GB2318892A - Co-processor for performing modular multiplication - Google Patents
Co-processor for performing modular multiplication Download PDFInfo
- Publication number
- GB2318892A GB2318892A GB9622719A GB9622719A GB2318892A GB 2318892 A GB2318892 A GB 2318892A GB 9622719 A GB9622719 A GB 9622719A GB 9622719 A GB9622719 A GB 9622719A GB 2318892 A GB2318892 A GB 2318892A
- Authority
- GB
- United Kingdom
- Prior art keywords
- processor
- bit
- data streams
- value
- binary data
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
- G06F7/60—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers
- G06F7/72—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers using residue arithmetic
- G06F7/728—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers using residue arithmetic using Montgomery reduction
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
- G06F7/60—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers
- G06F7/72—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers using residue arithmetic
- G06F7/722—Modular multiplication
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
- G06F7/60—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers
- G06F7/72—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers using residue arithmetic
- G06F7/723—Modular exponentiation
Landscapes
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Engineering & Computer Science (AREA)
- Computational Mathematics (AREA)
- Mathematical Analysis (AREA)
- Mathematical Optimization (AREA)
- Pure & Applied Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Computing Systems (AREA)
- Mathematical Physics (AREA)
- General Engineering & Computer Science (AREA)
- Complex Calculations (AREA)
Abstract
A co-processor (FIG. 2) for performing modular multiplication comprises: means for receiving B and N binary data streams (bstr, nstr); means for receiving a data value A; adder means (Add1, Add2), subtractor means (Sub1, Sub2, Sub3) and multiplier means (Mul1, Mul2) coupled to sequentially process the B and N binary data streams and the data value A to produce a modulo-reduced multiplication value (A*B) mod N; with splitter means (FIG. 5A) for splitting each of the B and N binary data streams into component data streams comprising respectively alternate bits of the binary data streams; and the adder means subtractor means and multiplier means are arranged to process the component data streams in parallel.
Description
CO-PROCESSOR FOR PERFORMING MODULAR MULTIPLICATION
FIELD OF THE INVENTION
This invention relates generally to a co-processor for performing modular multiplication and particularly, though not exclusively, for implementing the Montgomery
Reduction Algorithm.
BACKGROUND OF THE INVENTION
Modular multiplication is extensively used in implementing cryptographic methods such as RSA cryptography.
The Montgomery algorithm is one of the most efficient techniques for performing modular multiplication. Its use is particularly effective where high performance is required so as to minimise the computation time.
The Montgomery proof is given in Appendix 1 and the
Montgomery Reduction Algorithm is outlined below: Montaomerv Algorithm
To enact the P operator on A.B we follow the process
outlined below:
(1) X = A.B + S (S initially zero)
(2) Y = (X.J) mod2" (where J is a pre-calculated
constant)
(3) Z = X + Y.N
(4) S = z/2n (5) P = S (modN) (N is subtracted from S, if S 2 N)
Thus P = P(A.B)N (the result in the Montgomery Field
of numbers)
In financial applications where smart cards are used as a means of ensuring a high level of security during the transaction, Public Key Cryptography is becoming increasingly popular. Public Key Cryptography offers a higher level of protection than the traditional symmetric or private key methods but until recently has been expensive to implement. Advances in technology have now made the implementation of such methods cost effective.
RSA Public Key capability has been designed into smartcard microcontrollers which also include an on-chip coprocessor which has been specifically designed to perform modular multiplications for operands each of 512 bit length. The co-processor is directly driven by the microcontroller's CPU under software control by a program stored either in ROM or in EEPROM. Such a co-processor which implements the Montgomery algorithm for modular reduction without the division process and is known from
European Patent Publication EP-0601907-A.
As will be discussed in detail hereafter, such a known co-processor suffers from a number of disadvantages.
SUMMARY OF THE INVENTION
It is an object of the present invention to provide a co-processor for performing modular multiplication with improved performance and flexibility.
In accordance with a the invention there is provided a co-processor for performing modular multiplication as claimed in claim 1.
BRIEF DESCRIPTION OF THE DRAWINGS
One co-processor for performing modular multiplication to implement the Montgomery Reduction Algorithm will now be described, by way of example only, with reference to the accompanying drawings, in which:
FIG. 1 shows a block schematic diagram of a known,
prior art co-processor for performing modular
multiplication to implement the Montgomery
Reduction Algorithm;
FIG. 2 shows a block schematic diagram of a new,
improved co-processor for performing modular
multiplication to implement the Montgomery
Reduction Algorithm;
FIG. 3 shows a block schematic diagram of a bit
pair adder stage used in the co-processor of
FIG. 2;
FIG. 4 shows a block schematic diagram of a
multiplier and associated circuitry used in the
co-processor of FIG. 2;
FIG. 5A shows a block schematic diagram of an
arrangement used in the co-processor of FIG. 2 for
generating component serial bit streams from
random access memory utilising a parallel-serial
interface;
FIG. 5B shows a block schematic diagram of a dual
port register arrangement used in the co-processor
of FIG. 2;
FIG. 6 shows a block schematic diagram of an
arrangement used in the co-processor of FIG. 2 for
direct exponentiation utilising an auto-indexing
pointer; and
FIG. 7 shows a block schematic diagram
illustrating the use of the co-processor of
FIG. 2, in implementing the Chinese Remainder
Theorem.
DETAILED DESCRIPTION OF A PREFERRED EMBODIMENT
Known Co-Drocessor Operation
FIG. 1 shows a diagram of a known, prior art hardware implementation of a co-processor which performs the
Montgomery algorithm for both full mode 512 bit and halfmode 256 bit operands.
The diagram shows the execution unit which comprises basically three 512 bit clocked shift registers and two parallel - serial multipliers.
The B value and the modulus N are preloaded into the B and
N registers respectively. Register S is used to store the intermediate result after each rotation of 512 clock cycles. Initially this register will be cleared. The precalculated Montgomery Constant, Jo, is loaded into the coprocessor via a 32 bit shift register and latched in
Latch2.
The A value is shifted in 4 bytes (32 bits) at a time, (Ai) via multiplexer M2 1;2 and latched in Latchl. The value in the B register is serially clocked one bit at a time into a first parallel - serial multiplier ML1. The output of this multiplier, at node nA, is the value A1*B.
The value Aj*B is then summed at adder Adl to the intermediate value stored in register S to produce the value X = Aj*B + S.
For the first 32 clock cycles, the first 32 bit portion of the X value is fed via multiplexer M3~1;4 into a second parallel - serial multiplier ML2, where it is multiplied by the value Jo. The output from ML2 at node nD is the value Y0 = A*B*Jo. Yo is fed back through a 32 bit shift register and latched in Latch2 via multiplexer M.
After the first 32 clock cycles, multiplexer M3~1;4 switches and feeds the modulus N into the multiplier ML2, where N is multiplied by Yo to produce the value Yo*N.
This value is then summed, over the next 544 clock cycles, with X at adder Ad2 to produce the value Z = X + Yo*N. The last 32 bits of this calculation are zero and only the 512 most significant bits are saved back in the S register.
This completes one full rotation.
Sixteen rotations, using a 32 bit multiplication, are required to perform the full 512 bit by 512 bit multiplication, which gives:
P = A.B.I (modN) = P(A.B)N (the result in the Montgomery
Field of numbers).
To recover the required result P is multiplied by H (a pre-calculated Montgomery constant) to give the result in the field of real numbers:
R = A.B (modN)= P(P.H)N
RSA Public Kev Crvotoarashv Implementing the RSA public key cryptographic system requires calculating values of the form Md (modN) where the exponent d may be up to n bits long (where n is the number of binary digits in N). This is done by performing repeated squaring operations and multiply operations depending upon the value of each bit of the exponent value, d taken in sequence. For a 512 bit exponent, approximately 768 modular operations are required. This leads to the following performance calculation for a 512 bit RSA signature at a clock rate of 20MHz: trsa = (544 * 16 * 50 * 768) * 10-6 mS trsa = 334.23 mS Disadvantaaes of the Known Co-Processor Architecture
The known co-processor architecture shown in FIG. 1 is integrated onto a single silicon chip together with a microcontroller. The co-processor is directly driven by the microcontroller's CPU under software control by a program stored either in ROM or in EEPROM. Such a known co-processor arrangement suffers from a number of drawbacks:
The co-processor performance is severely limited
owing to the interaction with the software drivers,
The CPU is restricted by the co-processor dependence
on the CPU providing the Ai value during the
calculation,
The fixed length of the clocked shift registers make
the co-processor inflexible. It is not possible to
handle bit lengths less than the fixed 512 or 256 bit
key length efficiently. It still requires 544 or 288
clock cycles per rotation.
Because the co-processor has a fixed register length
of 512 bits, it becomes unwieldy to handle key
lengths greater than 512 bits. This leads to a high
CPU overhead for key lengths greater than 512 bits
(see timings in Table 1 below)
Because the co-processor utilises fixed length,
clocked shift registers, data has to be loaded and
unloaded from RAM into the co-processor in a timely
fashion. This involves CPU overhead and can lead to
data starvation in some instances where the CPU
cannot supply the co-processor fast enough. This is
particularly true when the co-processor is operating
in half-mode and performing calculations using the
Chinese Remainder Theorem (CRT).
Clocking three 512 bit shift registers, leads to a
high power consumption and leads to a difficult
design problem in terms of a clocking scheme
especially when an increase in computational
performance is attempted by raising the clock
frequency.
In an RSA Public Key Signature/Authentication scheme
where modular exponentiation is required, the current
architecture requires the direct intervention of the
CPU to control the exponentiation process.
The co-processor is a single serial loop design in
that the binary digits are serially shifted one bit
at a time per clock period through one-bit adders,
subtracters and 32 bit by 1 bit parallel - serial
multipliers.
To generate an RSA signature, if the prime factors (p
& q) of N are known then it is possible to use the
Chinese Remainder Theorem (CRT) to substantially
speed up the calculation time. Appendix 2 states the
Chinese Remainder Theorem and details its application
to RSA. The current architecture is simply a modular
multiplier and does not allow easy implementation of
CRT. As a result a substantial CPU overhead tends to
negate the advantage of using CRT.
Typical performance times (CPU time, co-processor time and total time) for the known co-processor arrangement processing different lengths of signature using the
Chinese Remainder Theorem are: Table 1 CPU Co-processor Total 512 bit CRT 95.5 mS 92 mS 187.5 mS Signature 768 bit CRT 568 mS 348 mS 916 mS
Signature 1024 bit CRT 375 mS 680 mS 1055 mS
Signature
New, Improved Co-Processor
Referring now to FIG. 2, a new co-processor as shown offers improved performance and flexibility to overcome the disadvantages of the known co-processor, as discussed above. Features of the new co-processor which provide the improvements will be discussed in detail below (descriptions typically refer to 512 bit calculations for convenience):
Bit Pair Calculation
The new co-processor uses bit-pair multiplication, addition and subtraction. Instead of using a single serial loop clocking scheme as in the co-processor of FIG. 1, the serial bit stream in the new improved co-processor is examined two bits at a time per clock period.
As will be described in detail below, each serial bit stream is split into two (odd and even) component bit streams (bits from the originating serial bit stream being fed alternately into the two component serial bit streams respectively) and the two component bit streams are processed in parallel, one bit being presented by each of the component bit streams at the same time to form a bitpair for calculation. This means that the adders, subtracters and parallel-serial multipliers evaluate and compute results two bits at a time. This change in architecture immediately doubles the performance for the same clock frequency. An immediate advantage is that the computational throughput is almost doubled without a corresponding doubling of power dissipation.
Referring now also to FIG. 3 (which shows a bit-pair adder forming the basis of the new co-processor's bit-pair multipliers, adders and subtracters), the new coprocessor's bit-pair multiplication, addition and subtraction is implemented as follows:
Initially the elements of the adder are set to zero.
The bits Ao and Bo from the odd data stream are added in a carry-safe half-adder to produce odd sum and odd carry outputs So and CO respectively.
The bits AE and BE from the even data stream are input to a carry-safe full-adder which produces even sum and even carry outputs SE and CE respectively.
The signals So and CO are logically combined with the signal CE to produce a signal CE.So + CO, which is input to the full-adder.
The signals So and CE are XORed to produce the odd bit result of the bit-pair addition, and the signal SE forms the even bit result of the bit-pair addition.
The bit pair subtracter uses the same circuitry as the bit-pair adder described above, except thatsfor use as a subtracter the initial values CE and SO are set to logical 1 and the data stream to be subtracted is inverted before input to the half- and full-adder respectively. The subtraction is thus achieved by two's complement addition.
The bit-pair multipliers (which are 2- by 32-bit multipliers) are formed using bit-pair adders as described above.
As the odd and even bits of the serial data streams are presented to the multiplier, the multiplication process proceeds by addition as follows:
if the two input serial data bits are 00", a zero value is added;
if the two input serial data bits are "01", the 32-bit value is added;
if the two input serial data bits are "10", the 32-bit value is left-shifted by one bit, then
added;
if the two input serial data bits are "11", a pre-calculated value of three times the 32-bit
value is added.
Improved Yg Calculation
As described above, the new co-processor uses a bit-pair multiplication scheme to enhance performance. In the known architecture, shown in FIG. 1, this would have involved greatly complicating the Yo control, by adding additional logic and a 3x function to both the J0 and Y0 paths feeding multiplier MUL2. This complication has been avoided as shown in FIG. 2.
Referring to FIG. 1, in the known architecture, at the start of a rotation, for the first 32 clocks cycles, Jo is multiplied by X = A*B + S. The result Y0 is fed back during these first 32 clock cycles and latched in Latch2, after which time Y0 is fed into MUL2 and used to generate the product Yo*N over the following 512 clock cycles.
Referring now to FIGS. 2 and 4, in the new co-processor Jo is initially loaded into latch ML2. Register SR is cleared except for SR~bitl6 which is set. The output of SR~bitk if a logical 1, will enable data to be clocked through the latch ML2 from the MSB down to the kth bit pair. After the first clock cycle in any given rotation, bits 31 and 30 in
ML2 are no longer required and the first two bits of Yo can be fed back and latched into ML2~bit31 and ML2~bit30.
During the first clock cycle the logical 1 at SR~bitl6 is clocked to SR~bitlS, at which point ML2 bit31 and
ML2~bit30 are enabled. On the second clock cycle the logical 1 at SR~bitlS shifts to SR~bitl4. SR~bitlS is reloaded with a logical 1 and now ML2~bit31, ML2~bit30,
ML2~bit29 and ML2~bit28 are enabled. The next two output bits from MUL2 are clocked into ML2~bit31 and ML2~bit30.
The bits previously in ML2~bit31 and ML2~bit30 are shifted to ML2 bit29 and ML2~bit28 respectively. The process repeats until after 16 clock cycles, 32 bits of Yo have fed back and loaded into ML2. On the subsequent 256 clock cycles Yo is multiplied by the modulus N.
For the next rotation, Jo is re- loaded into ML2, SR~bitl5 to SR~bitO is cleared and SR~bitl6 set and the process is repeated.
This implementation obviates the need for one 34 bit shift register, one 32 bit shift register, one 34 bit multiplexer and one 32 bit multiplexer that would otherwise have been necessary for a direct implementation of the bit-pair multiplication scheme, and uses instead one 17-bit shift register.
Register Retlacement As discussed above, the known architecture utilises three 512 bit clocked serial shift registers (B, S and N registers). Data (i.e. value B and modulus value N) are loaded from memory into the B and N registers respectively by the CPU via a bus interface. The CPU feeds the A value into the co-processor, 4 bytes at a time. The CPU subsequently loads the result back into memory from either the B or S register once the calculation is complete. This scheme consumes power and adds CPU overhead.
Referring now to FIGS. 5A, in the new co-processor the previous fixed length, clocked shift registers have now been replaced by making use of a simple 8 bit parallel to serial interface, placed between the RAM and the modular multiplier, together with an automatic RAM pointer mechanism. The RAM interface is shown in FIG. 4. Here each alternate bit is loaded into a 4 bit clocked shift register. There are two such 4 bit clocked serial shift registers forming the odd and even component serial bit streams. These two component serial bit streams are then fed into the modular multiplier.
FIG. 5B shows the arrangement for writing data back into the RAM. The RAM is configured with a double sided'or "dual port" arrangement, where right and left side arrays share a central row decoder. With this arrangement, for a given decoded row, data can be read from the left side array while at the same time data is being written back into the right side array.
The advantage of this scheme is that data in RAM is never loaded into registers by the CPU via load and store instructions, data is simply downloaded into the serial interface automatically when needed by the co-processor.
The fact that each 512 bit clocked shift register is replaced by an 8-bit clocked shift register interface significantly reduces power consumption.
Utilising a mechanism as shown in FIG. 6 below, an automatic RAM pointer and downloading mechanism obviates the need for CPU intervention. The data in RAM is referenced by the RAM pointer and transferred to the serial interface and clocked out. The RAM pointer automatically increments in readiness for the next data transfer. This scheme has the further advantage in that it allows greater flexibility in handling varying key lengths. The co-processor performs a 32-bit by 512-bit multiply per rotation. The number of rotations is determined by the key length. The improved scheme allows the key length to be varied in increments of 32 bits. Once the key length is chosen the number of rotations required for the calculation is automatically determined as a multiple of 32 bits (e.g. 384 / 32 = 12 rotations)
FIG. 2 shows the general arrangement for the improved coprocessor. All data paths are 2 bits wide (unless a wider bit width is clearly required, such as at the 32-bit inputs to the multipliers Mull and Mu12) to allow bit pair operations. The intermediate S value and the B value are stored in dual port RAM as these storage areas are overwritten at various stages of the calculation.
Direct Exoonentiation In the known co-processor, in order to perform exponentiation operations as required for RSA Public Key systems, the CPU has to regulate the exponentiation process under software control by examining each exponent bit in sequence. The current bit is used to decide whether to perform a modular square or a modular multiply. The exponent value is stored in memory and is read by the CPU one byte at a time as needed. The current bit value is determined by an instruction sequence. As the co-processor requires the CPU to provide the A value during the modular operation, the determination of the exponent bit can only happen between modular operations. Only then can the CPU control the co-processor mode of operation.
FIG. 6, shows that by making use of similar automatic RAM pointing mechanism to that described previously, the coprocessor is now controlled automatically during the exponentiation process. At the end of each modular operation (square or multiply), a signal, EOP is generated by the co-processor. This causes the control logic to shift the pointer in the counter register to the next exponent bit. In this way, the next modular operation can be selected and started immediately without the intervention of the CPU. If the exponent bit is a logical 1, two modular operations (square followed by multiply) are performed.
Typical performance times (CPU time, co-processor time and total time) for the new co-processor processing different lengths of signature using the Chinese Remainder Theorem are:
Table 2 CPU (CRT) Co-processor Total 512 bit CRT 34 mS 46 mS 80 mS
Signature 768 bit CRT 82 mS 168 mS 250 mS
Signature 1024 bit CRT 220 mS 340 mS 560 mS
Signature
The improvements provided by the new co-processor arrangement are readily apparent from a comparison of the times in Table 2 with those for the known processor presented in Table 1 above.
In order to further reduce the CPU overhead required in the new co-processor arrangement, two additional arithmetic operations have been added to he co-processor, namely an addition and a subtraction function.
Addition
In the new co-processor, values stored in the B-RAM and S
RAM may be summed together. Referring to FIG. 2, multiplexers Mx2, Mx6 are set to give a logical 0 output.
This means that the output from Subl is equal to the input, bstr. Likewise for subtracter Sub2, the output will be equal to the input, sstr. Data from the B-RAM (bstr) and S-RAM (sstr) are fed serially through subtracters Subl and Sub2. The output from Subl (bstr) is fed to adder Addl via multiplexer Mx3, where it is summed with the output from Sub2 (sstr). The result is returned via multiplexers
Mx7 and Mx8 to the B-RAM.
Subtraction
Values stored in the S-RAM or N -RAM may be optionally subtracted from the value stored in the B-RAM. Referring to FIG. 2, in either case, the data from either the S-RAM or N-RAM is fed serially via multiplexer Mx2 to subtracter
Subl, where it is subtracted from the value stored in the
B-RAM. The result is fed back via multiplexers Mx7 and Mx8 to either the S-RAM or B-RAM.
The inclusion of these additional functions allows an efficient implementation of modular exponentiation using the Chinese Remainder Theorem, as outlined below.
CRT Engine
If the prime factors of the modulus N are known, the CRT may be used to reduce the computation time for a given RSA signature process. The Chinese Remainder Theorem and its application in generating an RSA signature, is given in
Appendix 2. With the known co-processor architecture, there is still a significant CPU overhead in using the CRT technique. This is because the co-processor is first used to evaluate rp = Mpr (modp) and rq = Mqs (modq). The final result is then evaluated under software control by the
CPU. The processing times given immediately above show the significant CPU contribution to the performance degradation.
The inclusion of the addition and subtraction arithmetic functions to the new co-processor's exponentiation functions, as described previously, allows the coprocessor to act as a CRT engine in a way that allows this
CPU overhead to be drastically reduced. FIG. 7, shows how this is implemented.
If the prime factors of N are known, then in order to compute R = Md (modN) using the Montgomery Method and CRT, use is made of the following pre-calculated values: u, Jp, Jq, Hp, Hq, r = d mod(p-l) and s = d mod(q-1). These values in a smartcard device would typically be stored in the EEPROM. The following sequence of calculations is followed: Mp = M (modp) (1)
Mq = M (modq) (2) rp = Mpr (modp) (3)
rq = MqS (modq) (4)
a = rq (modp) (5)
b = rp - a (6)
c = b * u (modp) (7)
g = c* q (8)
R = g + rq (9)
The new co-processor architecture as described above, now has all of the necessary functionality to be able to efficiently calculate the required result using the CRT method. Appropriate sequencing of events to allow the new co-processor to perform this calculation are described below. The control of the sequence may be'under software control using the CPU. In this case the CPU overhead is now minimal, otherwise control of the sequence of calculations may be done using a dedicated hardware state machine.
In the above sequence of calculations, operations (1), (2), (3), (4), (5) and (7) are all modular operations that use the Montgomery Algorithm and use the co-processor as a modular multiplier. The memory pointing mechanism of the new co-processor now allows these intermediate results to be returned to pre-designated locations within memory in readiness for subsequent stages of the CRT calculation.
Stage (8) uses the ordinary multiply function, whilst stages (6) and (9) make use of the new arithmetic operations that are now available within the new coprocessor, namely, addition and subtraction.
CRT Engine Operation
Reference is now made to FIG. 7. For the purposes of the following description, the A-RAM area, B-RAM area, N-RAM and S-RAM area are divided into regions AL and AH, BL and
BH, NL and NH, SL and SH respectively.
The message M is first stored in the B-RAM and the prime factors p and q are stored in memory N-RAM areas NL and NH respectively. The message M is then multiplied by 1 modulo p to give the result Mp. This value is initially returned to the S-RAM area, SL and then transferred to the A-RAM area AL. In a similar fashion the value Mq is calculated and returned to S-RAM area SH after which it is transferred to A-RAM area AH.
Mp and Mq are next loaded into the B-RAM areas BL and BH respectively in preparation for the following exponentiation process.
The two modular exponentiations of Mpr(modp) and MqS(modq) are then performed using the newly incorporated exponentiation functions and the results rp and rq are stored in BL and BH, overwriting the values Mp and Mq respectively.
Next the value a = rq(modp) is calculated. This is done by multiplying rq times 1 modulo p. The result is stored for convenience in SH Next the value b = (rp - a) is calculated. This is carried out by invoking the newly incorporated subtraction function and the result is returned to BL , overwriting rp.
Next c= b*u (modp) is calculated. This is a modular multiplication with the result being returned to BL, overwriting the value b on the final rotation.
Next the product g = c*q is formed by invoking the ordinary multiply function. The result is stored in S-RAM area, S.
Finally the result R = g + rq is calculated by applying the newly incorporated addition function. This value is returned to either the S-RAM or B-RAM.
It will be appreciated that various modifications to the above described new co-processor will be apparent to a person of ordinary skill in the art, and may be made without departing from the scope invention as set out in the following claims.
Appendix 1
Montaomerv Modular Reduction Technique
The Montgomery function P(A.B)N performs a multiplication modulo N of the product A.B into the P field. The retrieval from the P field back into the normal modular field is performed by enacting P on the result of P(A.B)N panda precalculated constant H.
Thus if P == P(A.B)N, then P(P.H)N == A.B (modN).
Proof
We require to calculate R = A.B (modN).
First find Q, such that: P2" = A.B + Q.N (where N is odd) (1)
Note:
I.2n == 1 (modN) (and n is the bit length of N) (2)
Multiply equation (1) by I to give: P.I.2n = A.B.I + Q.I.N (3)
Consider the left side of (3), from (2): P.I.2n == P (modN) q Consider the right side of (3), then from (4):
P == (A.B.I + Q.I.N) (modN), and therefore:
P == A.B.I (modN) = P(A.B)N (5)
Consider P(P.H)N then from (5):
P(P.H)N == A.B.I2.H (modN) (6)
Clearly if H is defined as I-2 then:
R == P(P.H)N == A.B (modN) (7)
Equation (7) gives the desired result.
From (2) above, H = 22n (modN) and is a precalculated constant depending only on N and n.
It next requires that Q be found. From (1) it can be seen that:
{A.B.I + Q.I.N) (mod2n) = 0 (8)
This implies:
A.B.I (mod2") = -Q.I.N (mod2n) and therefore,
Q == -N-l A.B (mod2n) (9)
For odd N, J = N-1 such that N.J = I.2" + 1.
Hence Q == - A.B.J (mod2n).
Note, J is also a precalculated constant depending only on
N and n.
Appendix 2
Chinese Remainder Theorem
The Chinese Remainder Theorem may be stated as follows.
For a given set of integers m0, m1, m2, , mk such that gcd(m1, m2, m3, , mk) = 1, then for any set of integers ro, r1, r2, , rk such that ri < mi (0 < i < k), there exists a unique integer X such that
X (modmi) = ri (0 < i < k) and X < m0mlm2 mk.
Chinese Remainder Theorem as addled to RSA
In the RSA system the modulus N is the product of two large prime factors, p and q. As p and q are prime, then gcd(p, q) = 1 {gcd = greatest common divisor}.
Therefore, for some integers rp and rq such that rp < p and rq < q, there exists a unique integer R (R < N) such that R (modp) = rp and R (modq) = rq.
In general we have:
(M modN) modp = X modp = rp
(M modN) modq = X modq = rq Suppose that R= Md (modN), then we can use the Chinese
Remainder Theorem as follows:
rp= R modp = (Md (modN)) modp
rq= R modq = (Md (modN)) modq
Also suppose d = k*(p - 1) + r, then by the Euler - Fermat
Theorem
rp= (M P - 1)k Mr (modp) = 1k Mr (modp) = (M modp) r modp
Similarly if d = j*(q - 1) + s,
rq= (M qw 1)j Ms (modq) = lj Ms (modq) = (M modq)S modq
Also, r = d (mod (p - 1)) and s= d (mod (q - 1))
Hence in order to calculate R, where R = Md (mooN) 1) Compute:
a) rp= (M modp)d mod(p-l) modp
b) rq= (M modq)d 'nod(q-1) modq 2) Find u with 0 < u < p and,
u * q = 1 (modp) 3) Use one of:
a) R = (((rp - (rq modp)) * u) modp) * q + rq
(where a > rq modp)
b) R = (((rp + p - (rq modp)) * u) modp) * q + rq
(where a < rq modp)
Thus the problem of calculating R = Md (modN), where M, N and d are n binary digit values, is reduced to one of calculating two values rp and rq involving n/2 binary digit values. This represents a considerable saving in computation time.
Claims (8)
1. A co-processor for performing modular multiplication comprising:
means for receiving B and N binary data streams;
means for receiving a data value A;
adder means, subtractor means and multiplier means coupled to sequentially process the B and N binary data streams and the data value A to produce a moduloreduced multiplication value (A*B) mod N;
wherein the co-processor further comprises splitter means for splitting each of the B and N binary data streams into component data streams comprising respectively alternate bits of the binary data streams, and
the adder means, subtractor means and multiplier means are arranged to process the component data streams in parallel.
2. A co-processor according to claim 1 wherein the means for receiving the binary data streams comprises:
random access memory for holding B and N values; and
parallel-serial interface means for receiving parallel data from the random access memory and for producing therefrom the binary data streams B and N.
3. A co-processor according to claim 2 wherein the means for receiving the binary data streams further comprises an auto-indexing random access memory pointer for sequentially referencing a plurality of random access memory locations holding sequential portions of the B and N values.
4. A co-processor according to claim 3 wherein the co-processor is arranged to perform a number of processing iterations dependent upon the number of random access memory locations holding the B and N values.
5. A co-processor according to any preceding claim including exponentiation means comprising:
random access memory for holding an exponent value;
parallel-serial interface means for receiving in parallel from the random access memory the exponent value and for producing therefrom a binary data stream
E;
control means for receiving the binary data stream
E and for initiating a square or a multiply operation in dependence on the value of each bit thereof.
6. A co-processor according to claim 5 wherein the exponentiation means further comprises an auto-indexing random access memory pointer for sequentially referencing a plurality of random access memory locations holding sequential portions of the exponent value.
7. A co-processor according to any preceding claim arranged to perform the Chinese Remainder Theorem.
8. A co-processor substantially as hereinbefore described with reference to FIGS. 2-7 of the accompanying drawings.
Priority Applications (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
GB9622719A GB2318892B (en) | 1996-10-31 | 1996-10-31 | Co-processor for performing modular multiplication |
PCT/EP1997/005980 WO1998019230A1 (en) | 1996-10-31 | 1997-10-22 | Co-processor for performing modular multiplication |
EP97948836A EP0877979A1 (en) | 1996-10-31 | 1997-10-22 | Co-processor for performing modular multiplication |
JP10520055A JP2000512786A (en) | 1996-10-31 | 1997-10-22 | Coprocessor for performing modular multiplication |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
GB9622719A GB2318892B (en) | 1996-10-31 | 1996-10-31 | Co-processor for performing modular multiplication |
Publications (3)
Publication Number | Publication Date |
---|---|
GB9622719D0 GB9622719D0 (en) | 1997-01-08 |
GB2318892A true GB2318892A (en) | 1998-05-06 |
GB2318892B GB2318892B (en) | 2001-07-11 |
Family
ID=10802258
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
GB9622719A Expired - Fee Related GB2318892B (en) | 1996-10-31 | 1996-10-31 | Co-processor for performing modular multiplication |
Country Status (4)
Country | Link |
---|---|
EP (1) | EP0877979A1 (en) |
JP (1) | JP2000512786A (en) |
GB (1) | GB2318892B (en) |
WO (1) | WO1998019230A1 (en) |
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2001088693A2 (en) * | 2000-05-17 | 2001-11-22 | Giesecke & Devrient Gmbh | Cryptographic method and cryptographic device |
WO2003023605A2 (en) * | 2001-09-06 | 2003-03-20 | Infineon Technologies Ag | Device and method for calculating the result of a modular exponentiation |
GB2383435A (en) * | 2001-12-18 | 2003-06-25 | Automatic Parallel Designs Ltd | Logic circuit for performing modular multiplication and exponentiation |
US7260595B2 (en) | 2002-12-23 | 2007-08-21 | Arithmatica Limited | Logic circuit and method for carry and sum generation and method of designing such a logic circuit |
Families Citing this family (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
DE10206089A1 (en) | 2002-02-13 | 2002-08-14 | Zimmer Ag | bursting |
CN102207847B (en) * | 2011-05-06 | 2013-12-04 | 广州杰赛科技股份有限公司 | Data encryption and decryption processing method and device based on Montgomery modular multiplication operation |
CN109271137B (en) * | 2018-09-11 | 2020-06-02 | 网御安全技术(深圳)有限公司 | Modular multiplication device based on public key encryption algorithm and coprocessor |
Family Cites Families (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JPS58146129A (en) * | 1982-02-24 | 1983-08-31 | Usac Electronics Ind Co Ltd | Parallel-serial conversion circuit |
EP0188779A1 (en) * | 1984-12-27 | 1986-07-30 | Siemens Aktiengesellschaft | Fast digital multiplier |
JP2599999B2 (en) * | 1989-09-13 | 1997-04-16 | 富士通株式会社 | Modem |
EP0576262B1 (en) * | 1992-06-25 | 2000-08-23 | Canon Kabushiki Kaisha | Apparatus for multiplying integers of many figures |
US5513133A (en) * | 1992-11-30 | 1996-04-30 | Fortress U&T Ltd. | Compact microelectronic device for performing modular multiplication and exponentiation over large numbers |
US5349551A (en) * | 1993-07-30 | 1994-09-20 | The United States Of America As Represented By The Director Of National Security Agency | Device for and method of preforming an N-bit modular multiplication in approximately N/2 steps |
-
1996
- 1996-10-31 GB GB9622719A patent/GB2318892B/en not_active Expired - Fee Related
-
1997
- 1997-10-22 WO PCT/EP1997/005980 patent/WO1998019230A1/en not_active Application Discontinuation
- 1997-10-22 EP EP97948836A patent/EP0877979A1/en not_active Withdrawn
- 1997-10-22 JP JP10520055A patent/JP2000512786A/en active Pending
Cited By (9)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2001088693A2 (en) * | 2000-05-17 | 2001-11-22 | Giesecke & Devrient Gmbh | Cryptographic method and cryptographic device |
WO2001088693A3 (en) * | 2000-05-17 | 2002-02-28 | Giesecke & Devrient Gmbh | Cryptographic method and cryptographic device |
AU2001265967B2 (en) * | 2000-05-17 | 2005-11-24 | Giesecke+Devrient Mobile Security Gmbh | Cryptographic method and cryptographic device |
US7227947B2 (en) | 2000-05-17 | 2007-06-05 | Giesecke & Devrient Gmbh | Cryptographic method and cryptographic device |
WO2003023605A2 (en) * | 2001-09-06 | 2003-03-20 | Infineon Technologies Ag | Device and method for calculating the result of a modular exponentiation |
WO2003023605A3 (en) * | 2001-09-06 | 2004-04-01 | Infineon Technologies Ag | Device and method for calculating the result of a modular exponentiation |
US7248700B2 (en) | 2001-09-06 | 2007-07-24 | Infineon Technologies Ag | Device and method for calculating a result of a modular exponentiation |
GB2383435A (en) * | 2001-12-18 | 2003-06-25 | Automatic Parallel Designs Ltd | Logic circuit for performing modular multiplication and exponentiation |
US7260595B2 (en) | 2002-12-23 | 2007-08-21 | Arithmatica Limited | Logic circuit and method for carry and sum generation and method of designing such a logic circuit |
Also Published As
Publication number | Publication date |
---|---|
JP2000512786A (en) | 2000-09-26 |
GB2318892B (en) | 2001-07-11 |
GB9622719D0 (en) | 1997-01-08 |
WO1998019230A1 (en) | 1998-05-07 |
EP0877979A1 (en) | 1998-11-18 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
EP0890147B1 (en) | Co-processor for performing modular multiplication | |
US7277540B1 (en) | Arithmetic method and apparatus and crypto processing apparatus for performing multiple types of cryptography | |
JP4955182B2 (en) | Integer calculation field range extension | |
US5742530A (en) | Compact microelectronic device for performing modular multiplication and exponentiation over large numbers | |
JP3525209B2 (en) | Power-residue operation circuit, power-residue operation system, and operation method for power-residue operation | |
US8078661B2 (en) | Multiple-word multiplication-accumulation circuit and montgomery modular multiplication-accumulation circuit | |
US7962758B2 (en) | Method and apparatus for processing arbitrary key bit length encryption operations with similar efficiencies | |
US5121429A (en) | Digital signal processing | |
US7240204B1 (en) | Scalable and unified multiplication methods and apparatus | |
GB2318892A (en) | Co-processor for performing modular multiplication | |
Jung et al. | A reconfigurable coprocessor for finite field multiplication in GF (2n) | |
US7113593B2 (en) | Recursive cryptoaccelerator and recursive VHDL design of logic circuits | |
US20240220201A1 (en) | A method and architecture for performing modular addition and multiplication sequences | |
Koppermann et al. | Fast FPGA implementations of Diffie-Hellman on the Kummer surface of a genus-2 curve | |
GB2318890A (en) | Co-processor for performing modular multiplication | |
KR100297110B1 (en) | Modular multiplier | |
GB2318891A (en) | Co-processor for performing modular multiplication | |
GB2321979A (en) | Modular multiplication circuit | |
KR20000000770A (en) | Device for multiplying modular | |
US7403965B2 (en) | Encryption/decryption system for calculating effective lower bits of a parameter for Montgomery modular multiplication | |
GB2332542A (en) | Multiplication circuitry | |
KR19990086179A (en) | Modular computing apparatus and method thereof | |
JP2004226516A (en) | Power remainder computing method and program for the same | |
Shirase et al. | An architecture for elliptic curve cryptograph computation | |
JP3137599B2 (en) | Circuit for calculating the remainder of B raised to the power of C modulo n |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
732E | Amendments to the register in respect of changes of name or changes affecting rights (sect. 32/1977) | ||
PCNP | Patent ceased through non-payment of renewal fee |
Effective date: 20041031 |
|
732E | Amendments to the register in respect of changes of name or changes affecting rights (sect. 32/1977) |
Free format text: REGISTERED BETWEEN 20090917 AND 20090923 |