Fast precomputation for montgomery multipliers

Abstract

A Montgomery multiplication apparatus (MMA) for multiplying two multiplicands and then taking a modulus of a predefined number includes a precomputation circuit and a Montgomery multiplication circuit. The precomputation circuit is configured to compute Montgomery precomputation values by performing a series of iterations. In a given iteration, the precomputation circuit is configured to modify one or more intermediate values by performing bitwise operations on the intermediate values computed in a previous iteration. The Montgomery multiplication circuit is configured to multiply the two multiplicands and then take the modulus of the predefined number by performing a plurality of Montgomery reduction operations using the Montgomery precomputation values computed by the precomputation circuit.

Description

[0001] Cross Reference to Related Applications

[0002] This application is related to U.S. Patent Application No. 1058-2082, entitled "Efficient Montgomery Multiplier," filed on even date herewith, the disclosure of which is incorporated herein by reference. Technical Field

[0003] The present application relates generally to Montgomery algorithms and, more particularly, to the calculation of Montgomery precomputed values ​​and the implementation of Montgomery multipliers and related circuitry. Background Art

[0004] In cryptography, operations such as modular multiplication and exponentiation of large integers are widely used. Several methods have been proposed for quickly implementing such multiplication and exponentiation. One such method, which is widely used, was proposed by Peter Lawrence Montgomery in 1985 and is described, for example, by Kork et al. in “Analyzing and Comparing Montgomery Multiplication Algorithms” (IEEE Micro, Vol. 16, No. 3, June 1996, pp. 26-33), in which the authors discuss several Montgomery multiplication algorithms and provide a detailed analysis of their space and time requirements.

[0005] In "Modified Montgomery modular multiplication and RSA exponentiation techniques" (IEE Proceedings on Computation Digital Techniques, Vol. 151, No. 6, November 2004), McIvor et al. present a modified Montgomery multiplication and related Rivest-Shamir-Adleman (RSA) exponentiation algorithm and circuit architecture for large-word addition using a carry-save adder (CSA). The proposed method is based on reformulating the solution to modular multiplication within the context of RSA exponentiation, and two algorithm variants are proposed: one based on a 5-2 CSA and the other based on a 4-2 CSA plus a multiplexer. Summary of the Invention

[0006] Embodiments of the invention described herein provide a Montgomery multiplication apparatus (MMA) for multiplying two multiplicands and taking a modulus by a predefined number. The MMA includes a precomputation circuit and a Montgomery multiplication circuit. The precomputation circuit is configured to compute Montgomery precomputation values by performing a series of iterations. In a given iteration, the precomputation circuit is configured to modify one or more intermediate values by performing bitwise operations on the intermediate values computed in a previous iteration. The Montgomery multiplication circuit is configured to multiply the two multiplicands and take a modulus by the predefined number by performing a plurality of Montgomery reduction operations using the Montgomery precomputation values computed by the precomputation circuit.

[0007] In some embodiments, the Montgomery precomputation values are powers of two that are at least two times the number of bits of the Montgomery multiplicands.

[0008] In some embodiments, the precomputation circuit is configured to modify the bitwise sum and the bitwise carry in a given iteration by performing a bitwise sum and a bitwise carry operation on (i) the bitwise sum computed in a previous iteration, (ii) twice the bitwise carry computed in the previous iteration, and (iii) a modulus correction number. In an example embodiment, the precomputation circuit is configured to compute the Montgomery precomputation values based on a sum of twice the bitwise sum and the bitwise carry after a last iteration of the series of iterations. In another embodiment, the precomputation circuit is configured to compute the modulus correction number based on a sum of twice the bitwise sum and the bitwise carry computed in the last iteration.

[0009] In yet another embodiment, the precomputation circuit is configured to compute the modulus correction number in a given iteration based on a difference between a sum of the bitwise sum and the bitwise carry computed in a previous iteration and the predefined number. In another embodiment, the precomputation circuit is configured to compute the modulus correction number in a given iteration based on a subset of most significant bits of a sum of the bitwise carry and the bitwise sum computed in a previous iteration and a subset of most significant bits of the predefined number.

[0010] In the disclosed embodiments, the precomputation circuit is configured to compute the modulus correction number in a given iteration based on a subset of bits of a sum of the bitwise carry and the bitwise sum computed in a previous iteration and a subset of bits of the predefined number. In an embodiment, the precomputation circuit is configured to set the modulus correction number to the predefined number multiplied by -1, -2, or 0. In an embodiment, the precomputation circuit includes a carry save adder (CSA) configured to compute, in a given iteration, (i) twice the bitwise sum computed in a previous iteration, (ii) twice the bitwise carry computed in the previous iteration, and (iii) a bitwise sum and a bitwise carry of the modulus correction number set to the predefined number multiplied by -1, -2, or 0.

[0011] In some embodiments, the pre-computation circuit includes a three-input carry-save adder (CSA) configured to compute, in a given iteration, (i) twice a carry-save sum computed in a previous iteration, (ii) twice a carry-save carry computed in the previous iteration, and (iii) a carry-save sum and carry of a modulus correction number set to a predefined number multiplied by -1, -2, or 0. In other embodiments, the pre-computation circuit includes a four-input carry-save adder (CSA) configured to compute, in a given iteration, (i) twice a carry-save sum computed in a previous iteration, (ii) twice a carry-save carry computed in the previous iteration, (iii) a first modulus correction number set to a predefined number multiplied by -1 or 0, and (iv) a second modulus correction number set to a predefined number multiplied by -2 or 0.

[0012] In some embodiments, the pre-computation circuit and the Montgomery multiplication circuit are included in a network device and are configured to perform an encryption operation of the network device.

[0013] According to embodiments of the present invention, there is additionally provided a method for multiplying two multiplicands and then taking a modulus of a predefined number. The method includes computing Montgomery pre-computation values using a pre-computation circuit by performing a series of iterations including modifying one or more intermediate values in a given iteration by performing bitwise operations on intermediate values computed in a previous iteration. The two multiplicands are multiplied and then taking a modulus of the predefined number using a Montgomery multiplication circuit by performing a plurality of Montgomery reduction operations using the Montgomery pre-computation values computed by the pre-computation circuit.

[0014] According to embodiments of the present invention, there is additionally provided an integrated Montgomery computation engine (IMCE) for multiplying two multiplicands and then taking a modulus of a predefined number. The IMCE includes a carry-save adder (CSA) circuit and a control circuit. The CSA circuit has a plurality of inputs and has outputs including a sum output and a carry output. The control circuit is coupled to the inputs and outputs of the CSA circuit and is configured to operate the CSA circuit in at least (i) a first setting to compute Montgomery pre-computation values and (ii) a second setting to compute a Montgomery multiplication of the two multiplicands.

[0015] In some embodiments, the control circuit is configured to logically shift the sum output and the carry output of the CSA circuit and couple the shifted sum output and the shifted carry output to respective inputs of the CSA circuit. In an example embodiment, the control circuit is configured to logically left-shift the sum output and the carry output of the CSA circuit in the first setting and to logically right-shift the sum output and the carry output of the CSA circuit in the second setting.

[0016] In an embodiment, in the first setting, the control circuit is configured to set two of the inputs of the CSA circuit to constant values that depend on a predefined number. In another embodiment, in the first setting, the control circuit is configured to set the inputs of the CSA circuit to a predefined number or zero, depending on the most significant bits of the sum output and the carry output of the CSA circuit and the two multiplicands. In yet another embodiment, in the second setting, the control circuit is configured to set the inputs of the CSA circuit to zero or one of the multiplicands, depending on the other multiplicand. In the disclosed embodiment, in the second setting, the control circuit is configured to set the inputs of the CSA circuit to zero or a predefined number, depending on the least significant bits of the sum output, the carry output and the two multiplicands.

[0017] In some embodiments, the control circuit is configured to further operate the CSA circuit in a third setting that computes a power of a predefined exponent to a predefined base, followed by a modulo by a predefined number. In an embodiment, the control circuit is configured to operate the CSA circuit in the third setting by applying the first and second settings in a sequence defined in accordance with the exponent.

[0018] In some embodiments, the CSA and control circuit are included in a network device and configured to perform cryptographic operations of the network device.

[0019] There is also provided, in accordance with an embodiment of the present application, a method for multiplying two multiplicands followed by a modulo by a predefined number. The method includes operating a carry-save adder (CSA) circuit having a plurality of inputs and having outputs including a sum output and a carry output. Using a control circuit coupled to the inputs and outputs of the CSA circuit, the CSA circuit is controlled to operate in at least (i) a first setting that computes Montgomery pre-computed values and (ii) a second setting that computes Montgomery multiplication of the two multiplicands.

[0020] The present application will be more fully understood from the following detailed description of embodiments, taken together with the drawings, in which: BRIEF DESCRIPTION OF DRAWINGS

[0021] Figure 1 is a block diagram schematically illustrating a Montgomery multiplication apparatus (MMA) in accordance with an embodiment of the present application;

[0022] Figure 2 is a block diagram schematically illustrating a Montgomery pre-computation circuit (MPC) in the MMA of Figure 1

[0023] Figure 3 is a flowchart schematically illustrating a method for Montgomery pre-computation in accordance with an embodiment of the present application; ​

[0024] Figure 4 is a block diagram schematically illustrating an MMA with pre-computation circuitry integrated in a Montgomery computation engine according to an embodiment of the application;

[0025] Figure 5 is a block diagram schematically illustrating an integrated Montgomery computation engine (IMCE) according to an embodiment of the application;

[0026] Figure 6 is a flowchart schematically illustrating a method for Montgomery 4096x4096 multiplication according to an embodiment of the application; and

[0027] Figure 7 is a flowchart schematically illustrating a method for exponentiation according to an embodiment of the application. DETAILED DESCRIPTION

[0028] SUMMARY

[0029] Public-key cryptography systems can be used to provide data confidentiality, author authentication, and data integrity. Some public-key cryptography systems, such as the Rivest-Shamir-Adleman (RSA), rely on exponentiation of large numbers, which requires repeated modular multiplication. To improve security, the size of the operands in length is typically much more than 1000 bits, which increases the computational load of the exponentiation operation.

[0030] A typical algorithm for reducing the computational load of modular multiplication is the Montgomery algorithm (e.g., described in the above cited article by Kork et al.). The Montgomery multiplication algorithm replaces trial division by the modulus with a series of additions and divisions by powers of two, and is the most common algorithm used in RSA cryptography systems today.

[0031] The Montgomery algorithm can be implemented in hardware or software. Typically, hardware implementations are based on repeated operations preceded by pre-computation of one or more values and followed by carry propagation operations and a final modulus correction. The pre-computed values can be, for example, (2 2n ) % R, where n is the number of bits of the Montgomery operand, "%" denotes the modulo operation, and R, the divisor, is a pre-selected number (R < 2 n ).

[0032] Embodiments of the invention described herein provide efficient methods and apparatus for computing Montgomery precomputation values. In some disclosed embodiments, a Montgomery multiplication apparatus (MMA) is configured to multiply two multiplicands and take a modulus by a predefined number. In some embodiments, the MMA includes a precomputation circuit and a Montgomery multiplication circuit. The precomputation circuit is configured to compute Montgomery precomputation values by performing a series of iterations. In a given iteration, the precomputation circuit modifies one or more intermediate values by performing bitwise operations on intermediate values computed in a previous iteration. In embodiments, in a given iteration, the precomputation circuit modifies a bitwise sum and a bitwise carry by performing bitwise sum and carry operations on (i) a bitwise sum computed in a previous iteration, (ii) twice a bitwise carry computed in the previous iteration, and (iii) a modulus correction number. The Montgomery multiplication circuit is configured to multiply the two multiplicands and take a modulus by the divisor by performing a plurality of Montgomery reduction operations using the Montgomery precomputation values computed by the precomputation circuit.

[0033] In some embodiments, two additional bits are added to the operands of the precomputation and / or Montgomery multiplication to avoid a final modulus correction step; thus, for 4096-bit arithmetic, 4098-bit operands are used. Adding the two bits also prevents overflow of the intermediate values.

[0034] Other embodiments according to the invention presented herein provide an integrated Montgomery computation engine (IMCE) in which the precomputation circuit is embedded in the Montgomery multiplication circuit; in embodiments, the same bitwise sum and carry circuitry is used during precomputation and Montgomery multiplication.

[0035] In some embodiments, the IMCE includes a CSA and a control circuit. The control circuit is configured to manage operation of the CSA in a plurality of settings; in a first setting, the control circuit controls the CSA to perform Montgomery precomputation computation; in a second setting, the control circuit controls the CSA to perform Montgomery multiplication, and in a third setting, the control circuit controls the CSA to compute exponentiation using a sequence of Montgomery multiplications. In embodiments, the control circuit includes a first circuit configured to control a loopback input of the CSA and a second circuit that can configure the CSA (via the first circuit) to compute exponentiation.

[0036] In the example embodiments described below, the number of bits of the Montgomery operands is 4098; however, the disclosed techniques are not limited to 4098 bits; any other suitable number of bits can be used in alternative embodiments.

[0037] The disclosed MMAs and IMCEs can be embedded in various host systems and used in various use cases. Generally, any system involving Montgomery multiplication can benefit from the technology described herein. Example host systems include various network devices such as network adapters (e.g., Ethernet network interface controllers (NICs), Infiniband host channel adapters (HCAs), data processing units (DPUs) or “smart NICs,” network-enabled graphics processing units (GPUs)), network switches and routers, and accelerators, among others.

[0038] In one example use case, the disclosed MMAs and / or IMCEs are embedded in a network device and used in a secure boot process for the network device, e.g., for signed attestation. In another example use case, the disclosed MMAs and / or IMCEs are embedded in a network adapter and used to accelerate cryptographic operations such as public key operations.

[0039] System Description

[0040] Figure 1 is a block diagram schematically illustrating a Montgomery multiplication apparatus (MMA) 100 according to an embodiment of the present invention. The MMA 100 computes the product of a pair of numbers modulo a large prime number N and comprises a Montgomery computation engine (MCE) 102, a Montgomery precomputation unit (MPC) 104, and a processor 106. Here, the MCE 102 is also referred to as a Montgomery multiplication circuit. Depending on the applicable host system and use case, the processor 106 can comprise or can be embedded in, for example, a CPU, a GPU, a system on a chip (SoC), a controller, a digital signal processor (DSP), or any other suitable type of processor.

[0041] The MCE 102 is configured to receive the multiplication arguments A, B, and the divisor N from the processor 106 and the precomputed value 2 R N from the MPC 104 and to output the product (A*B) % N to the processor 106. The MCE 102 can be a processor executing a suitable software program or a hardware Montgomery multiplier (see, e.g., Thampi and Jose, “Montgomery Multiplier for Faster Cryptosystems,” Procedia Technology 25 (2016), pp. 392-398). In some embodiments, the MCE 102 comprises additional circuitry that computes exponents based on Montgomery multiplication (see, e.g., the above-cited article by Mclvor et al.).

[0042] The MPC 104 is configured to receive N and -N from the processor 106. N and -N are typically represented in n+2 bits, where n is the number of bits used in the Montgomery multiplication. (-N can be represented by "two's complement" representation: -N = ~N + 1 (N inverse + 1)).

[0043] The MPC 104 then computes the pre-computed value (2 2n ) % N and sends the result to the MCE 102. In embodiments, the MPC comprises three or four carry-save adders (CSAs) and the computation is done in a number of cycles close to n (the number of bits).

[0044] The processor 106 is configured to send the operands (multiplicand) to the MCE 102 and the MPC 104, and to receive the multiplication result from the MCE 102. In some embodiments, the processor 106 can not be needed, e.g. if the MPC 104 comprises a processor.

[0045] The configuration of the MMA 100 is an example configuration depicted for conceptual clarity only. Other suitable configurations can be used in alternative embodiments of the invention. For example, in some embodiments, a single MPC is configured to pre-compute values for multiple MCEs. In another example, the MPC 104 is configured to compute -N by taking the two's complement of N; thus, the processor 106 does not send -N to the MPC 104.

[0046] In some embodiments, the processor 106 and / or the MPC 104 comprise a general purpose processor programmed in software to perform the functions described herein. The software can be downloaded to the processor, e.g. in electronic form, over a network or from a host computer, or the software can alternatively or additionally be provided and / or stored on a non-transitory tangible medium, such as a magnetic, optical or electronic memory.

[0047] Figure 2 is a block diagram schematically illustrating a Montgomery pre-computation circuit (MPC) 104 according to an embodiment of the invention. The MPC comprises a four-input carry-save adder (CSA) 200 configured to sum four inputs (designated In[0] to In[3]). The value of -N (N being the modulus) is input (e.g. from the processor 106, Figure 1 ) to the MPC. And is applied to the R_0 input of AND gate 202 and the R_1 input of AND gate 204. The AND gates 202 and 204 are configured to pass the -N input (to inputs in[0] and in[1] of the CSA, respectively) when enabled, and to pass the value "0" otherwise. (The enable inputs of the AND gates 202 and 204 are designated en_0 and en_1, respectively.)

[0048] It should be noted that when en_0 and en_1 are both off (e.g., at logic 0), CSA 200 receives a combined value of "0" at inputs in[0] and in[1]; when one of en_0 and en_1 is on, the CSA receives a combined value of "-N", and when both en_0 and en_1 are on, the CSA receives a combined value of "-2N".

[0049] Two registers (R_C register 206 and R_S register 208) are configured to store the carry-out and sum-out, respectively, of CSA 200. The data stored in R_C 206 can be routed back to the in[3] input of CSA 200 via shifter 210, while the data stored in R_S 208 can be routed back to the in[2] input via shifter 212. Shifters 210 and 212 are configured to multiply the data by 2 by shifting it left by one position (with the rightmost output bit set to logic 0).

[0050] MPC 104 also includes a control unit 214 configured to drive inputs en_0 and en_1 of AND gates 202 and 204. Figure 3 ), in an embodiment, only a few more significant bits (eg, the five most significant bits) of N and R_SC are input to the control unit 214.

[0051] In an embodiment, the pre-calculation process performed by MPC 104 includes a carry-save stage in which CSA 200 generates a sum and carry representation of the pre-calculated value, and adds the sum and carry (stored in R_S 208 and R_C 206, respectively) to produce the pre-calculated value P=2 2n %N carry propagation stage. Figure 2 In the example embodiment illustrated in FIG, MC 104 includes a full adder 216 configured to add the values ​​stored in R_S 208 and R_C 206 to produce a precomputed value P. In the example embodiment, full adder 216 includes 64 bits and can perform a 4096-bit addition in 64 cycles (as will be described below, an additional two bits may be required in the CSA, so full adder 216 may require 65 cycles to perform a 4098-bit addition).

[0052] In summary, MPC 104 calculates P=2 in the iterative carry-save phase and then in the iterative carry-propagate phase. 2n % N. In the carry-save stage, the 4-input CSA iteratively computes P by adding the value of 0, -N, or -2N and the left-shifted carry and save result from the previous iteration. In the carry-propagate stage, the full adder iteratively sums the carry and the sum from the carry-save stage to produce P.

[0053] As will be appreciated, the configuration of MPC 104 is an example configuration depicted for conceptual clarity only. Other suitable configurations may be used in alternative embodiments of the present invention. For example, a three-input CSA may be used instead of a four-input CSA, where AND gates 202, 204 are replaced by a multiplexer configured to output 0, -N, or -2N to a single CSA input instead of in[0] and in[1]. In embodiments, shifters 210 and / or 212 may not be required; instead, R_S and R_C may be wired to in[2] and in[3] in a shifted manner (e.g., R_S[0] is wired to in[2][1], R_S[1] is wired to in[2][2], and so on).

[0054] Reserving the final subtraction stage

[0055] According to the original Montgomery paper and its early implementations, the Montgomery multiplication is followed by a final step in which a modulo correction of the result C is performed:

[0056] if(C>N)C=CN.

[0057] This operation is relatively expensive because it requires full carry propagation. In addition, by externally measuring the number of Montgomery multiplication cycles, a hacker trying to find the key can infer whether a modulo correction is required, thereby narrowing the range of possible key values. However, in an article by Walter entitled "Montgomery exponentiation needs no final subtractions" (Electronics Letters, Vol. 35, No. 21, 1999), the author teaches how the final modulo correction can be avoided if the number of bits in the Montgomery multiplication is increased by 2. The following table describes the differences between the original Montgomery algorithm and Walter's proposal:

[0058]

[0059] Therefore, in some embodiments, the MPC 104 calculates a pre-calculated value with an exponent greater than 2n, for example, calculating R=2 2(n +2) .

[0060] Figure 3 3 is a flow chart 300 schematically illustrating a method for Montgomery precomputation according to an embodiment of the present invention. Figure 1 ) is executed. The flowchart begins with the initialization carry-save addition step 302, where the MPC sets the initial values ​​to include R_0, R_1, R_S and R_C (all referenced above). Figure 2Step 302 includes: initializing R0 and R1 to n+3 bits of -N; initializing R_S to 2 n Initialize R_C to the N+1-bit representation of 0 and initialize the counter to 4096+4.

[0061] The MPC then enters a carry-save addition step 304, in which the MPC: i) sets en_0 to 1 if the number represented by the five most significant bits of S_N is greater than the number represented by the five most significant bits of N (en_0=1 will output -N to in[0], while en_0=0 will output 0); ii) sets en_1 to 1 if the number represented by the six most significant bits of S_N is greater than the number represented by the five most significant bits of N (en_1=1 will output -N to in[1], and en_1=0 will output 0); iii) assert the value of R_S in in[2] shifted left by 1; iv) assert the value of R_C in in[3] shifted left by 1; v) set R_S equal to the sum of in[0], in[1], in[2] and in[3] (no carry); vi) set R_C equal to the carry from in[0], in[1], in[2] and in[3]; and vii) decrement the counter.

[0062] (The carry-save addition step 304 is mathematically defined by the following formula:

[0063] SUM_SC[5:0]=R_S[n:n-4]+R_C[n:n-4]

[0064] en_0=(N[4095:4095–3] <SUM_SC[5:0]);

[0065] in0=(en_0)?-4096:0

[0066] en_1=(N[4095:4095–3] <SUM_SC[5:1]);

[0067] in1=(en_1)?-4096:0

[0068] in2=R_S<<1

[0069] in3=R_C<<1

[0070] R_C,R_S=CSA(in0,in1,in2,in3)

[0071] counter = counter - 1.)

[0072] After step 304, the MPC enters the confirm CSA completion step 306 and confirms whether the counter has reached zero. If so, the carry-save addition phase ends; the pre-calculated value P=2 2n The sum of %N and the carry are stored in R_S and R_C respectively, and then the MPC will proceed to the initialize carry-propagate addition step 308. If the carry-save addition is not completed in step 306, the MPC will re-enter step 304 to perform the next CSA iteration.

[0073] In step 308, the MPC initializes the counter to 65. Figure 3 In the illustrated example embodiment, the full adder 216 ( Figure 2 ) comprises 64 bits; therefore, the carry-propagation addition requires 64+1 iterations (64*64=4096; the extra iteration is required because n is slightly larger than 4096).

[0074] After step 308, the MPC enters a carry propagate add step 310, where the output P is calculated (by adding the carry from the previous iteration, the 64-bit group from R_S, and the 64-bit group from R_C), and the counter is decremented. The selected groups of bits from R_S and R_C are shifted left in successive iterations (e.g., bits 63:0 are selected in the first iteration, bits 127:64 are selected in the next iteration, and so on).

[0075] Next, the MPC proceeds to a confirm carry-propagation addition complete (CPA complete) step 312 and determines whether the counter has reached zero. If so, the pre-calculation flow chart is completed and the pre-calculated value is stored in P. If the carry-propagation addition is not complete in step 312, the MPC re-enters step 310 for the next CPA iteration.

[0076] As will be understood, Figure 3 The flowchart 300 shown in FIG. 3 is an example depicted for conceptual clarity only. Other suitable flowcharts may be used in alternative embodiments of the present invention. For example, a counter may count up instead of down (modifying the confirmation completion step accordingly). In some embodiments, a counter may be incremented (or decremented) after the confirmation completion step.

[0077] Precomputed decimals

[0078] In some embodiments, the number of bits used for pre-calculation operations may be smaller than the width of the MPC (e.g., N<4096). Since the next cycle is executed in response to the high-order bits of the operand in the above method and circuit, two preparatory steps are added:

[0079] a. The operand is shifted left (by MPC, MCE, or processor) until the MSB = 1;

[0080] b. The number of algorithm cycles is reduced by the shift count of a).

[0081] After the pre-calculation algorithm is completed, the result is right-shifted (by the MPC, MCE, or processor) to restore the original bit size.

[0082] Integrated Montgomery multiplier with pre-calculation circuit

[0083] The pre-calculation circuit described above is similar to the Montgomery multiplication circuit. In some embodiments, the pre-calculation is integrated into the Montgomery multiplication circuit, thereby adding a small amount of logic.

[0084] Figure 4 1 is a block diagram schematically illustrating an MMA 400 having pre-calculation circuitry integrated into a Montgomery calculation engine according to an embodiment of the present invention. Figure 1 ), MMA 400 computes the product of a pair of numbers modulo a large prime number N. However, unlike MMA 100, MMA 400 includes an integrated Montgomery computation engine (IMCE) 402. IMCE 402 is configured to receive arguments A and B and a divisor N from a processor 404 and output the product (A*B)%N to processor 404. Processor 404 is configured to send operands (multiplicands) to IMCE 402 and receive multiplication results from IMCE 402. In some embodiments, for example, if IMCE 402 includes a processor, processor 404 may not be required.

[0085] As in MMA 100, in some embodiments, processor 404 and / or IMCE 402 comprises a general-purpose processor that is programmed in software to perform the functions described herein. The software may be downloaded to the processor in electronic form, over a network or from a host computer, for example, or the software may alternatively or additionally be provided and / or stored on a non-transitory tangible medium such as magnetic, optical, or electronic memory.

[0086] Figure 5 is a block diagram schematically illustrating an integrated Montgomery computation engine (IMCE) 402 according to an embodiment of the present invention. In the example embodiment, the multiplication is 4096 bits x 4096 bits (however, as explained in the Walter reference cited above, we use 4096 + 2 = 4098 bits to preserve the final modulo operation). As will be understood, ICME 402 is an MPC 104 ( Figure 2); some subunits of ICME 402 are identical to corresponding subunits of MPC 104 (and retain the same subunit numbering); other subunits are supersets of corresponding MPC 104 subunits. In addition, IMCE 402 includes three new subunits: controller 518 (different from control unit 214, Figure 2 ), and two registers—GPR0 register 514 and GPR1 register 516.

[0087] The 4-input CSA 200 performs carry-save addition on inputs IN[0] to IN[3]. The sum output and carry output are coupled to the R_S register 208 and the R_C register 206, respectively. Inputs IN[0] and IN[1] are coupled to AND gates 202 and 204, respectively. AND gate 202 is configured to output the value of the R_0 register 502 to IN[0] when the signal en_0 is at a logic 1, and to output zero otherwise. AND gate 204 is configured to output the value of the R_1 register 504 to IN[1] when the signal en_1 is at a logic 1, and to output zero otherwise.

[0088] The left / right shifter 512 is configured to shift the output of R_S 208 to the left or right and send the shifter value to IN[2] of CSA 200; in a similar manner, the left / right shifter 510 is configured to shift the output of R_C 206 to the left or right and send the shifter value to IN[3] of CSA 200. As will be understood, the left / right shifters 512 and 510 are the shifters 212, 210 ( Figure 2 ) that is configured to shift only left. In some embodiments, CPA 216 performs carry-propagation addition on groups of bits (e.g., 64-bit groups) from R_S 208 and R_C 206 to reduce the 4098-bit carry-sum representation to a 4098-bit binary representation; in an embodiment, GPPR0 514 and / or GPR1 516 load the output of CPA 216 in sequential order, for example, in 64-bit groups.

[0089] The controller 518 is configured to manage the operation of the IMCE 402 by sending an ordered pattern of control signals to the subunits including en_0, en_1; shift direction control of the left / right shifters 512 and 510; load control of registers R_0 502, R_1 504, GPR0 514, GPR1 516; and by initializing registers R_S 208, R_C 206. The controller may be (e.g., by the processor 404, Figure 4) is configured into one of at least two settings: a first setting in which the controller manages AND gates 202, 204 and shifters 510, 512 such that the CSA computes Montgomery pre-calculation values; and a second setting in which the controller manages the AND gates and shifters such that the CSA computes Montgomery multiplications. In some embodiments, the controller can be configured into a third setting in which the CSA computes exponentiation (e.g., RSA exponentiation) by cascading a Montgomery pre-calculation setting and multiple occurrences of a Montgomery multiplication setting.

[0090] Hereinafter, we will collectively refer to the aggregation of controller 518 , AND gate 202 , AND gate 204 , shifter 510 , and shifter 512 as a control circuit.

[0091] Therefore, according to Figure 5 In the example embodiment illustrated in and as described above, the IMCE 402 is configured to perform Montgomery precomputation and Montgomery multiplication (and specifically to perform Montgomery precomputation followed by Montgomery multiplication).

[0092] As will be understood, in Figure 5 The configuration of IMCE 104 illustrated in FIG and described above is an example configuration depicted for conceptual clarity. Other suitable configurations may be used in alternative embodiments of the present invention. For example, in some embodiments, CPA is not present, and all operations are performed in sum-and-carry representation (except for the final exponentiation result, which may be converted to binary format by CPA or, for example, by software).

[0093] Figure 6 FIG. 6 is a flow chart 600 schematically illustrating a method for Montgomery 4096-bit×4096-bit multiplication according to an embodiment of the present invention. Figure 6 In the example embodiment illustrated in FIG. , both multiplicands are expanded to 4098 bits to preserve the final modulus (as described above). The process is executed by control circuit 518, which controls IMCE 402 ( Figure 5 ) of the various subunits. The flowchart begins with the initialization of the CSA registers step 602, where the control circuit loads the value of N (modulus) into R0 502, the value of A (first multiplicand) into R1 504; loads B (second multiplicand) into GPR1 514, and loads zero into the R_S 208 and R_C 206 registers. In an embodiment, the controller loads 4098-bit values ​​in 64-bit groups within 65 cycles. In some embodiments, the controller receives the data from a processor (e.g., processor 404, directly or via a bus). Figure 4 ) receives some or all values.

[0094] Next, the control circuit enters an initialize counter step 604 and loads an internal counter (not shown) with a value of "4098" (the number of Montgomery reductions to be performed). The control circuit then enters a Montgomery iteration step 606, where the control circuit:

[0095] i) Set AND gate 202 ( Figure 5 )’s en0 input is set to S[0]+C[0]*GPR1[0]*r1[0] (bitwise operation);

[0096] ii) Set the en1 input of AND gate 204 to GPR1[0];

[0097] iii) If en_0 is at logic 1, copy R0 to 4098-bit in[0]; otherwise set in[0]=0;

[0098] iv) If en_1 is at logic 1, copy R1 to 4098-bit in[1]; otherwise set in[1]=0;

[0099] v) Set the 4098-bit in[2] value to R_S and shift it right by 1;

[0100] vi) Set the 4098-bit in[3] value to R_C and shift it right by 1;

[0101] vii) add in[0], in[1], in[2], in[3] bit by bit (preserving the bitwise sum in R_S and the bitwise carry in R_C); and

[0102] viii) Decrement the counter.

[0103] The control circuit then proceeds to a confirm counter is greater than zero step 608 to determine if the counter value is still greater than zero. If so, the Montgomery multiplication loop has not yet completed, and the control circuit re-enters step 606 to perform the next Montgomery iteration. If the counter is not greater than zero in step 608, the control circuit proceeds to an initialize carry propagate add step 610, where the control circuit sets the counter to 65, and then proceeds to a carry propagate add (CPA) step 612.

[0104] CPA step 612 (with Figure 3 64-bit addition (similar to step 310 in FIG. 6 ) adds the 64R_S bit group to the corresponding 64R_C bit group and decrements the counter. In a confirm CPA completion step 614, the control circuit confirms whether the counter has reached zero. If the counter is still greater than zero, the process re-enters step 612. When the counter has reached zero in step 614, the flowchart ends.

[0105] As will be understood, in Figure 6The flowchart 600 illustrated in FIG. 1 and described above is an example depicted for conceptual clarity only. Other suitable flowcharts may be used in alternative embodiments of the present invention. For example, in one embodiment, a counter may count up and then be compared to the number of iterations. In some embodiments, the counter may be modified after confirming that the counter is complete.

[0106] RSA index calculation

[0107] The RSA algorithm involves exponentiation of large numbers. In the article cited above by Mclvor et al., the authors describe the use of Montgomery multipliers to perform exponentiation. Exponentiation is formally defined as M = C D MOD(n). D (i.e., the exponent) may be stored in the control circuit 518 or may be received from a processor (e.g., processor 204, Figure 4 ) read.

[0108] Figure 7 700 is a flowchart schematically illustrating a method for exponentiation according to an embodiment of the present invention. The flowchart is provided by the control circuit 518 ( Figure 5 ) is executed. The exponentiation flowchart includes a pre-calculation flowchart 300 ( Figure 3 ) and the Montgomery multiplication flowchart 600 ( Figure 6 ) multiple executions. In the following, we will formally calculate K = (2 2k )%n is called Precompute(k,n); and the Montgomery multiplication M=(a*b)%n is called MONTGOMERY(a,b,n).

[0109] Flowchart 700 begins with a pre-calculation step 702, in which the control circuit performs a pre-calculation process (e.g., flowchart 300 ( Figure 3 )) to calculate the pre-calculated value K=PRECOMPUTE(k,n). Then, in step 704 of calculating the initial GPR0, the control circuit executes the Montgomery multiplication process (for example, process 600, Figure 6 ) to compute MONTGOMERY(K, C, n) and store the result in GPR0. Then, in compute initial GPR1 step 706, the control circuit performs another Montgomery multiplication process to compute MONTGOMERY(K, 1, n) and stores the result in GPR1. Now, in set counter 4098, the control circuit sets the counter value to 4098, which is the number of iterations in the exponentiation.

[0110] After step 708, the control circuit begins a sequence of 4098 exponentiation iterations. GPR0 will store C after the ith iteration. 2i The value of C will be stored in GPR1. D[i-1:0]The cumulative exponentiation result of . In a calculate next GPR0 step 710, the control circuit calculates MONTGOMERY(GPR0, GPR0, n), squaring the previous value of GPR0. Next, in a determine Di step 712, the control circuit determines whether the i-th bit of d is a logic 1. If so, the control circuit proceeds to an update GPR1 step 714, where the control circuit performs a Montgomery multiplication (e.g., flowchart 600) to calculate MONTGOMERY(GPR0, GPR1, n), stores the result in GPR1, and proceeds to a decrement counter step 716 (if d[i] is not a logic 1 in step 712, the control circuit bypasses step 714).

[0111] In step 716, the control circuit decrements the counter and then checks whether the counter has reached zero in step 718. If so, the exponentiation process ends and GPR1 stores M, the exponentiation result. If the counter has not reached zero in step 718, the control circuit re-enters step 710 for the next exponentiation iteration.

[0112] As will be understood, in Figure 7 Flowchart 700, illustrated in FIG. 7 and described above, is an example depicted for conceptual clarity only. Other suitable flow charts may be used in alternative embodiments of the present invention. For example, in an embodiment, to prevent security attacks that measure the exponentiation time to estimate the number of logical-one exponent bits, the Montgomery multiplication of step 714 is always performed, and the value of the exponent bit d[i] (determined in step 712) determines whether GPR1 will be updated with the multiplication result. In some embodiments, the counter is cleared in step 708, counts up in step 716, and is compared to 4098 in step 718. In an embodiment, the counter is incremented after the comparison with the final value.

[0113] Montgomery Calculation of Decimals

[0114] In the Montgomery multiplication method and circuit described above, the next cycle is executed in response to the low-order bits of the operands, so the algorithm works well when the number of bits of the number to be multiplied is less than the width of the IMCE (e.g., N < 4096). The operands should be loaded into the LSB portion of the register, and a logic 0 bit should be loaded into the unused MS portion.

[0115] The configurations of the Montgomery multiplication apparatuses (MMAs) 100 and 400 (including the Montgomery pre-computation circuit (MPC) 104 and the integrated Montgomery computation engine (IMCE) 402), and the methods of the flowcharts 300, 600, and 700 described above are example configurations and methods shown for conceptual clarity only. Any other suitable configurations and flowcharts may be used in alternative embodiments. The various elements of the Montgomery multiplication apparatuses (MMAs) 100 and 400 (including the Montgomery pre-computation circuit 104 and the integrated Montgomery computation engine 402) may be implemented using suitable hardware, such as in one or more application-specific integrated circuits (ASICs) or field-programmable gate arrays (FPGAs).

[0116] Although the embodiments described herein primarily refer to Montgomery multiplication, Montgomery precomputation, and Montgomery-based exponentiation, the methods and systems described herein may also be used in other applications, such as fast division.

[0117] Therefore, it will be understood that the above embodiments are cited by way of example, and the present invention is not limited to the embodiments that have been specifically shown and described above. On the contrary, the scope of the present invention includes the combinations and subcombinations of the various features described above, as well as changes and modifications that may occur to those skilled in the art upon reading the foregoing description and that are not disclosed in the prior art. The documents incorporated by reference in this patent application will be considered to be an integral part of the application, except that to the extent that any term is defined in these incorporated documents in a manner that conflicts with the definition explicitly or implicitly made in this specification, only the definition in this specification should be considered.

Claims

1. A Montgomery pre-calculation circuit comprising a carry-save adder, a sum shifter, and a carry shifter for calculating a Montgomery pre-calculated value for a Montgomery multiplication operation by performing a series of iterations, wherein in a given series of iterations: The carry-save adder is used to generate a sum output and a carry output; and The sum shifter and the carry shifter are used to left-shift the sum output and the carry output respectively, and feed back the left-shifted sum output and the left-shifted carry output to corresponding inputs of the carry-save adder.

2. The Montgomery pre-calculation circuit according to claim 1, wherein the Montgomery pre-calculation value is (2 2n )% R is given, n represents the number of digits of Montgomery multiplication operation, and R represents the preselected number.

3. The Montgomery pre-calculation circuit according to claim 2, wherein R=N, where N represents a divisor of the Montgomery multiplication operation.

4. The Montgomery pre-calculation circuit according to claim 1, further comprising an adder for calculating the Montgomery pre-calculation value by adding the sum output and the carry output after the series of iterations.

5. The Montgomery pre-calculation circuit of claim 1 , wherein in the given iteration, the carry-save adder is further configured to receive as input a modulo correction number set to N times -1, -2, or 0, where N represents a divisor for the Montgomery multiplication operation.

6. The Montgomery pre-calculation circuit of claim 1 , wherein the carry-save adder is a three-input carry-save adder that further receives as input a modulo correction number set to N times -1, -2, or 0, N representing a divisor for the Montgomery multiplication operation.

7. The Montgomery pre-calculation circuit of claim 1 , wherein the carry-save adder is a four-input carry-save adder that further receives as input (i) a first modulo correction number set to N times -1 or 0, and (ii) a second modulo correction number set to N times -2 or 0, where N represents a divisor for the Montgomery multiplication operation.

8. A method of computing a Montgomery precomputed value for a Montgomery multiplication operation, the method comprising performing a series of iterations using a carry-save adder, a sum shifter, and a carry shifter, wherein in a given series of iterations: generating a sum output and a carry output by the carry-save adder; and Left-shifting the sum output and the carry output respectively by the sum shifter and the carry shifter; and The left-shifted sum output and the left-shifted carry output are fed back to the corresponding inputs of the carry-save adder.

9. The method according to claim 8, wherein the Montgomery pre-calculated value is (2 2n )% R is given, n represents the number of digits of Montgomery multiplication operation, and R represents the preselected number.

10. The method according to claim 9, wherein R=N, N represents a divisor of the Montgomery multiplication operation.

11. The method of claim 8, further comprising calculating the Montgomery pre-calculated value by adding the sum output and carry output after the series of iterations.

12. The method of claim 8, further comprising receiving as input by a carry-save adder in the given iteration a modulo correction number set to N times -1, -2, or 0, N representing a divisor for a Montgomery multiplication operation.

13. The method of claim 8, wherein the carry-save adder is a three-input carry-save adder, and further comprising receiving as an input to the carry-save adder a modulo correction number set to N times -1, -2, or 0, N representing a divisor for a Montgomery multiplication operation.

14. The method of claim 8 , wherein the carry-save adder is a four-input carry-save adder, the method further comprising receiving as inputs to the carry-save adder (i) a first modulo correction number set to N times -1 or 0, and (ii) a second modulo correction number set to N times -2 or 0, where N represents a divisor for a Montgomery multiplication operation.

Images