High-efficiency Montgomery multiplier

Abstract

An integrated Montgomery calculation engine (IMCE) for multiplying two multiplicands and then taking the modulus of a predefined number includes a carry-preserving adder (CSA) circuit and a control circuit. The CSA circuit has multiple inputs and outputs including a sum output and a carry output. The control circuit is coupled to the inputs and outputs of the CSA circuit and is configured to operate the CSA circuit in at least (i) a first setting for calculating a Montgomery pre-calculated value and (ii) a second setting for calculating the Montgomery multiplication of the two multiplicands.

Description

[0001] Cross-references to related applications

[0002] This application relates to U.S. patent application filed on the same date entitled “Fast Precomputation for Montgomery Multiplier”, Agent’s File No. 1058-2082.1, the disclosure of which is incorporated herein by reference. Technical Field

[0003] This application generally relates to the Montgomery algorithm, and more particularly to the calculation of Montgomery pre-computed values ​​and the implementation of Montgomery multipliers and related circuits. Background Technology

[0004] In cryptography, operations such as modular multiplication and exponentiation of large integers are widely used. Several methods have been proposed for fast implementation of these multiplications and exponentiations. One widely used method of this kind was proposed by Peter Lawrence Montgomery in 1985, and described, for example, by Kork et al. in “Analyzing and Comparing Montgomery Multiplication Algorithms” (IEEE Micro, Vol. 16, No. 3, June 1996, pp. 26-33), in which the authors discuss several Montgomery multiplication algorithms and analyze the space and time requirements of the methods in detail.

[0005] In “Modified Montgomery modular multiplication and RSA exponentiation techniques” (IEE Proceedings on Computation Digital Techniques, Vol. 151, No. 6, November 2004), McLvor et al. proposed an improved Montgomery multiplication and a related Rivest-Shamir-Adleman (RSA) exponentiation algorithm and circuit architecture using a carry-preserving adder (CSA) for large-word addition. The proposed method is based on a reformulation of the modular multiplication solution within the context of RSA exponentiation, and two algorithm variants are presented: one based on 5-2 CSA and the other on a 4-2 CSA multiplexer. Summary of the Invention

[0006] The embodiments of the invention described herein provide a Montgomery multiplication device (MMA) for multiplying two multiplicands and taking the modulus of a predefined number. The MMA includes pre-calculation circuitry and Montgomery multiplication circuitry. The pre-calculation circuitry is configured to compute a Montgomery pre-calculated value by performing a series of iterations. In a given iteration, the pre-calculation circuitry is configured to modify one or more intermediate values ​​by performing bitwise operations on intermediate values ​​computed in previous iterations. The Montgomery multiplication circuitry is configured to multiply the two multiplicands and take the modulus of a predefined number by performing multiple Montgomery reduction operations using the Montgomery pre-calculated value computed by the pre-calculation circuitry.

[0007] In some implementations, the Montgomery pre-calculated value is a power of at least two to twice the number of digits in the Montgomery multiplicand.

[0008] In some implementations, the pre-computation circuitry is configured to modify the bitwise sum and carry in a given iteration by performing bitwise sum and carry operations on (i) the bitwise sum calculated in previous iterations, (ii) twice the bitwise carry calculated in previous iterations, and (iii) the modulus correction number. In an example implementation, the pre-computation circuitry is configured to calculate the Montgomery pre-computation value based on the sum of the bitwise sum and twice the carry calculated after the last iteration in a series of iterations. In another implementation, the pre-computation circuitry is configured to calculate the modulus correction number based on the sum of the bitwise sum and twice the carry calculated in the last iteration.

[0009] In another embodiment, the pre-calculation circuit is configured to calculate the modulus correction number in a given iteration based on the difference between the sum of bitwise sums and carry-bitwise sums calculated in previous iterations and a predefined number. In yet another embodiment, the pre-calculation circuit is configured to calculate the modulus correction number in a given iteration based on a subset of the most significant bits of the sum of bitwise carry-bitwise sums calculated in previous iterations and a subset of the most significant bits of a predefined number.

[0010] In the disclosed embodiments, the pre-computation circuit is configured to compute a modulo correction number in a given iteration based on a subset of the bits of the sum of bitwise carry and bitwise sum calculated in previous iterations, and a subset of the bits of a predefined number. In one embodiment, the pre-computation circuit is configured to set the modulo correction number to a predefined number multiplied by -1, -2, or 0. In another embodiment, the pre-computation circuit includes a carry-holding adder (CSA) configured to compute, in a given iteration, (i) twice the bitwise sum calculated in previous iterations, (ii) twice the bitwise carry calculated in previous iterations, and (iii) the bitwise sum and carry of the modulo correction number set to a predefined number multiplied by -1, -2, or 0.

[0011] In some embodiments, the pre-computation circuitry includes a three-input carry-holding adder (CSA) configured to compute, in a given iteration, (i) twice the bitwise sum calculated in a previous iteration, (ii) twice the bitwise carry calculated in a previous iteration, and (iii) the bitwise sum and carry of a modulo correction number set to a predefined number multiplied by -1, -2, or 0. In other embodiments, the pre-computation circuitry includes a four-input carry-holding adder (CSA) configured to compute, in a given iteration, (i) twice the bitwise sum calculated in a previous iteration, (ii) twice the bitwise carry calculated in a previous iteration, (iii) a first modulo correction number set to a predefined number multiplied by -1 or 0, and (iv) a second modulo correction number set to a predefined number multiplied by -2 or 0.

[0012] In some implementations, pre-computation circuitry and Montgomery multiplication circuitry are included in the network device and configured to perform encryption operations of the network device.

[0013] According to embodiments of the present invention, a method for multiplying two multiplicands and then taking the modulus of a predefined number is further provided. This method includes using a pre-computation circuit to calculate a Montgomery pre-computation value through a series of iterations, wherein the series of iterations includes modifying one or more intermediate values ​​in a given iteration by performing bitwise operations on intermediate values ​​calculated in previous iterations. Using a Montgomery multiplication circuit, the two multiplicands are multiplied by performing multiple Montgomery reduction operations using the Montgomery pre-computation value calculated by the pre-computation circuit, and then taking the modulus of the predefined number.

[0014] According to embodiments of the invention, an integrated Montgomery calculation engine (IMCE) for multiplying two multiplicands and then taking the modulus of a predefined number is also provided. The IMCE includes a carry-preserving adder (CSA) circuit and a control circuit. The CSA circuit has multiple inputs and outputs including a sum output and a carry output. The control circuit is coupled to the inputs and outputs of the CSA circuit and is configured to operate the CSA circuit in at least (i) a first setting for calculating a Montgomery pre-calculated value and (ii) a second setting for calculating the Montgomery multiplication of the two multiplicands.

[0015] In some implementations, the control circuitry is configured to logically shift the sum output and carry output of the CSA circuit, and couple the shifted sum output and carry output to the corresponding inputs of the CSA circuit. In an example implementation, the control circuitry is configured to logically shift the sum output and carry output of the CSA circuit to the left in a first setting, and logically shift the sum output and carry output of the CSA circuit to the right in a second setting.

[0016] In one embodiment, in a first setting, the control circuit is configured to set two of the inputs of the CSA circuit to constant values ​​depending on a predefined number. In another embodiment, in the first setting, the control circuit is configured to set the inputs of the CSA circuit to a predefined number or zero based on the most significant bit of the sum output and carry output of the CSA circuit, and the two multiplicands. In yet another embodiment, in a second setting, the control circuit is configured to set the inputs of the CSA circuit to zero or the other multiplicand based on one of the multiplicands. In the disclosed embodiment, in the second setting, the control circuit is configured to set the inputs of the CSA circuit to zero or a predefined number based on the least significant bit of the sum output, the carry output, and the two multiplicands.

[0017] In some embodiments, the control circuitry is configured to further operate the CSA circuitry in a third setting, which calculates a predefined exponent raised to the power of a predefined base and then modulo the predefined number. In other embodiments, the control circuitry is configured to operate the CSA circuitry in the third setting by applying a first setting and a second setting in a sequence defined according to the exponent.

[0018] In some implementations, the CSA and control circuitry are included in the network device and configured to perform encryption operations on the network device.

[0019] According to embodiments of the invention, a method for multiplying two multiplicands and then taking the modulus by a predefined number is also provided. The method includes operating a carry-holding adder (CSA) circuit having multiple inputs and outputs including a sum output and a carry output. Using control circuitry coupled to the inputs and outputs of the CSA circuit, the CSA circuit is controlled to operate in at least (i) a first setting for calculating a Montgomery pre-calculated value and (ii) a second setting for calculating the Montgomery multiplication of the two multiplicands.

[0020] The invention will be more fully understood from the following detailed description of embodiments taken in conjunction with the accompanying drawings, in which: Attached Figure Description

[0021] Figure 1 This is a schematic block diagram illustrating a Montgomery multiplication device (MMA) according to an embodiment of the present invention;

[0022] Figure 2 This is a schematic illustration of an embodiment of the present invention. Figure 1 Block diagram of the Montgomery pre-computation circuit (MPC) in MMA;

[0023] Figure 3 This is a schematic flowchart illustrating a method for Montgomery pre-calculation according to an embodiment of the present invention;

[0024] Figure 4 This is a schematic diagram illustrating an MMA with pre-computation circuitry integrated into a Montgomery computing engine according to an embodiment of the present invention.

[0025] Figure 5 This is a schematic diagram illustrating an integrated Montgomery Computing Engine (IMCE) according to an embodiment of the present invention;

[0026] Figure 6 This is a flowchart schematically illustrating a method for Montgomery 4096-bit × 4096-bit multiplication according to an embodiment of the present invention; and

[0027] Figure 7 This is a schematic flowchart illustrating a method for exponentiation according to an embodiment of the present invention. Detailed Implementation

[0028] Overview

[0029] Public-key cryptosystems can be used to provide data confidentiality, author authentication, and data integrity. Some public-key cryptosystems (e.g., Rivest–Shamir–Adleman (RSA)) rely on the exponentiation of large numbers, which requires repeated modular multiplication. To improve security, operands are often much larger than 1000 bits in length, which increases the computational load of exponentiation operations.

[0030] A typical algorithm used to reduce the computational burden of modular multiplication is the Montgomery algorithm (for example, as described in the paper by Kork et al. cited above). The Montgomery multiplication algorithm replaces trial division by the modulus with a series of additions and divisions by powers of 2, and is the most common algorithm used in RSA cryptosystems today.

[0031] The Montgomery algorithm can be implemented in hardware or software. Typically, hardware implementations are based on repetitive computations, preceded by pre-computation of one or more values, followed by carry propagation and final modulus correction. The pre-computed values ​​could be, for example, (2...). 2n )%R, where n is the number of bits in the Montgomery operand, "%" indicates modulo operation, and R, the divisor, is a preselected number (R < 2). n ).

[0032] The embodiments of the invention described herein provide efficient methods and apparatus for calculating Montgomery pre-calculated values. In some disclosed embodiments, the Montgomery multiplication apparatus (MMA) is configured to multiply two multiplicands and then take the modulus by a predefined number. In some embodiments, the MMA includes pre-calculation circuitry and Montgomery multiplication circuitry. The pre-calculation circuitry is configured to calculate the Montgomery pre-calculated value by performing a series of iterations. In a given iteration, the pre-calculation circuitry modifies one or more intermediate values ​​by performing bitwise operations on intermediate values ​​calculated in previous iterations. In embodiments, in a given iteration, the pre-calculation circuitry modifies the bitwise sum and carry by performing bitwise sum and carry operations on (i) the bitwise sum calculated in previous iterations, (ii) twice the bitwise carry calculated in previous iterations, and (iii) a modulus correction number. The Montgomery multiplication circuitry is configured to multiply two multiplicands and then take the modulus by a divisor by performing multiple Montgomery reduction operations using the Montgomery pre-calculated value calculated by the pre-calculation circuitry.

[0033] In some implementations, two additional bits are added to the operands of pre-computed and / or Montgomery multiplications to avoid the final modulo correction step; thus, for 4096-bit arithmetic, 4098-bit operands are used. Adding two bits also prevents overflow of intermediate values.

[0034] The present invention provides an integrated Montgomery computation engine (IMCE) according to other embodiments thereof, wherein pre-computation circuitry is embedded in Montgomery multiplication circuitry; in embodiments, the same bitwise sum and carry circuitry is used during pre-computation and Montgomery multiplication.

[0035] In some implementations, the IMCE includes a CSA and control circuitry. The control circuitry is configured to manage the operation of the CSA in multiple settings; in a first setting, the control circuitry controls the CSA to perform Montgomery pre-computation; in a second setting, the control circuitry controls the CSA to perform Montgomery multiplication; and in a third setting, the control circuitry controls the CSA to compute exponentiation using a sequence of Montgomery multiplications. In one implementation, the control circuitry includes a first circuitry configured to control the loopback input of the CSA and a second circuitry that can configure the CSA (via the first circuitry) to compute exponentiation.

[0036] In the example implementation described below, the Montgomery operand has 4098 bits; however, the disclosed technique is not limited to 4098 bits; any other suitable number of bits may be used in alternative implementations.

[0037] The disclosed MMA and IMCE can be embedded in a variety of host systems and used in a variety of use cases. In general, any system involving Montgomery multiplication can benefit from the techniques described herein. Example host systems include a variety of network devices such as network adapters (e.g., Ethernet network interface controllers (NICs), Infiniband host channel adapters (HCAs), data processing units (DPUs) or “smart NICs,” network-enabled graphics processing units (GPUs), network switches and routers, and accelerators, etc.

[0038] In one example use case, the disclosed MMA and / or IMCE are embedded in a network device and used in the secure boot process of the network device, such as for authentication of signatures. In another example use case, the disclosed MMA and / or IMCE are embedded in a network adapter and used to accelerate cryptographic operations such as public key operations.

[0039] System Description

[0040] Figure 1 This is a schematic block diagram illustrating a Montgomery multiplication device (MMA) 100 according to an embodiment of the present invention. The MMA 100 calculates the product of pairs of numbers and then modulo it by a large prime number N, and includes a Montgomery computation engine (MCE) 102, a Montgomery pre-computation unit (MPC) 104, and a processor 106. Here, the MCE 102 is also referred to as a Montgomery multiplication circuit. Depending on the applicable host system and use case, the processor 106 may include or be embedded in, for example, a CPU, GPU, system-on-a-chip (SoC), controller, digital signal processor (DSP), or any other suitable type of processor.

[0041] MCE 102 is configured to receive multiplication arguments A, B, and divisor N from processor 106 and a pre-calculated value 2 from MPC 104. R %N, and output the product (A*B)%N to processor 106. MCE 102 may be a processor executing a suitable software program, or a hardware Montgomery multiplier (e.g., see Thampi and Jose, “Montgomery Multiplier for Faster Cryptosystems,” Procedia Technology 25 (2016), pp. 392-398). In some implementations, MCE 102 includes additional circuitry for calculating the exponent based on Montgomery multiplication (e.g., see the article by Mclvor et al. cited above).

[0042] MPC 104 is configured to receive N and -N from processor 106. N and -N are typically represented by n+2 bits, where n is the number of bits used in Montgomery multiplication (-N can be represented by "two's complement": -N = ~N+1 (N inverse + 1)).

[0043] Then, MPC 104 calculates the pre-calculated value (2 2n The result is sent to MCE 102. In an implementation, the MPC includes three or four input carry-holding adders (CSAs) and completes the calculation in a number of cycles close to n (digits).

[0044] Processor 106 is configured to send operands (multiplicands) to MCE 102 and MPC 104, and receive the multiplication result from MCE 102. In some implementations, for example, if MPC 104 includes a processor, processor 106 may not be required.

[0045] The configuration of MMA 100 is an example configuration depicted for conceptual clarity only. Other suitable configurations may be used in alternative embodiments of the invention. For example, in some embodiments, a single MPC is configured to pre-compute the values ​​of multiple MCEs. In another example, MPC 104 is configured to compute -N by taking the two's complement of N; therefore, processor 106 does not send -N to MPC 104.

[0046] In some embodiments, processor 106 and / or MPC 104 include a general-purpose processor that is programmed in software to perform the functions described herein. The software may be, for example, in electronic form, via a network, or downloaded to the processor from a host, or the software may alternatively or additionally be provided and / or stored on a non-transitory tangible medium such as magnetic storage, optical storage, or electronic storage.

[0047] Figure 2 This is a schematic block diagram illustrating a Montgomery pre-computation circuit (MPC) 104 according to an embodiment of the present invention. The MPC includes a four-input carry-holding adder (CSA) 200 configured to sum four inputs (designated as In[0] to In[3]). The value of -N (where N is the modulo divisor) is (e.g., from processor 106, Figure 1 The input is fed into the MPC. It is also applied to the R_0 input of AND gate 202 and the R_1 input of AND gate 204. AND gates 202 and 204 are configured to send the -N input (respectively) to the CSA inputs in[0] and in[1] when enabled, otherwise sending the value "0". (The enable inputs of AND gates 202 and 204 are called en_0 and en_1, respectively.)

[0048] It should be noted that when both en_0 and en_1 are off (e.g., at logic 0), CSA 200 receives the combined value “0” at inputs in[0] and in[1]; when one of en_0 and en_1 is on, CSA receives the combined value “-N”; and when both en_0 and en_1 are on, CSA receives the combined value “-2N”.

[0049] Two registers (R_C register 206 and R_S register 208) are configured to store the carry-out and sum-out of the CSA 200, respectively. Data stored in R_C 206 can be routed back to the in[3] input of the CSA 200 via shifter 210, while data stored in R_S 208 can be routed back to the in[2] input via shifter 212. Shifters 210 and 212 are configured to multiply by 2 by shifting the data one position to the left (with the rightmost output bit set to logic 0).

[0050] MPC 104 also includes a control unit 214 configured to drive the inputs en_0 and en_1 of AND gates 202 and 204. (See below for reference) Figure 3 As described above, in the implementation, only a few of the more significant bits (e.g., the five most significant bits) of N and R_SC are input to the control unit 214.

[0051] In this implementation, the pre-computation process performed by MPC 104 includes a carry-holding stage where CSA 200 generates a pre-computed value and a carry representation, and adding the pre-computed value P = 2 to the carry (stored in R_S 208 and R_C 206 respectively). 2n The carry propagation phase of %N. According to... Figure 2 In the example implementation illustrated in the figure, MC 104 includes a full adder 216 configured to add the values ​​stored in R_S 208 and R_C 206 to produce a pre-computed value P. In the example implementation, the full adder 216 includes 64 bits and can perform 4096-bit addition in 64 loops (as will be described below, two additional bits may be needed in CSA, therefore, the full adder 216 may need 65 loops to perform 4098-bit addition).

[0052] In summary, MPC 104 calculates P=2 in both the iterative carry retention phase and the iterative carry propagation phase. 2n %N. In the carry-holding phase, the 4-input CSA iteratively calculates P by adding the values ​​of 0, -N, or -2N along with the left-shift carry and hold result from the previous iteration. In the carry-propagation phase, the full adder iteratively sums the carry and sum from the carry-holding phase to produce P.

[0053] As will be understood, the configuration of MPC 104 is an example configuration depicted for the sake of conceptual clarity only. Other suitable configurations may be used in alternative embodiments of the invention. For example, a three-input CSA may be used instead of a four-input CSA, wherein AND gates 202, 204 are replaced by a multiplexer configured to output 0, -N, or -2N to a single CSA input instead of in[0] and in[1]. In embodiments, shifters 210 and / or 212 may not be required; instead, R_S and R_C may be wired to in[2] and in[3] in a shifted manner (e.g., R_S[0] wired to in[2][1], R_S[1] wired to in[2][2], etc.).

[0054] Preserve the final subtraction order

[0055] According to the original Montgomery paper and its early implementations, the final step following the Montgomery multiplication is the modulus correction of the result C:

[0056] if (C>N)C=CN.

[0057] This operation is relatively expensive because it requires full carry propagation. Furthermore, by externally measuring the number of Montgomery multiplication cycles, a hacker trying to find the key can infer whether modulo correction is needed, thus narrowing down the range of possible key values. However, in a paper by Walter entitled “Montgomery exponentiation needs no final subtractions” (Electronics Letters, Vol. 35, No. 21, 1999), the author teaches how to avoid final modulo correction when the number of bits in Montgomery multiplication is increased by 2. The following table describes the differences between the original Montgomery algorithm and Walter's suggestion:

[0058]

[0059] Therefore, in some implementations, MPC 104 calculates a pre-calculated value for an exponent greater than 2n, for example, calculating R=2. 2(n +2) .

[0060] Figure 3 This is a schematic flowchart 300 illustrating a method for Montgomery pre-calculation according to an embodiment of the present invention. The process is described by MPC 104 ( Figure 1 The flowchart begins with initialization carry-preserving addition step 302, where MPC sets initial values ​​to include R_0, R_1, R_S, and R_C (all referenced above). Figure 2The parameters stored in the registers (described herein) and the counter configured to count iterations are as follows. Step 302 includes: initializing R0 and R1 to an n+3-bit representation of -N; initializing R_S to 2 n The n+1 bits represent the initialization of R_C to 0, and the N+1 bits represent the initialization of the counter to 4096+4.

[0061] Then, MPC enters the carry-holding addition step 304, where MPC: i) sets en_0 to 1 if the number represented by the five most significant bits of S_N is greater than the number represented by the five most significant bits of N (en_0 = 1 will output -N to in[0], and en_0 = 0 will output 0); ii) sets en_1 to 1 if the number represented by the six most significant bits of S_N is greater than the number represented by the five most significant bits of N (en_1 = 1). The output will be -N to in[1] and 0 will be output when en_1 = 0; iii) assert that the value of R_S is shifted left by 1 in in[2]; iv) assert that the value of R_C is shifted left by 1 in in[3]; v) set R_S to be equal to the sum of in[0], in[1], in[2] and in[3] (without carry); vi) set R_C to be equal to the carry in in[0], in[1], in[2] and in[3]; and vii) decrement the counter.

[0062] (Carry-and-hold addition step 304 is mathematically defined by the following formula:)

[0063] SUM_SC[5:0]=R_S[n:n-4]+R_C[n:n-4]

[0064] en_0 = (N[4095:4095–3]) <SUM_SC[5:0]);

[0065] in0 = (en_0)? -4096:0

[0066] en_1 = (N[4095:4095–3]) <SUM_SC[5:1]);

[0067] in1 = (en_1)? -4096:0

[0068] in2=R_S<<1

[0069] in3=R_C<<1

[0070] R_C,R_S=CSA(in0,in1,in2,in3)

[0071] counter = counter - 1.

[0072] After step 304, MPC proceeds to confirm that CSA has completed step 306 and whether the counter has reached zero. If so, the carry-holding addition phase ends; the pre-calculated value P = 2. 2n The sum and carry of %N are stored in R_S and R_C respectively, and then MPC will proceed to the initialization carry propagation addition step 308. If the carry-holding addition is not completed in step 306, MPC will re-enter step 304 to execute the next CSA iteration.

[0073] In step 308, MPC initializes the counter to 65. According to... Figure 3 The illustrated example implementation, full adder 216 ( Figure 2 The number of bits is 64; therefore, carry propagation addition requires 64+1 iterations (64*64=4096; additional iterations are needed because n is slightly larger than 4096).

[0074] After step 308, MPC proceeds to carry propagation addition step 310, where output P is calculated (by adding the carry from the previous iteration, the 64-bit set from R_S, and the 64-bit set from R_C), and a counter is decremented. The selected bit sets from R_S and R_C are shifted left in successive iterations (e.g., bits 63:0 are selected in the first iteration, bits 127:64 are selected in the next iteration, and so on).

[0075] Next, MPC proceeds to step 312, confirming carry propagation addition completion (CPA completion), and checks if the counter has reached zero. If so, the pre-calculation flowchart is completed, and the pre-calculated value is stored in P. If carry propagation addition is not completed in step 312, MPC re-enters step 310 for the next CPA iteration.

[0076] As will be understood, Figure 3 The flowchart 300 shown in the figure is an example drawn for clarity of concept only. Other suitable flowcharts may be used in alternative embodiments of the invention. For example, the counter may count up instead of down (correspondingly modifying the confirmation completion step). In some embodiments, the counter may increment (or decrement) after the confirmation completion step.

[0077] Pre-calculation of decimals

[0078] In some implementations, the number of bits used for pre-computation operations can be smaller than the width of the MPC (e.g., N < 4096). Since the next loop is executed in response to the higher-order bits of the operands in the methods and circuits described above, two preparatory steps are added:

[0079] a. Shift the operand left (via MPC, MCE, or processor) until MSB = 1;

[0080] b. The number of algorithm loops reduces the shift count of a).

[0081] After the pre-computation algorithm is completed, the result (via MPC, MCE, or processor) is right-shifted to restore the original bit size.

[0082] Integrated Montgomery multiplier with pre-calculation circuitry

[0083] The pre-computation circuit described above is similar to the Montgomery multiplication circuit. In some implementations, the pre-computation is integrated within the Montgomery multiplication circuit, thereby adding a small amount of logic.

[0084] Figure 4 This is a schematic block diagram illustrating an MMA 400 with pre-computation circuitry integrated into a Montgomery computing engine according to an embodiment of the present invention. (Compared to MMA 100...) Figure 1 Similar to MMA 100, MMA 400 calculates the product of pairs of numbers and then takes the modulus of the largest prime number N. However, unlike MMA 100, MMA 400 includes an Integrated Montgomery Computation Engine (IMCE) 402, which is configured to receive the arguments A, B, and the divisor N from processor 404 and output the product (A*B)%N to processor 404. Processor 404 is configured to send operands (multiplicands) to IMCE 402 and receive the multiplication result from IMCE. In some implementations, for example, if IMCE 402 includes a processor, processor 404 may not be necessary.

[0085] Similar to MMA 100, in some embodiments, processor 404 and / or IMCE 402 include a general-purpose processor that is programmed in software to perform the functions described herein. The software may be, for example, in electronic form, via a network, or downloaded to the processor from a host, or the software may alternatively or additionally be provided and / or stored on a non-transitory tangible medium such as magnetic storage, optical storage, or electronic storage.

[0086] Figure 5 This is a schematic block diagram illustrating an Integrated Montgomery Computing Engine (IMCE) 402 according to an embodiment of the present invention. In the example embodiment, the multiplication is 4096 bits × 4096 bits (however, as explained in the Walter Reference cited above, we use 4096 + 2 = 4098 bits to preserve the final modulo operation). As will be understood, ICME 402 is MPC 104 ( Figure 2The ICME 402 is a superset of the corresponding MPC 104 subunits; some subunits of the ICME 402 are identical to their corresponding subunits of the MPC 104 (and retain the same subunit numbers); other subunits are supersets of their corresponding MPC 104 subunits. Additionally, the ICME 402 includes three new subunits—controller 518 (different from control unit 214, ...). Figure 2 ), and two registers—GPR0 register 514 and GPR1 register 516.

[0087] 4. Input CSA 200 performs carry-holding summation on inputs IN[0] to IN[3]. The output and carry-out are coupled to R_S register 208 and R_C register 206, respectively. Inputs IN[0] and IN[1] are coupled to AND gates 202 and 204, respectively. AND gate 202 is configured to output the value of R_0 register 502 to IN[0] when signal en_0 is at logic 1, otherwise it outputs zero, while AND gate 204 is configured to output the value of R_1 register 504 to IN[1] when signal en_1 is at logic 1, otherwise it outputs zero.

[0088] Left / right shifter 512 is configured to shift the output of R_S 208 to the left or right and send the shifter value to IN of CSA 200[2]; similarly, left / right shifter 510 is configured to shift the output of R_C 206 to the left or right and send the shifter value to IN of CSA 200[3]. As will be understood, left / right shifters 512 and 510 are shifters 212, 210 ( Figure 2 A superset of R_S 208 and R_C 206, configured to shift left only. In some implementations, CPA 216 performs carry-propagating addition on bit groups (e.g., 64-bit groups) from R_S 208 and R_C 206 to reduce the 4098-bit carry sum representation to a 4098-bit binary representation; in some implementations, GPPR0 514 and / or GPR1 516 load the output of CPA 216, for example, in 64-bit groups.

[0089] The controller 518 is configured to manage the operation of the IMCE 402 by sending ordered control signal patterns for subunits including en_0 and en_1; shift direction control of left / right shifters 512 and 510; load control of registers R_0 502, R_1 504, GPR0 514, and GPR1 516; and by controlling the initialization of registers R_S 208 and R_C 206. The controller can (e.g., by processor 404, ...) Figure 4The controller can be configured to one of at least two of the following settings: a first setting, in which the controller manages AND gates 202, 204 and shifters 510, 512 such that the CSA will compute the Montgomery pre-computed value; and a second setting, in which the controller manages the AND gates and shifters such that the CSA will compute the Montgomery multiplication. In some embodiments, the controller may be configured to a third setting, in which the CSA computes exponentiation (e.g., RSA exponentiation) by cascading the Montgomery pre-computed setting and multiple occurrences of the Montgomery multiplication setting.

[0090] In the following text, we will refer to the combination of controller 518, AND gate 202, AND gate 204, shifter 510 and shifter 512 as the control circuit.

[0091] Therefore, according to Figure 5 The example implementation shown in the figure and as described above, IMCE 402 is configured to perform Montgomery pre-computation and Montgomery multiplication (and specifically Montgomery pre-computation followed by Montgomery multiplication).

[0092] As will be understood, in Figure 5 The configuration of IMCE 104 illustrated and described above is an example configuration depicted for clarity of concept. Other suitable configurations may be used in alternative embodiments of the invention. For example, in some embodiments, there is no CPA, and all operations are performed in bitwise AND carry notation (except for the final exponentiation result which can be converted to binary format by CPA or, for example, by software).

[0093] Figure 6 This is a flowchart 600 schematically illustrating a method for Montgomery 4096-bit × 4096-bit multiplication according to an embodiment of the present invention. Figure 6 In the example implementation shown in the diagram, the two multiplicands are expanded to 4098 bits to preserve the final modulus (as described above). The process is executed by control circuitry 518, which controls IMCE 402 ( Figure 5 The flowchart is divided into various subunits. The flowchart begins with the initialization of the CSA register at step 602, where the control circuit loads the value of N (modulus) into R0502, the value of A (first multiplicand) into R1504, B (second multiplicand) into GPR1514, and zeros into registers R_S208 and R_C206. In one implementation, the controller loads a 4098-bit value in 64-bit groups over 65 cycles. In some implementations, the controller loads the value directly or via a bus from the processor (e.g., processor 404). Figure 4 It can receive some or all values.

[0094] Next, the control circuit enters the initialization counter step 604 and loads the internal counter (not shown) with the value "4098" (the number of Montgomery reductions to be performed). Then, the control circuit enters the Montgomery iteration step 606, where the control circuit:

[0095] i) will be with door 202 ( Figure 5 The en0 input of ) is set to S[0]+C[0]*GPR1[0]*r1[0] (bit operation);

[0096] ii) Set the en1 input of AND gate 204 to GPR1[0];

[0097] iii) If en_0 is at logic 1, then copy R0 to bit 4098 in[0]; otherwise, set in[0] = 0;

[0098] iv) If en_1 is at logic 1, then copy R1 to bit 4098 in[1]; otherwise, set in[1] = 0;

[0099] v) Set the 4098-bit in[2] value to R_S right shift by 1;

[0100] vi) Set the 4098-bit in[3] value to R_C right shift by 1;

[0101] vii) Add in[0], in[1], in[2], and in[3] bit by bit (preserving the bit-by-bit sum in R_S and the bit-by-bit carry in R_C); and

[0102] viii) Decrease the counter.

[0103] Then, the control circuit proceeds to step 608 to confirm that the counter is greater than zero and checks if the counter value is still greater than zero. If so, the Montgomery multiplication loop has not yet completed, and the control circuit re-enters step 606 to execute the next Montgomery iteration. If the counter is not greater than zero in step 608, the control circuit proceeds to step 610 to initialize carry propagation addition, where the control circuit sets the counter to 65, and then proceeds to step 612 to perform carry propagation addition (CPA).

[0104] CPA Step 612 (and) Figure 3 (Same as step 310 in the previous example) is a 64-bit addition, which adds the 64R_S bit set to the corresponding 64R_C bit set and decrements the counter. In step 614, which confirms CPA completion, the control circuit checks whether the counter has reached zero. If the counter is still greater than zero, it re-enters step 612. When the counter reaches zero in step 614, the flowchart ends.

[0105] As will be understood, in Figure 6The flowchart 600 illustrated and described above is an example drawn for clarity of concept only. Other suitable flowcharts may be used in alternative embodiments of the invention. For example, in one embodiment, the counter may count up and then be compared with the number of iterations. In some embodiments, the counter is modified after it is confirmed that the counter has completed.

[0106] RSA index calculation

[0107] The RSA algorithm includes exponentiation of large numbers. In the paper by McLvor et al. cited above, the authors describe using a Montgomery multiplier for exponentiation. Exponentiation is formally defined as M = C D MOD(n). D (i.e., the exponent) can be stored in the control circuit 518, or obtained from the processor (e.g., processor 204). Figure 4 Read.

[0108] Figure 7 This is a schematic flowchart 700 illustrating a method for exponentiation according to an embodiment of the present invention. The flowchart is composed of control circuit 518 ( Figure 5 ) Execution. The exponentiation flowchart includes a pre-calculation flowchart 300 ( Figure 3 The execution of ) and the Montgomery multiplication flowchart 600 ( Figure 6 The multiple executions of ) are discussed below. We will formally calculate K = (2 2k The Montgomery precompute of (a,b)%n is called Precompute(k,n); and the Montgomery multiplication M = (a*b)%n is called MONTGOMERY(a,b,n).

[0109] Flowchart 700 begins with a pre-calculation step 702, in which the control circuit executes the pre-calculation process (e.g., flowchart 300). Figure 3 The pre-computed value K = PRECOMPUTE(k,n) is calculated. Then, in step 704 of calculating the initial GPR0, the control circuit executes the Montgomery multiplication procedure (e.g., procedure 600). Figure 6 The control circuit first calculates MONTGOMERY(K,C,n) and stores the result in GPR0. Then, in step 706 of calculating the initial GPR1, the control circuit executes another Montgomery multiplication procedure to calculate MONTGOMERY(K,1,n) and stores the result in GPR1. Now, in setting counter 4098, the control circuit sets the counter value to 4098, which is the number of iterations in the exponentiation.

[0110] After step 708, the control circuit begins a sequence of 4098 exponentiation iterations. GPR0 will store C after the i-th iteration. 2i The value of C, and GPR1 will store C. D[i-1:0]The cumulative exponentiation result. In step 710 of calculating the next GPR0, the control circuit calculates MONTGOMERY(GPR0, GPR0, n), squaring the previous value of GPR0. Next, in step 712 of confirming Di, the control circuit confirms whether the i-th bit of d is logic 1. If so, the control circuit will proceed to step 714 of updating GPR1, where the control circuit will perform Montgomery multiplication (e.g., flowchart 600) to calculate MONTGOMERY(GPR0, GPR1, n), store the result in GPR1, and proceed to step 716 of decrementing the counter (if d[i] is not logic 1 in step 712, the control circuit bypasses step 714).

[0111] In step 716, the control circuit decrements the counter, and then in step 718, it checks whether the counter has reached 0. If so, the exponentiation process ends, and GPR1 stores M, the exponentiation result. If the counter has not reached zero in step 718, the control circuit re-enters step 710 for the next exponentiation iteration.

[0112] As will be understood, in Figure 7 The flowchart 700 illustrated and described above is an example drawn for clarity of concept only. Other suitable flowcharts may be used in alternative embodiments of the invention. For example, in one embodiment, to prevent security attacks that measure the exponentiation time to estimate the number of bits of the logic 1 exponent, the Montgomery multiplication at step 714 is always performed, and the value of the exponent bit d[i] (confirmed in step 712) determines whether GPR1 will be updated with the result of the multiplication. In some embodiments, the counter is cleared in step 708, counted up in step 716, and compared with 4098 in step 718. In another embodiment, the counter increments after being compared with the final value.

[0113] Montgomery's calculation of decimals

[0114] In the Montgomery multiplication method and circuit described above, the next loop is executed in response to the low-order bit of the operand. Therefore, the algorithm works well when the number of bits to be multiplied is less than the width of the IMCE (e.g., N < 4096). The operand should be loaded into the LSB portion of the register, and logic 0 bits should be loaded into the unused MS portion.

[0115] The configurations of Montgomery multiplication devices (MMA) 100 and 400 (including the Montgomery pre-computation circuitry (MPC) 104 and the integrated Montgomery computation engine (IMCE) 402), and the methods described in flowcharts 300, 600, and 700 above, are merely illustrative configurations and methods for clarity of concept. Any other suitable configurations and flowcharts may be used in alternative implementations. The various components of the Montgomery multiplication devices (MMA) 100 and 400 (including the Montgomery pre-computation circuitry 104 and the integrated Montgomery computation engine 402) may be implemented using suitable hardware, such as in one or more application-specific integrated circuits (ASICs) or field-programmable gate arrays (FPGAs).

[0116] Although the implementation methods described herein primarily refer to Montgomery multiplication, Montgomery precomputation, and Montgomery-based exponentiation, the methods and systems described herein can also be used in other applications, such as fast division.

[0117] Therefore, it will be understood that the above embodiments are referenced by way of example, and the invention is not limited to the embodiments specifically shown and described above. Rather, the scope of the invention includes combinations and sub-combinations of the various features described above, as well as variations and modifications that may occur to those skilled in the art upon reading the foregoing description and that are not disclosed in the prior art. Documents incorporated herein by reference will be considered part of the application, and the definitions in this specification should be considered only to the extent that any terms are defined in those incorporated documents to the extent that they conflict with the definitions expressly or implicitly made in this specification.

Claims

1. An integrated Montgomery multiplier for multiplying two multiplicands and then taking the modulus by a predefined number, the integrated Montgomery multiplier comprising: A carry-retaining adder circuit, the carry-retaining adder circuit having multiple inputs and an output including an sum output and a carry output; as well as A control circuit, coupled to the input and output of the carry-retaining adder circuit, is configured to operate the carry-retaining adder circuit in at least (i) a first setting for calculating the Montgomery pre-calculated value and (ii) a second setting for calculating the Montgomery multiplication of the two multiplicands. The control circuit wherein, in the first setting, the sum output and the carry output of the carry-retaining adder circuit are logically shifted left, and in the second setting, the sum output and the carry output of the carry-retaining adder circuit are logically shifted right, and the shifted sum output and the shifted carry output are coupled to the corresponding inputs of the carry-retaining adder circuit.

2. The integrated Montgomery multiplier of claim 1, wherein in the first configuration, the control circuit is configured to set two of the inputs of the carry-holding adder circuit to constant values ​​depending on the predefined number.

3. The integrated Montgomery multiplier of claim 1, wherein in the first configuration, the control circuit is configured to set the input of the carry-retaining adder circuit to the predefined number or zero based on the sum output of the carry-retaining adder circuit and the most significant bit of the carry output, as well as the two multiplicands.

4. The integrated Montgomery multiplier of claim 1, wherein in the second configuration, the control circuit is configured to set the input of the carry-holding adder circuit to zero or the other multiplicand based on one of the multiplicands.

5. The integrated Montgomery multiplier of claim 1, wherein in the second configuration, the control circuit is configured to set the input of the carry-retaining adder circuit to zero or the predefined number based on the sum output, the least significant bit of the carry output, and the two multiplicands.

6. The integrated Montgomery multiplier of claim 1, wherein the control circuit is configured to further operate the carry-holding adder circuit in a third setting, the third setting calculating the power of a predefined exponent with respect to a predefined base and then taking the modulus of the predefined number.

7. The integrated Montgomery multiplier of claim 6, wherein the control circuitry is configured to operate the carry-holding adder circuitry in the third setting by applying the first setting and the second setting according to a sequence of the predefined exponents.

8. The integrated Montgomery multiplier of claim 1, wherein the carry-preserving adder and the control circuitry are included in a network device and configured to perform encryption operations of the network device.

9. A method for multiplying two multiplicands and then taking the modulus by a predefined number, the method comprising: An operation of a carry-holding adder circuit, the carry-holding adder circuit having multiple inputs and an output including an sum output and a carry output; as well as Using control circuitry coupled to the inputs and outputs of the carry-hold adder circuit, the carry-hold adder circuit is controlled to operate in at least (i) a first setting for calculating the Montgomery pre-calculated value and (ii) a second setting for calculating the Montgomery multiplication of the two multiplicands. The control of the carry-holding adder circuit includes performing a logical left shift on the sum output and the carry output of the carry-holding adder circuit in the first setting, and performing a logical right shift on the sum output and the carry output of the carry-holding adder circuit in the second setting, and coupling the shifted sum output and the shifted carry output to the corresponding inputs of the carry-holding adder circuit.

10. The method of claim 9, wherein controlling the carry-holding adder circuit includes setting two of the inputs of the carry-holding adder circuit to constant values ​​depending on the predefined number in the first setting.

11. The method of claim 9, wherein controlling the carry-retaining adder circuit includes, in the first setting, setting the input of the carry-retaining adder circuit to the predefined number or zero based on the sum output of the carry-retaining adder circuit and the most significant bit of the carry output, as well as the two multiplicands.

12. The method of claim 9, wherein controlling the carry-holding adder circuit includes, in the second setting, setting the input of the carry-holding adder circuit to zero or the other of the multiplicands based on one of the multiplicands.

13. The method of claim 9, wherein controlling the carry-holding adder circuit includes, in the second setting, setting the input of the carry-holding adder circuit to zero or the predefined number based on the sum output, the least significant bit of the carry output, and the two multiplicands.

14. The method of claim 9, wherein controlling the carry-holding adder circuit further includes operating the carry-holding adder circuit in a third setting, the third setting calculating a predefined exponent raised to the power of a predefined base and then modulo the predefined number.

15. The method of claim 14, wherein operating the carry-holding adder circuit in the third setting includes applying the first setting and the second setting according to a sequence of the predefined exponents.

16. The method of claim 9, wherein the carry-holding adder is operated and controlled in the network device to perform encryption operations of the network device.

Images