[BLen], [α], a[BLen], [α], c[BLen] with c2 = b (mod p) |
Vector C | X1[BLen], [α], Y1[BLen], [α], Z1[BLen] with Z1=1 |
Vector D | X0[BLen], [α], Y0[BLen], [α], Z0[BLen], [α], WorkSpace[...…] |
Sequencer Operation Opcode | PKA_FUNCTION[18:16, 14:12] = 001 101 |
Function: EC2mSCALExyz | Operation: P1_xyz -> P0_xyz, with Z0=1, on binary curve: y2 + xy = x3 + ax2 + b (mod p) |
Vector B | p[BLen] the other curve parameters are not used |
Vector D (input) | X1[BLen], [α], Y1[BLen], [α], Z1[BLen] |
Vector D (output) | X0[BLen], [α], Y0[BLen], [α], Z0[BLen], [α], WorkSpace[...] |
Sequencer Operation Opcode | PKA_FUNCTION[18:16, 14:12] = 001 110 |
Function: MODINV2m | Operation: 1 / Z (mod p) -> R |
Vector A | Z[Alen] |
Vector B | p[BLen] |
Vector D | R[BLen], [α], WorkSpace[…] |
Sequencer Operation Opcode | PKA_FUNCTION[18:16, 14:12] = 001 111 |
Function: ECDSApsign | Operation: ECDSApsign(H, X, k) -> R, S, signs message-hash H with private-key X |
---|---|
Vector A | X[BLen] |
Vector B | p[BLen], [1], [1], [α], a[BLen], [1], [1], [α], b[BLen], [1], [1], [α], n[BLen], [1], [1], [α], Gx[BLen], [1], [1], [α], Gy[BLen], [1], [1] [α], Rz[BLen], [1], [1] |
Vector C | H[BLen] |
Vector D (input) | k[BLen], [1], [1], [α] WorkSpace[...…] (k is a random value, new for each sign operation). |
Vector D (output) | R[BLen], [1], [1] [α], S[BLen], [1], [1] |
Sequencer Operation Opcode | PKA_FUNCTION[18:16, 14:12] = 010 010 |
Function: ECDSApvrfy | Operation: ECDSApvrfy(H, Y, RS) -> OK / not OK, verifies signature RS for message-hash H with public key Y |
Vector A | Yx[BLen], [1], [1] [α], Yy[BLen], [1], [1], [α], R'z[BLen], [1], [1] |
Vector B | p[BLen], [1], [1], [α], a[BLen], [1], [1], [α], b[BLen], [1], [1], [α], n[BLen], [1], [1], [α], Gx[BLen], [1], [1], [α], Gy[BLen], [1], [1] [α], Rz[BLen], [1], [1] |
Vector C | H[BLen] |
Vector D | R[BLen], [1], [1] [α], S[BLen], [1], [1] [α], WorkSpace[...…] |
Sequencer Operation Opcode | PKA_FUNCTION[18:16, 14:12] = 010 011 |
Function: ECmontMUL | Operation: affine point multiplication in prime domain k * P1_x → P0_x, on Montgomery curve: y2 = x3 + ax2 + x (mod p) |
Vector A | k[ALen] |
Vector B | p[BLen], [1], [1] [α], a[BLen] , [1], [1] [α] (b is always 1) |
Vector C | P1_x[BLen], [1], [1] [α] |
Vector D | P0_x[BLen], [1], [1] [α], WorkSpace[…] |
Sequencer Operation Opcode | PKA_FUNCTION[18:16, 14:12] = 000 010 |