Patent Grant
8073891
The present Application is based on International Application No. PCT/EP2006/061235, which in turn corresponds to French Application No. 05 03178 filed Apr. 1, 2005 and priority is hereby claimed under 35 USC §119 based on these applications. The application is hereby incorporated by reference in its entirety into the present application.
The invention relates to a method and a device for executing a Montgomery modular multiplication.
It is notably used in the field of cryptology, in integrated circuits of FPGA (Field Programmable Gate Array) or ASIC (Application Specific Integrated Circuit) type. Modular multiplication is done over a modular ring (Z/NZ) or over a field (Z/pZ) with p a prime number.
In the description, the operating frequency of a pipelined multiplier-adder with p stages is defined as given by the inverse of the time to cross a threshold of the stages of the multiplier-adder.
In the description, the term “pipeline” is defined as an operation consisting in adding register barriers between the logic phases and the architecture resulting therefrom.
Modular multiplication is at the core of numerous public-key crypto systems (RSA, ECDSA).
The encipherment and signature operations exhibit different constraints which require notably a fast, flexible and inexpensive architecture in terms of hardware resources.
Two flexibility levels are thus defined:
The architecture must be capable of processing various sizes of data so as to be able to perform operations of ECDSA type (Elliptic Curve Digital Signature Algorithm) of size 256-512 bits and also operations of RSA type (from the name of its inventors: Rivest, Shamir, Adleman) of size 1024-4096 bits.
To evaluate the performance of an architecture, the time*area product is used. The time is given in terms of number of clock cycles. The area is estimated in terms of number of equivalent Nand gates (ASIC) or in terms of elementary cells (LC (Logic Cell) or CLB (Configuration Logic Block), sequential combinatorial blocks, for FPGAs or field-programmable gate arrays).
The prior art describes various exemplary devices and methods using modular multiplication in asymmetric cryptography.
The most frequent implementations of modular multiplication are of systolic type and use the Montgomery algorithm. Numerous publications deal with these implementations. The reference in this field being due to Peter Kornerup, A systolic, linear-array for a class of right-shift algorithms, IEEE Transactions on Computers 43 (1994), no. 8, 892-898.
Modular multiplication can also be implemented according to the algorithm of Barret, Johann Groβschädl, High speed RSA Hardware based on Barret's modular reduction method, CHES'00, 2000.
The latter type of implementation, although efficacious, exhibits the drawback of not being flexible, since it is defined on a given size and cannot handle operations of greater sizes.
“Exotic” number representations (that is to say unconventional ones, such as for example the RNS (Residue Number System) representation) are also used to parallelize the implementation of modular multiplication, for example, L-S Didier, J-C Bajard and P. Kornerup, An RNS Montgomery multiplication Algorithm, Proceedings of ARITH13, IEEE Computer Society, 1997, pp. 234-239. However, this solution requires significant hardware resources and does not solve the flexibility problem.
Devices exhibiting flexible architectures, or “scalable hardware”, are also known. The first publication of such an architecture is due to Alexandre F. Tenca and Cetin K. Koç, A scalable architecture for Montgomery multiplication, CHES'99, 1999.
Other more recent publications take up the idea developed in this article and propose improvements and extensions. Such is the case in:
These architectures are based on wiring up small elementary cells composed of an adder and a multiplier. These devices address the flexibility problem. However, these structures entail choosing a low internal bus size. The number of cycles to perform a modular multiplication is therefore high.
Before explaining the device and the steps of the method according to the invention a few reminders relating to the Montgomery algorithm are given.
The Montgomery algorithm used is as follows:
MMnS(A,B,N)
mn+1←S0N′ mod r
S←(mn+1N+S)/r
Return S
The step S←aiB+(miN+S)/r is the most expensive from a computation time point of view. It may be noted that this step is obtained by doing the same operation twice: digit×long integer+long integer→long integer (xiY+Z→Z).
This step is performed by looping over the digits (numbers) of the two long integers (Y and Z).
However, two cases are distinguished depending on whether or not the shift is performed.
Classical Multiplication: aiB+T→S (1)
This multiplication-addition is performed by the following loop:
c=0
For j going from 0 to n do:
sn+1=c
For iteration j=n, bj≦1, therefore P≦3(r−1)=2r+r−3, which implies MSB(P)≦2. It follows from this that sn+1≦2.
Remark:
The basic operation is x×y+z+c with x, y, z and c lying between 0 and r−1. The result therefore lies between 0 and r2−1, representable by two digits.
Multiplication and shift: (miN+S/r)→T (2)
In the particular case of division by r (right shift), the loop is the same as above, with a shift of index at the output T level.
Specifically, the determination of mi renders the quantity P=mi×N0+s0 divisible by r. In that case, LSB(P) is certainly zero. Therefore this first value (index−1) is intentionally “dropped”, the first significant value (t0) being obtained at the following iteration (j=1).
On account of the shift of index, the last iteration (j=n) will give access to the value tn−1. The value tn will therefore be obtained by adding c=MSB(P) of iteration j=n with sn+1.
The loop is therefore as follows:
c=0
For j going from 0 to n do:
tn=c+sn+1
For iteration j=n, Nj=0, therefore P≦2(r−1)=r+r−2, which implies MSB(P)≦1.
It follows from this that tn≦3.
As r≧4, it follows from this that T is indeed represented by n+1 digits.
The present invention relies on a new approach which considers notably, during normal operation, a unique cell of bigger size than the cells considered in the prior art and a self-iteration process using a Montgomery algorithm with a high base. That is to say hereinafter, the base r is assumed to be larger than or equal to 4. In practice the base r usually corresponds to 232 or to 264, thereby justifying the terminology high base.
The invention relates to a device for implementing modular multiplication characterized in that it comprises at least one computation cell comprising a multiplier-adder comprising p pipelined logic-register pairs, receiving several digits to be added together and multiplied, at least two outputs corresponding to the low order and to the high order, an adder receiving the two outputs of the multiplier-adder, the number p being chosen in such a way that the maximum frequency of the multiplier-adder is greater than or equal to the maximum frequency of the adder.
The device can comprise a low part multiplier whose inputs correspond to the LSB output of the adder and to a precomputed constant, said multiplier being pipelined over a depth k.
The invention exhibits notably the following advantages:
the use of a higher base reduces the number of cycles necessary for the computation of a modular multiplication. A single elementary cell is then used. The time area product of this architecture is therefore improved.
Other characteristics and advantages of the present invention will be further apparent on reading the description which follows of an exemplary embodiment given by way of wholly nonlimiting illustration together with the figures which represent:
The idea implemented in the multiplier according to the invention consists notably in splitting the operation x×y+z+c into (x×y+z)+c, by pipelining the multiplication-addition operation (x×y+z) and by adding, as the results are obtained, the variable c, where x, y and z are the data, c being the high-order digit originating from the previous iteration.
Pipeline
The pipeline consists in adding register barriers between the logic phases so as to reduce the critical path, and thus increase the maximum operating frequency (theoretically that of an adder with base r).
The pipeline depth of an elementary component is defined by its number of internal registers. The output register is not counted.
Implementation of Multiplication-Addition
The example given in
It comprises notably a set of logic-register pairs (li, ri). The number p of these pairs is chosen notably so that the maximum frequency F1max of the pipelined multiplier-adder is greater than or equal to the maximum frequency F2max of the adder, the values of these two frequencies being as close as possible.
The maximum operating frequency of the adder is given by the inverse of the time to execute the multiplication-addition operation, while the maximum operating frequency of the pipelined multiplier-adder is given by the inverse of the time to execute a single one of the p stages. For optimal operation, the maximum frequency of the adder is determined, thereby giving the execution time of the adder and the adder is split up into p stages whose crossing time is less than or equal, but as close as possible, to the execution time of the adder.
The inputs of the multiplier-adder 1 correspond to three digits: x, y and z and the output is a pair of digits corresponding to LSB (x×y+z) and MSB (x×y+z). The output is held on two digits.
The results of the multiplier-adder are transmitted to a three-input adder, referenced 2: digit+digit+carry→digit+carry, operating in 1 cycle (pipeline 0) at the frequency F2max.
Hereinafter, b will denote the size of the internal bus (the assumption which is made is: b≧2 so as to satisfy r≧4), (r=2b).
The register Temp corresponds to the storage of c necessary for the following computation: addition of c with the following LSB and the previous carry.
The data (digits of x×y+z) therefore exit in series at each cycle, low-order digit leading, in the same direction as the carry propagation.
In this example, the main components of the circuit are: a pipelined multiplier-adder 1, a 3-input adder, referenced 2, a low part multiplier 3, a 2 bits+1 bit to 2 bits adder, denoted 4 and a barrier of nreg-max−1 registers and multiplexers, denoted 5.
The number of multiplexers and registers depends notably on the data intrinsic to the circuit, the pipeline depths p and k, as well as the number of digits of the data.
In the example of
Low Part Multiplication—Component 3
In the main loop of the algorithm, at each iteration, mi, the digit which renders the quantity S+miN divisible by r, is determined.
mi is determined by performing a partial multiplication of the low-order digit of S with a constant N′, precomputed once and for all for a given modulus N. In this multiplication, only the low part interests us: this operation is performed modulo r.
This operation being slower than an addition, it is also pipelined.
The pipeline depth of this operator is called k and it is assumed that k<p.
Loopback, Latency and Additional Registers
Two cases are distinguished, the switch from classical multiplication aiB+T→S, (1), to multiplication and shift (mi×N+S)/r→T, (2), and the switch from (2) to (1), the delay not being the same.
This delay determines notably the number of registers to be used: n′reg or nregk according to case. Thus for example, in the switch from (2) to (1), and in the case where p+2≦n (case where n′reg is defined), the number of registers to be used is n′reg. As there are nreg-max−1 of them, it is necessary to jump nreg-max−1−n′reg of them. This is done by virtue of the multiplexers, placed accordingly.
Switch from (1) to (2)
To be able to chain the multiplications-additions (1) and (2) without loss of time (ie: without adding latency), it is appropriate to determine mi before having traversed all the digits of the current multiplication.
It is therefore desirable to achieve the condition: p+k+2≦n.
Specifically, the low-order digit of the result of the multiplication-addition is available when the digit of index p+1 arrives at the input of the multiplier-adder.
At the next cycle, the addition is performed. S0 is available, the computation of mi can therefore start. After k+1 additional clock ticks, mi is available as output from the low part multiplier. It can therefore be used as input for the multiplier-adder at the next clock tick. This explains the condition p+k+2≦n.
Loopback
If one wants to chain the multiplications-additions (1) and (2), without loss of time, one chooses p+k+2≦n.
In this case, the datum mi is available before the end of traversal of the digits of the multiplication-addition in progress. This value is therefore looped back, so as to delay its input into the multiplier-adder. nrebk=n−p−k−2 is then defined which corresponds to the number of necessary loopback of this value.
In the particular case where nrebk=0, the datum mi is synchronous with the new inputs of the multiplier-adder.
However, in all cases, the value mi is looped back n times so that the input is the same for all the digits of N.
If on the other hand n−p−k−2 is negative, this corresponds to a delay of the computation of mi, latency is therefore added.
Latency
When the condition p+k+2≦n is not achieved, this signifies that the outputs have some delay over the inputs, standby ticks (latency) to synchronize the data are added.
During the latency ticks, the inputs are disabled (in the sense that 0 is taken as new input, to take account of the last carry of S), the computation continuing for the data already input.
In this case (p+k+2>n), one defines nlatk=p+k+2−n. This quantity represents the number of latency ticks to be performed before presenting new inputs to the multiplier-adder.
As soon as mi is determined, it is used as input for the multiplication-addition. S0 for its part is necessarily determined before mi and must be stored (as well as S1, S2 . . . ) until mi is computed.
For this reason, registers are added so as to delay the arrival of the results at the input of the multiplier-adder.
Additional Registers
Two cases are distinguished. Specifically, depending on whether p+k+2 is larger or smaller than n, the number and the use of the extra registers are not the same however.
Case 1: p+k+2≦n
In this case, the set S0 and mi is determined before the end of traversal of the digits of the data.
For mi, see the section on loopback, the method described above in the loopback section is used.
For S0, its arrival at the input of the multiplier-adder is delayed by adding shift registers.
nreg is then defined by nreg=n−p−1. This quantity corresponds to the number of registers to be added to synchronize the arrival of the low-order digit of the result of a multiplication-addition with the low-order data of the next one.
Case 2: p+k+2>n
Two sub-cases depending on whether p is or is no longer larger than n, are distinguished. In fact, whatever the value of p, mi will be determined after S0.
The arrival of S0 at the input of the multiplier is therefore delayed by adding extra registers. This number of registers will therefore depend only on k, the depth of the pipeline of the low part multiplication operator.
Therefore in this case nregk=k+1 is defined, the number of registers to be added to delay the arrival of S0 at the input of the multiplier.
Switch from (2) to (1)
We are concerned here with the switch from (2) to (1). If there is no mi to be determined, it is necessary on the other hand to take account of the shift (division by r).
As previously, the arrival of the results is synchronized with the input of new data. Here, only the quantity p is significant, mi not needing to be determined, k is not relevant.
On the other hand, the shift is taken into account (ie: consider t0 to be low-order digit and not t1 which is zero). This can be viewed as an additional pipeline level.
Additional Registers and Latency
Therefore as previously, two cases are distinguished depending on whether p+2 is or is not larger than n.
Case 1: p+2≦n
In this case, to is available before the end of traversal of the digits of the data. Registers are therefore added to take the delay into account. n′reg=n−p−2 is then defined, which indicates the number of registers to be added to take the delay into account.
Case 2: p+2>n
In this case, t0 is available after the traversal of the digits of the data. The input of the new data is therefore delayed. This is done as previously by adding standby ticks (latency). One defines n′lat=p+2−n which represents the number of standby ticks to be produced.
Extra Adder and Loopback
The determination of tn is done by adding sn+1 with c, sn+1≦2 and c≦1. For this purpose a 2 bits+1 bit to 2 bits (logic) adder (tn≦3) (component denoted 4) is envisaged.
In the computation of T, the shift makes it possible to economize on the use of a register. The latter is used for storing sn+1. This value is stored until c is determined, then the two are added thus releasing the register for storing sn+1.
One therefore defines nreb=n+nlatk−1 which is the number of necessary loopback of sn+1.
Correction Parameters
The final design of the component depends notably on the pipeline depths p and k as well as the number, for which it is initially envisaged, of digits n of the long integers. In particular, the number of registers to be added is a tricky point since it is not the same depending on whether the switch from (1) to (2) or the switch from (2) to (1) is the case.
The following summary table 1 relates the quantities p, k and n to the previously defined correction parameters.
p + 2 ≦ n)
In practice the number of registers to be added is defined by:
nreg-max=max(nregk, nreg) and is equal to n−p−1 if p+k+2≦n and otherwise k+1. In particular, nreg-max is greater than or equal to 1.
The steps requiring fewer registers are performed by shortening the chain of registers by adding multiplexers.
Sequencing Described in
An exemplary sequencing of the operations is described in conjunction with
General Behavior of the Multiplexers
The latency is relevant here. Specifically, depending on whether or not there is latency, the changes of state do not happen at the same moments.
It is however possible to use the latency correction parameters of the circuit (n′lat and nlatk) to define a general behavior of the multiplexers.
Specifically, it may be assumed that
with the first n′lat digits of B zero. (Except obviously for the computation of a0B.)
Likewise, it is possible to assume that N=n+1+nlatk with the first nlatk digits of N zero.
Moreover, the particular case of the first computation a0B for which the latency is not taken into account (the first n′lat zero digits of B) is singled out.
Finally, this particular case over with, it is noted that the data successively presented as input to the multiplier-adder can be grouped together in branches of 2n+2+n′lat+nlatk data. The first nlatk+n+1 correspond to the data mi and Nj. The last n′lat+n+1 correspond to the data ai and bj.
The behavior of the multiplexers will therefore be cyclic, of period 2n+2+n′lat+nlatk.
mux 1
mux1 is a multiplexer with two states symbolizing which type of inputs must be taken into account at the multiplier-adder level. The two states are:
The use of the constants n′lat and nlatk makes it possible notably to verify that the change of state occurs when all the digits of B (or of N) have been traversed.
For a0 the first n′lat zero digits are not taken into account. The computation begins directly with the data a0bn′lat.
Thus mux1, initially at 0 (reset), remains in this state during the first n clock ticks, and switches to the 1 state at the n+1th tick.
At the end of this n+1th tick, the data presented as input to the multiplier-adder are a0 and bn, all the digits of B will therefore have been traversed.
mux1 is at 1 at the end of this same clock tick, therefore at the end of the following clock tick, m1 and N0 will be presented as input to the multiplier-adder.
The general behavior of mux1 as a function of the clock tick clock can be summarized by the following steps:
If clock<n+1, then mux1=0
Otherwise:
If (clock−(n+1)mod(2n+2+nlatk+n′lat))<n+1+nlatk, then mux1=1
Otherwise mux1=0
mux2
mux2 is a multiplexer with two states symbolizing the moment at which the addition sn+2+c must be done. Recall that sn+2 is stored in Stab1.
Moreover, when this addition is performed, the carry of the three-input adder must be initialized to 0 since a new addition is beginning.
The two states are:
The low-order digit (s0) of the product a0×b0 is in the output register of the adder at clock p+3 (=1 (load)+(p+1)(s0 in LSB)+1(s0 in output register of the adder)).
sn is therefore in this same register at clock p+3+n. As sn corresponds to the low-order digit of a0×bn, the following inputs are therefore the digits of N and m1. Now, the addition must be performed when tn−1 is located in the output register of the adder since at this moment the right value of carry to be added to sn+1 to determine tn is available.
mux2 must therefore be in the 1 state when tn−1 is located in the output register of the adder, that is to say at clock tick p+3+n+nlatk+n+1=p+2n+nlatk+4. It should not be forgotten that with the shift, tn−1 corresponds to the computation of m1×Nn.
By periodicity, it is possible to describe the general behavior of mux2.
If clock=p+2n+4+nlatk mod 2n+2+nlatk+n′lat, then mux2=1
Otherwise mux2=0
mux3
During the loop over the digits of N, a right shift must be performed on the digits of the output to take account of the division by r. mux3 is a multiplexer with two states symbolizing the moment at which the shift (modeled by a register jump) is performed. The two states are:
The shift occurs when the datum sn+1 is present in the register Stab1. Specifically, at this instant, the register S of the adder contains, according to the value of nlatk, either 0 (result of a latency tick), or the value of t0. t0 having a delay time with respect to classical multiplication (s0), it must then jump a register so as to make up this delay time. This shift must therefore be performed until all the digits (latency included) of T, up to tn−1, are determined. Specifically, when tn−1 is determined (ie: in the register S of the adder), at the following clock tick, tn is determined in Stab1 by addition of c with sn+1, and tn−1 is located in the register Stab2. The shift then ends, the data tn−1 and tn again being in two successive registers, mux3 therefore remains in the 1 state for n+nlatk=nreb+1 ticks.
As we stated previously, the shift corresponds to the jump of the register Stab1 which is then used for the loopback to sn+1. The loopback to sn+1 therefore occurs at the same moment as the shift. Therefore the change of state of mux3 from 0 to 1 also indicates that it is necessary to loop the value sn+1 back into the register Stab1. This loopback takes place nreb times.
Initially, mux3 is in the 0 state (classical multiplication). It switches to 1 when sn+1 is in the register Stab1. Now, sn is in S at the clock tick p+3+n (cf: behavior of mux2). Therefore sn+1 is in this same register at the tick p+n+4, and in Stab1 at the next tick: p+n+5.
The general behavior of mux3 is deduced by periodicity: If clock<p+n+5, then mux3=0
Otherwise:
This command represents the instants for which sn+1 must be looped back into the register Stab1.
The two states are:
The behavior of reb is described at the same time as that of mux3. We therefore deduce from this:
If clock<p+n+5, then reb=0
Otherwise:
mux4 is a multiplexer with two states which forms part of the barrier of registers.
In the cases where this multiplexer is present, it indicates whether it is necessary to use n′reg or nregk registers. The two states are:
mux4 must be in the 1 state when to is determined in S. It was seen (cf: mux3) that sn+1 is present in S at clock=p+n+4, therefore nlatk+1 clock ticks after, that is to say at clock=p+n+5+nlatk, t0 is in S.
mux4 must remain at 1 until tn is located in Stab1 ie for n+1 clock ticks.
A general behavior of mux4 is deduced by periodicity:
If clock<p+n+5+nlatk, then mux4=0
Otherwise:
The command rebk indicates the moment at which it is necessary to loop the value of mi back into the output register of the low part multiplier.
The two states are:
It is therefore necessary to loop this value back from that moment onwards, at least n+1 times so that this input is the same for all the digits of N. It is also necessary to take account of the value of nrebk which is the number of necessary loopbacks of m1 in the case where m1 is determined before the traversal of all the digits of B.
The total loopback number for m1 is therefore: n+1+nrebk. The general behavior of rebk is deduced by periodicity: If clock<p+n+4, then rebk=0
Otherwise:
| Number | Date | Country | Kind |
|---|---|---|---|
| 05 03178 | Apr 2005 | FR | national |
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/EP2006/061235 | 3/31/2006 | WO | 00 | 4/11/2008 |
| Publishing Document | Publishing Date | Country | Kind |
|---|---|---|---|
| WO2006/103288 | 10/5/2006 | WO | A |
| Number | Name | Date | Kind |
|---|---|---|---|
| 5133069 | Asato et al. | Jul 1992 | A |
| 6804696 | Chen et al. | Oct 2004 | B2 |
| 7805479 | Moshier et al. | Sep 2010 | B2 |
| 20020116430 | Chen et al. | Aug 2002 | A1 |
| 20020194237 | Takahashi et al. | Dec 2002 | A1 |
| 20040267855 | Shantz et al. | Dec 2004 | A1 |
| 20050033790 | Hubert | Feb 2005 | A1 |
| 20070233769 | Moshier et al. | Oct 2007 | A1 |
| 20090086961 | Sauzet et al. | Apr 2009 | A1 |
| 20090089350 | Sauzet et al. | Apr 2009 | A1 |
| 20100235414 | Huang et al. | Sep 2010 | A1 |
| Number | Date | Country | |
|---|---|---|---|
| 20090037508 A1 | Feb 2009 | US |
