Montgomery reduction

Abstract

The approaches proposed here relate to apparatus and method for performing a Montgomery reduction of an input C modulo a modulo N, in particular within the framework of a Montgomery multiplication, comprising: (i) performing a multiplication to obtain an approximate product Y based on a value D and the modulo N, wherein only a higher-order part of the approximate product Y is computed and / or approximated by means of an incomplete execution of the multiplication and wherein the value D is derived from the input C and an auxiliary number N' of the Montgomery reduction, (ii) determining a sum by adding a word or part of the input C with a word or part of the approximate product Y, (iii) determining a carry depending on the sum, and (iv) adding the carry to the input C or to a value derived from the input C.

Description

[0001] The approaches presented here concern Montgomery reduction, in particular Montgomery multiplication.

[0002] The task is, in particular, to improve known approaches and, especially, to create a more efficient way to carry out the Montgomery reduction.

[0003] This problem is solved according to the features of the independent claims. Preferred embodiments can be found in particular in the dependent claims.

[0004] The examples proposed herein can be based on at least one of the following solutions. In particular, combinations of the following features can be used to achieve a desired result. The features of the device can be combined with features of the method, or vice versa.

[0005] For example, a device for performing a Montgomery reduction of an input C modulo a module N, particularly within the framework of a Montgomery multiplication, is used as a solution, wherein the device comprises a processing unit configured to - Performing a multiplication to obtain an approximate product Y based on a value D and the modulus N, - where only a higher-value part of the approximated product Y is calculated and / or approximated based on an incomplete execution of the multiplication, - where the value D is derived from the input C and an auxiliary number N' of the Montgomery reduction, - Determining a sum by adding a word or part of the input C with a word or part of the approximate product Y, - Determining a carry-over depending on the sum, - Adding the carry-over to input C or to a value derived from input C.

[0006] It should also be noted that the higher-order part of the approximated product Y includes, in particular, the most significant bit (MSB).

[0007] It is a further development that the processing device is set up so that the value D is derived from a multiplication of the input C and the auxiliary number N' modulo 2 n , where n is determined by a word width of a number representation and a number of words.

[0008] It should be noted that the addition "modulo 2" n “ causes only the lower half of the product of input C and auxiliary number N' to be determined.

[0009] It is a further development that the processing device is set up so that the approximate product Y or a value derived from it, the carry and the input C or a value derived from it are added.

[0010] It is a further development that the processing equipment is set up so that a value Y' derived from the approximated product Y is determined according to Y'=Y div W.

[0011] It is a further development step that the processing equipment is set up so that a value Y'' derived from the approximated product Y is determined according to Y"=Y div W2.

[0012] It is a further development that the processing device is set up so that a value C' derived from the input C is determined according to C'=C div Wm−1.

[0013] It is a further development that the processing facility is set up so that a value C'' derived from the input C is determined according to C"=C div Wm.

[0014] It is a further development that the processing device is set up so that the input C is a long number to be reduced, which is determined by a long number multiplication of two numbers.

[0015] It is a further development that the auxiliary number N' is determined by N':=−N−1 mod Wm.

[0016] It is a further development step that the carry-over is determined to be 0, 1 or 2.

[0017] It is a further development step that the processing facility is set up, that - the carry-over to 0 is determined if the sum equals 0, - the carry to 1 is determined if the sum is greater than 0 and less than or equal to a base of the number representation, - the carry to 2 is determined if the sum is greater than the base of the number representation.

[0018] It is a further development step that the processing facility is set up so that the carry-over to 0, 1 or 2 is determined by rounding based on (C+Y+m)div W, where - m a number of words of module N and - W a basis of number representation describe.

[0019] It is a further development requirement that the processing facility is set up to perform a cryptographic operation, in particular encryption, decryption, signature creation and / or signature verification.

[0020] It is a further requirement that the processing facility includes one of the following or is designed as one of the following: - a processor, - a chip, - a crypto module.

[0021] A method is also proposed for the Montgomery reduction of an input C modulo a module N, in particular within the framework of a Montgomery multiplication, comprising: - Performing a multiplication to obtain an approximate product Y based on a value D and the modulus N, - where only a higher-value part of the approximated product Y is calculated and / or approximated based on an incomplete execution of the multiplication, - where the value D is derived from the input C and an auxiliary number N' of the Montgomery reduction, - Determining a sum by adding a word or part of the input C with a word or part of the approximate product Y, - Determining a carry-over depending on the sum, - Adding the carry-over to input C or to a value derived from input C.

[0022] It is a further development that the value D is derived from a multiplication of the input C and the auxiliary number N' modulo 2. n , where n is determined by a word width of a number representation and a number of words.

[0023] It is a further development that the approximate product Y or a value derived from it, the carry and the input C or a value derived from it are added.

[0024] It is a further development that a value Y' derived from the approximate product Y is determined according to Y'=Y div W.

[0025] It is a further development that a value Y'' derived from the approximate product Y is determined according to Y"=Y div W2.

[0026] It is a further development that a value C' derived from the input C is determined according to C'=C div Wm−1.

[0027] It is a further development that a value C'' derived from the input C is determined according to C"=C div Wm.

[0028] It is a further development that the input C is a long number to be reduced, which is determined by a long-number multiplication of two numbers.

[0029] It is a further development that the auxiliary number N' is determined by N':=−N−1 mod Wm.

[0030] It is a further development step that the carry-over is determined to be 0, 1 or 2.

[0031] It is a further education course that - the carry-over to 0 is determined if the sum equals 0, - the carry to 1 is determined if the sum is greater than 0 and less than or equal to a base of the number representation, - the carry to 2 is determined if the sum is greater than the base of the number representation.

[0032] It is a further development that the carry-over to 0, 1 or 2 is determined by rounding based on (C+Y+m)div W, where - m a number of words of module N and - W a basis of number representation describe.

[0033] The properties, features, and advantages of this invention described above, as well as the manner in which they are achieved, are described below in conjunction with a schematic description of exemplary embodiments, which are explained in more detail in connection with the drawings. For clarity, identical or equivalent elements may be designated with the same reference numerals. Fig. Figure 1 shows an exemplary implementation of the Montgomery algorithm for calculating F:=A⋆nB. Fig. Figure 2 shows an example notation of an algorithm for calculating word by word. F:=A⋆nB. Fig. Figure 3 shows an exemplary implementation of step 3 of the Montgomery algorithm. Fig. 1. Fig. Figure 4 shows an alternative exemplary implementation of step 3 of the Montgomery algorithm. Fig. 1. Fig. Figure 5 shows another exemplary implementation of step 3 of the Montgomery algorithm. Fig. 1. Fig. Figure 6 shows an example of an arrangement comprising a processing unit that provides a cryptographic output depending on an input. Fig. Figure 7 shows a processing device for implementing a cryptographic solution using at least one crypto module.

[0034] Montgomery multiplication is an approach to implementing algorithms that rely on modular arithmetic of long numbers. Long numbers are, for example, numbers suitable for elliptic curve cryptography and RSA algorithms. These can be numbers in a range [2 160 , 2 4096 ] or larger. While modular addition and subtraction are easy to implement, the operation of modular multiplication is significantly more complex. Modular multiplication is the operation F:=A⋅B mod N where N is an odd positive integer less than 2 n Let A, B ∈ [0,N[ be any integers. The expression F denotes the uniquely defined integer from the interval [0,N[ such that A⋅B−F F is divisible by N. Therefore, F can also be defined as follows: F=A⋅B−Q⋅N, with Q:=⌊A⋅BN⌋

[0035] Thus, the largest multiple of N that is less than or equal to A·B is subtracted from A·B. If this holds true... A⋅B=(A⋅BN)⋅N then Q is precisely the largest integer factor that forms this multiple.

[0036] Montgomery multiplication is a variant of modular multiplication. It is defined by A⋆nB:=A⋅B⋅2−nmod N

[0037] Here, 2 -n defined as the modular inverse of 2 n modulo N. If the value of n is clear from the context, then n can be omitted from the notation.

[0038] The following section provides an example of how Montgomery multiplication can be implemented on a processor with a word width of w. In particular, an embodiment is presented that can be applied to a specific implementation.

[0039] The following notations apply: - W is the basis of number representation. - The base W is a power of two, i.e., W = 2 w w is the word width of the number representation; this can be, for example, the width of a processor word (in bits). Example values ​​for w are 8, 16, 32, 64, or 128. In the case of a binary representation, w can also be equal to 2. - The module N is exactly m (≥ 1) words long. It can be assumed that the following holds: Wm−1 <N<Wm.

[0040] The left-hand side of the inequality is not strict, but is accepted for the sake of simplicity. For the sake of completeness, it should be mentioned that N < W m-1 This may apply. Based on this simplified representation, the following applies: n=m⋅w or 2n=Wm. Mathematical realization of Montgomery multiplication

[0041] The purpose of Montgomery multiplication is to implement a normal modular multiplication. Therefore, modular multiplication itself cannot be used to implement Montgomery multiplication.

[0042] The well-known algorithm by P.L. Montgomery uses an auxiliary number. N':=−N−1 mod 2n

[0043] Here, N' is the unique number from an interval [0,2]. n [ with the property (N⋅N'+1)mod 2n=0.

[0044] Fig. Figure 1 shows an exemplary implementation of the Montgomery algorithm for calculating F:=A⋆nB in a standard notation in five steps 1 to 5. The value N' can be pre-calculated.

[0045] It should be noted that the correctness of the result can be recognized by the fact that the result of the product C = A·B is only modified by multiples of N and then divided by 2. nis shared. This corresponds to the definition of A⋆nB. Furthermore, an estimation of the values ​​shows that E ∈ [0, 2N[ and therefore F ∈ [0, N[.

[0046] In step 2, the modular operations modulo 2 are performed. n calculated. It is noteworthy that the operations are modulo 2. n only correspond to the normal non-modular operations together with forgetting the bit positions beyond the nth position.

[0047] In step 4, due to the choice of N' or D, the value C+D·N is divided by 2. n Divisible. In other words, the n least significant bits of C+D·N are all equal to 0. Dividing by 2 n This corresponds to forgetting the lowest n bits or shifting the number down by n bit positions.

[0048] All steps from step 2 onwards, and especially steps 2 and 3, can be referred to as Montgomery reduction. Step 4 can then be part of the Montgomery reduction if the output is to be restricted from a range [0, 2N[ to a range [0,N[) (e.g., for a subsequent multiplication). implementation

[0049] Montgomery multiplication can be implemented using the standard methods of a processor unit (e.g., a CPU) because all operations can be reduced to normal non-modular operations. The operation thus consists of non-modular additions, subtractions, and multiplications of long numbers. These operations are composed of the corresponding short operations that can be directly implemented by the CPU.

[0050] However, a naive implementation of the above algorithm leads to significant performance losses.

[0051] For an exemplary implementation, processors with a word width of w bits are assumed. For a long integer A, the following representation results: A=am−1⋅Wm−1+⋯+a1⋅W+a0, with a1∈[0,W[

[0052] This applies accordingly to all other numbers. Both representations, i.e., the representation according to formula (6) and the naive representation, can be used equally and also mixed. In an implementation, such a number can be represented as an array of the m words. (ai)i=0m−1 or stored and used in a[m].

[0053] The multiplication of an integer A of word length m A=am−1⋅Wm−1+⋯+a1⋅W+a0, with ai∈[0,W[ with an integer B of word length m' B=bm'−1⋅Wm'−1+⋯+b1⋅W+b0, with bj∈[0,W[ It can be described, for example, as follows: A⋅B=∑i:=0m−1∑j:=0m'−ai⋅bj⋅Wi+j.

[0054] This operation has a complexity of m·m': Here, only the relevant elementary multiplications a are considered. i ·b j counted.

[0055] Elementary multiplications are defined below as operations that can normally be performed directly on a CPU, preferably an operation of the form: mul:[0,W[2→[0,W2[,(ai,bj)↦ai⋅bj or, in word spelling mul:[0,W[2→[0,W[2,(ai,bj)↦(ai⋅bj mod W,ai⋅bj div W).

[0056] To calculate C = A·B, m is therefore needed 2 multiple times are applied. Furthermore, an unspecified number of summations with carry treatments are performed.

[0057] This also applies accordingly to the multiplications D·N in step 3 and C·N' in step 2. It should be noted that although C is a number with 2m words, the following holds true: C⋅N' mod 2n=(C mod 2n)⋅N' mod 2n, and thus it is effectively a multiplication by m' = m.

[0058] Overall, a first estimate for the complexity of a Montgomery multiplication is determined to be 3m. 2 Elementary multiplications. However, this is suboptimal. For example, in step 2, the complete execution of the multiplication C·N' is not possible. C⋅N'=∑i,j:=0m−1ci⋅nj'⋅Wi+j. not necessary, because the values ci⋅nj'⋅Wi+j go through the following mod 2n≡mod Wm

[0059] The operation is completely lost if i+j ≥ m. Therefore, it is sufficient to merely ∑i+j <mci⋅nj'⋅Wi+j. to calculate what only m(m+1)2 This corresponds to elementary multiplications. This measure reduces the complexity of the Montgomery multiplication of 3·m. 2 on 2.5⋅m2+m2 be reduced.

[0060] The following explains how the complexity of the Montgomery multiplication can be further reduced. Word-by-word implementation of the Montgomery multiplication

[0061] Implementations are proposed that take into account from the outset that the long numbers consist of individual words. The representation of numbers as an array, especially a tuple, of words is still given by A=am−1⋅Wm−1+⋯+a1⋅W+a0, with ai∈[0,W[

[0062] This also applies to all other numbers. Both representations can be used equally and in combination.

[0063] The auxiliary number is used. n':=−N−1 mod 2w

[0064] Thus, n' is the unique number from the interval [0,2]. w [ with the property (N⋅n'+1) mod 2w=0.

[0065] Fig. Figure 2 shows an example notation of an algorithm for calculating word by word. F:=A⋆nB in six steps 1 to 6. The value n' can be pre-calculated.

[0066] For further information, see [AJ Menezes et al.: Handbook of Applied Cryptography, Second Edition, 1997, CRC Press LLC, Boca Raton, Section 14.3.2 Barrett reduction, pages 600 to 603].

[0067] The operation in step 3 only takes place on words. Therefore, it can be calculated directly on the CPU and requires two CPU multiplications (and one addition). The result is again a word.

[0068] The operation in step 4 comprises two long-number multiplications, each of a word (a i ,u i ) with a long number (B,N), where the long number has a word length of m. A total of 2m CPU multiplications (and CPU additions) are required for the operation.

[0069] This version of the Montgomery multiplication presented here has the additional advantage that the pre-calculated number n' is only a word, and the corresponding pre-calculation can easily take place on the CPU, whereas N' is a long number whose calculation is more complex.

[0070] The algorithm has a complexity of m · (2m + 2) = 2m 2 + 2m elementary multiplications.

[0071] The complexity can be further reduced to 2m 2 + m: The operation a i · b0 of step 3 can be reused in the calculation of a i B from step 4. Alternatively, the calculation E + a can be performed. i • B is performed before step 3; the result already contains the value (e0 + a) with e0. i · b0) mod W, which is needed for step 3.

[0072] The Montgomery reduction described here can generally be called a modular reduction. Fig. Figure 6 shows an example arrangement comprising a processing unit 401, which receives an input 402, performs a cryptographic procedure (e.g., encryption, decryption, signature creation, or signature verification), and provides a corresponding output 403 (e.g., encrypted data, decrypted data, signature, verified signature, error, etc.). The processing unit 401 can be implemented as a chip, a crypto module, or a processor, or it can comprise at least one chip, one crypto module, and / or one processor. The cryptographic procedure performed on the processing unit 401 uses modular multiplication. The modular reduction described here can be used within the framework of this modular multiplication.

[0073] Fig. Figure 7 shows a processing device 500 with a CPU 501, a RAM 502, a non-volatile memory 503 (NVM), a crypto module 504, an analog module 506, an input / output interface 507 and a hardware random number generator 512.

[0074] In this example, the CPU 501 has access to at least one crypto module 504 via a common bus 505, to which each crypto module 504 is connected. Each crypto module 504 can, in particular, comprise one or more crypto cores to perform specific cryptographic operations. Examples of crypto cores are: - an AES 509 kernel (AES: Advanced Encryption Standard), - a SHA 510 kernel (SHA: Secure Hash Algorithm), - an ECC 511 core (ECC: Error Checking and Correcting) and - an RSA kernel 508 (RSA: Rivest-Shamir-Adleman, refers to a kernel that implements the RSA algorithm).

[0075] The CPU 501, the hardware random number generator 512, the NVM 503, the crypto module 504, the RAM 502, and the input / output interface 507 are connected to the bus 505. The input / output interface 507 can have a connection to other devices, which may be similar to the processing device 500.

[0076] The 504 crypto module can be equipped with or without hardware-based security features.

[0077] Bus 505 itself can be masked or open. Instructions for performing the steps described here can be stored in NVM 503 and processed by CPU 501. The processed data can be stored in NVM 503 or in RAM 502. Supporting functions can be provided by crypto modules 504.

[0078] The steps of the procedure described here can be performed exclusively or at least partially on the 504 crypto module. In particular, at least one modular multiplication comprising the Montgomery reduction described here can be performed on the 504 crypto module.

[0079] In one example, long integer multiplications can be performed in the crypto module 504 or at least partially in the CPU 501. In another example, non-modular integer multiplications are always performed in the crypto module 504.

[0080] The processing device 500 can be, for example, a chip card operated by direct electrical contact or by an electromagnetic field. The processing device 500 can be a fixed circuit or based on reconfigurable hardware (e.g., a field-programmable gate array, FPGA). The processing device 500 can be connected to a personal computer, a microcontroller, an FPGA, or a smartphone. Alternatively, the processing device 500 can be implemented as a cryptographic core, a hardware security module (HSM), or another type of hardware module. Special features during implementation

[0081] The Montgomery algorithm explained above has many advantages in its implementation on a CPU: The individual steps can be performed on the CPU and the algorithm is optimized for the number of elementary multiplications required.

[0082] However, estimating the actual performance of an implementation of the algorithm on a CPU depends on several additional factors: The algorithm consists not only of multiplications, but also of additions / subtractions with or without carry handling. How it is implemented on a CPU depends on the available instructions. For example, a CPU is equipped with a small memory, the so-called register bank, and a large memory, the RAM. The register bank comprises a number (usually 16 or 32) of words (registers) of width w. Only on these registers are fast basic arithmetic operations (multiplication, etc.) possible. Data transfers between RAM and a register are accomplished using instructions (if implemented in software). If arithmetic operations only work on registers, the algorithm (or software) must also ensure that the corresponding input values ​​for the operations are available in the registers in a timely manner. Loading and storing register values ​​takes additional time, especially in purely software-based implementations. In specialized hardware implementations, such data transfers can potentially be performed in the background, but then require complex logistics. In modern CPUs, elementary multiplications often only require one clock cycle to execute. Therefore, an elementary multiplication might only take as much time as an elementary addition, and possibly less time than a load or store operation. Thus, an algorithm optimized for minimizing elementary multiplications, but requiring many load / store operations and additions, may become slower.

[0083] For the following example, it is assumed that an elementary operation requires only one clock cycle. Therefore, the execution time for a Montgomery multiplication is at least 2m. 2 +m bars.

[0084] The execution time of an implementation depends on how many elementary multiplications the algorithm needs, how many additions are required, and how cleverly the register bank is used.

[0085] If m is small enough that, for example, all necessary input values ​​for the Montgomery multiplication A, B, N,n' can be kept in the register bank, then the execution time is dominated by the multiplications and additions; only the loading time of A and B and the time to write back the result need to be additionally considered.

[0086] If m lies in a middle range, such that perhaps only a portion of the values ​​can be kept in the register, e.g. only B, N, n', then by cleverly reloading a i In the background, at the right time, a favorable performance of the implementation may still be achieved.

[0087] However, if m exceeds the size of the register, making it impossible to even store any of the involved numbers completely in the register, the runtime in naive implementations is dominated by loading and saving operations. An elementary operation requires two loading operations and possibly also a saving operation if the data is not readily available in the register.

[0088] Conventional optimization leads to a significantly increased complexity of the software or hardware control system. Optimization becomes even more difficult if the more complex word-by-word Montgomery multiplication is to be implemented instead of non-modular multiplication. Improved approach

[0089] For example, it is assumed that m is a large number. This applies, for instance, to implementations of RSA algorithms. Here, the runtime of the Montgomery multiplication depends on the quadratic factor m. 2 The linear factor dominates; it is rather negligible. The following example assumes that a non-modular multiplication of two numbers of word length m by a number of m 2 + O(m) clock cycles can be implemented.

[0090] In this case, one can, for example, start with the original monolithic implementation of Montgomery multiplication, in which only non-modular multiplications are used. This variant of Montgomery multiplication has a complexity of approximately 3m. 2 Clock cycles. Thus, an implementation with a complexity of 3m is possible. 2 + O(m) is realistic. However, this means a performance loss of at least 50%. Step 2

[0091] To return to a complexity level of 2m 2 To arrive at + O(m), further improvements are required. As described above, it is only necessary to perform the multiplication according to step 2 only in the lower half, see equation (8).

[0092] Such a partial multiplication can be implemented using the same methods as a full multiplication and can be performed with a runtime of 0.5m. 2 + O(m) can be realized. This results in a total runtime of 2.5m. 2 + O(m) clock cycles for a Montgomery multiplication. Step 3

[0093] A further reduction in complexity from a factor of 2.5 to 2 is more complex and takes place in step 3. There, E=(C+D⋅N)2n=C2n+(D⋅N)2n calculated.

[0094] Choosing D ensures that C+D·N is divided by 2 n = W mis divisible, or E is an integer. Therefore, it is sufficient to calculate only the upper half of the sum C+D·N.

[0095] Therefore, only the upper half of D·N can be calculated and added to the upper half of C. This roughly corresponds to a computational effort of approximately m. 2 / 2 instead of m 2 Elementary multiplications or clock cycles. In this case, the total runtime could be reduced to 2m. 2 + O(m) will be reduced.

[0096] Furthermore, an approach could be formulated as follows: Approach: E←C div 2n+(D⋅N)div 2n where "div" stands for integer division without remainder.

[0097] In most cases, C is not divided by 2. n If divisible, then the value (C mod 2) must be n ) by (D·N mod 2 n ) are supplemented to the value 2 n The correct solution is therefore: E←{C div 2n+(D⋅N)div 2n,if 2n|CC div 2n+(D⋅N)div 2n+1,else

[0098] This approach still has the following problems: - It must be C mod 2 n To check if C = 0, the entire lower half of C must be checked. - The term (D·N) div 2 n This requires that D·N be calculated completely, which contradicts the effort optimization described here.

[0099] The following term X:=D⋅N=∑i,j:=0m−1di⋅nj⋅Wi+j can be approximated by X':=∑i+j≥mdi⋅nj⋅Wi+j.

[0100] This term contains (m−1)+(m−2)+⋯+1=(m−1)m2=m2−m2

[0101] Elementary products. The following applies: X−X':=∑i+j≤m−1di⋅nj⋅Wi+j<(∗)∑i+j=m−1W⋅W⋅Wi+j=m⋅W(m+1). (*): It should be noted that the terms with i+j < m - 1 are covered by the terms with i+j = m - 1 if d i = n j = W is rounded up.

[0102] A further improved approximation is: X":=∑i+j≥m−1di⋅nj⋅W1+j.

[0103] This term contains m+(m−1)+⋯+1=m(m+1)2=m2+m2

[0104] Elementary products. The following applies: X −

[0105] Here too, the value X / 2 can n of X" / 2 n The difference is still just under m. The next approximation is: X''':=∑i+j≥m−2di⋅nj⋅Wi+j.

[0106] This term now contains (m−1)+m+(m−1)+⋯+1=m2+3m2−1

[0107] Elementary products and it applies X − and thus XWm−XmWm <m−2W.

[0108] In the case m - 2 < W, this means that X div 2n−X''' div 2n∈{0,1}. and thus E←(C div 2n)+(X''' div 2n)+ε∈{0,1,2} This applies. In a concrete implementation, a criterion is needed to determine the value of ε. The following can be used for this purpose. Estimates are used: C':=C div Wm−1⇒0≤(CWm−C'W)<1W

[0109] According to equation (14): Y:=X'''Wm−2=∑i+j≥m−2di⋅nj⋅Wi+j−(m−2)⇒0≤XWm−YW2 <m−2W.

[0110] In summary, this results in: 0≤(CWm+XWm)−(C'+YW)W <m−1W

[0111] In other words, (C'+YW) / W is a good approximation of E and deviates from it by less than (m-1) / W. Therefore, the following holds: (C'+YW)W∈]E−m−1W,E] or with rounding errors C'+(Y div W)W∈]E−mW,E] or C'+(Y div W)+mW∈]E,E+mW]

[0112] Therefore, assuming that m < W: E=(C'+(Y div W)+m) div W

[0113] Fig. Figure 3 shows an exemplary implementation of step 3 of the Montgomery algorithm. Fig. 1. This algorithm requires m22+1.5m−1 Elementary multiplications. Instead of +m in step 3, it is also possible to add any integer from the interval [m, W - m[.

[0114] It is taken into account that the value in step 2 is not e0' If the lowest word of E' is of interest, but only the transfer to the next higher word is of interest, then a result is obtained in Fig. Figure 4 shows an alternative implementation of step 3 of the Montgomery algorithm. Here, ε in the algorithm corresponds to ε from equation (16). It can only take the values ​​0, 1, 2.

[0115] In the algorithm above, the following criterion applies to ε: ε={2,if c0'+y0'>W1,if W≥c0'+y0'>00,if c0'+y0'=0.

[0116] This criterion has the advantage that the value m no longer appears. While m < W still holds true, an implementation of the criterion does not need to know m. Another advantage is its inexpensive implementation on a CPU.

[0117] Based on this, Fig. 5 another alternative for implementing step 3 of the Montgomery algorithm.

[0118] It should also be noted that in step 2 any other criterion is possible that maps the ranges {0}, ]W - m, W], and ]2W - m, 2W] to the values ​​0, 1, 2. Advantages and other aspects

[0119] The approach described here has several advantages. For example, this solution can be used when implementing Montgomery multiplication word by word results in performance losses. This can be the case, for instance, when... - the long numbers involved are too large to be kept in the registry, - loading and saving data to the register (from / into RAM) takes longer than the actual elementary calculations or - the logistics of data management in the registry bank becomes complicated and possibly unmanageable.

[0120] Another advantage is that the approach described here only requires an implementation of simple non-modular multiplications of long integers, which can preferably be started or stopped "in the middle".

[0121] The approach yields a runtime of 2m 2 + O(m).

[0122] Another advantage is that the criterion for calculating ε can be implemented without knowing m. This is particularly useful in hardware implementations.

[0123] The examples described here enable the determination of a carry of the valency 0, 1 or 2 within the framework of a Montgomery reduction or Montgomery multiplication of long integers.

[0124] In particular, at least one of the following features can be taken into account in one of the solutions presented here: - A long integer to be reduced (C). Montgomery multiplication calculates the number to be reduced by multiplying two given long numbers, whereas in Montgomery reduction, the number to be reduced is given directly. - A long-number multiplication (Y) that only calculates or approximates the upper half of a product by an incomplete execution of the multiplication. - A (partial) word of the number to be reduced (c0') and the approximate product (y0') are added together. Depending on the value of the sum, the carry-over is determined as 0, 1, or 2. This is done, for example, directly according to equation (24) or by a type of rounding such as... ε:=(c0'+y0'+m) div W. - The carry is added to the number to be reduced or to a value derived from it (C"). For example, this is done indirectly, e.g. via C"+Y"+ε as above in Fig. 4 variants shown. - The last two points can alternatively be combined according to the in Fig. 3 variants shown. QUOTES INCLUDED IN THE DESCRIPTION

[0000] This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited non-patent literature

[0000] AJ Menezes et al.: Handbook of Applied Cryptography, Second Edition, 1997, CRC Press LLC, Boca Raton, Section 14.3.2 Barrett reduction, pages 600 to 603

[0066]

Claims

[1] Device for performing a Montgomery reduction of an input C modulo of a module N, in particular in the context of a Montgomery multiplication, wherein the device comprises a processing unit configured to - Performing a multiplication to obtain an approximate product Y based on a value D and the modulus N, - where only a higher-value part of the approximated product Y is calculated and / or approximated based on an incomplete execution of the multiplication, - where the value D is derived from the input C and an auxiliary number N' of the Montgomery reduction, - Determining a sum by adding a word or part of the input C with a word or part of the approximate product Y, - Determining a carry-over depending on the sum, - Adding the carry-over to input C or to a value derived from input C. [2] Device according to claim 1, wherein the processing device is configured such that the value D is derived from a multiplication of the input C and the auxiliary number N' modulo 2 n , where n is determined by a word width of a number representation and a number of words. [3] Device according to claim 1 or 2, wherein the processing device is configured to add the approximate product Y or a value derived therefrom, the carry and the input C or a value derived therefrom. [4] Device according to one of claims 1 to 3, wherein the processing device is configured to determine a value Y' derived from the approximated product Y according to Y'=Y div W. [5] Device according to claim 3, wherein the processing device is configured such that a value Y" derived from the approximated product Y is determined according to Y"=Y div W2. [6] Device according to any one of claims 1 to 5, wherein the processing device is configured to determine a value C' derived from the input C according to C'=C div Wm−1. [7] Device according to any one of claims 1 to 5, wherein the processing device is configured to determine a value C" derived from the input C according to C"=C div Wm. [8] Device according to any one of claims 1 to 7, wherein the processing device is configured such that the input C is a long number to be reduced, which is determined by long number multiplication of two numbers. [9] Device according to any one of claims 1 to 8, wherein the auxiliary number N' is determined by N':=−N−1 mod Wm. [10] Device according to any one of claims 1 to 9, wherein the transfer is determined to 0, 1 or 2. [11] Device according to any one of claims 1 to 10, wherein the processing device is configured such that - the carry-over to 0 is determined if the sum equals 0, - the carry to 1 is determined if the sum is greater than 0 and less than or equal to a base of the number representation, - the carry to 2 is determined if the sum is greater than the base of the number representation. [12] Device according to any one of claims 1 to 10, wherein the processing device is configured such that the carry to 0, 1 or 2 is determined by rounding based on (C+Y+m)div W, where - m a number of words of module N and - W a basis of number representation describe. [13] Device according to any one of claims 1 to 12, wherein the processing unit is configured to perform a cryptographic operation, in particular encryption, decryption, signature creation and / or signature verification. [14] Device according to any one of claims 1 to 13, wherein the processing device comprises or is configured as one of the following: - a processor, - a chip, - a crypto module. [15] Methods for Montgomery reduction of an input C modulo a module N, in particular in the context of a Montgomery multiplication, comprising: - Performing a multiplication to obtain an approximate product Y based on a value D and the modulus N, - where only a higher-value part of the approximated product Y is calculated and / or approximated based on an incomplete execution of the multiplication, - where the value D is derived from the input C and an auxiliary number N' of the Montgomery reduction, - Determining a sum by adding a word or part of the input C with a word or part of the approximate product Y, - Determining a carry-over depending on the sum, - Adding the carry-over to input C or to a value derived from input C. [16] Method according to claim 15, wherein the value D is derived from a multiplication of the input C and the auxiliary number N' modulo 2 n , where n is determined by a word width of a number representation and a number of words. [17] Method according to claim 15 or 16, wherein the approximate product Y or a value derived therefrom, the carry and the input C or a value derived therefrom are added. [18] The method of claim 17, wherein a value Y' derived from the approximated product Y is determined according to Y'=Y div W. [19] The method of claim 17, wherein a value Y" derived from the approximated product Y is determined according to Y"=Y div W2. [20] Method according to any one of claims 15 to 19, wherein a value C' derived from the input C is determined according to C'=C div Wm−1. [21] Method according to any one of claims 15 to 19, wherein a value C" derived from the input C is determined according to C"=C div Wm. [22] Method according to any one of claims 15 to 21, wherein the input C is a long number to be reduced, which is determined by long number multiplication of two numbers. [23] Method according to any one of claims 15 to 22, wherein the auxiliary number N' is determined by N':=−N−1 mod Wm. [24] Method according to any one of claims 15 to 23, wherein the carry is determined to 0, 1 or 2. [25] Method according to any one of claims 15 to 24, wherein - the carry-over to 0 is determined if the sum equals 0, - the carry to 1 is determined if the sum is greater than 0 and less than or equal to a base of the number representation, - the carry to 2 is determined if the sum is greater than the base of the number representation. [26] Method according to any one of claims 15 to 24, wherein the carry-over to 0, 1 or 2 is determined by rounding based on (C+Y+m)div W, where - m a number of words of module N and - W denotes a basis of number representation.

Images