An Algorithmic and Architectural Study on Montgomery Exponentiation in RNS

Abstract

International audienceThe modular exponentiation on large numbers is computationally intensive. An effective way for performing this operation consists in using Montgomery exponentiation in the Residue Number System (RNS). This paper presents an algorithmic and architectural study of such exponentiation approach. From the algorithmic point of view, new and state-of-the-art opportunities that come from the reorganization of operations and precomputations are considered. From the architectural perspective, the design opportunities offered by well-known computer arithmetic techniques are studied, with the aim of developing an efficient arithmetic cell architecture. Furthermore, since the use of efficient RNS bases with a low Hamming weight are being considered with ever more interest, four additional cell architectures specifically tailored to these bases are developed and the tradeoff between benefits and drawbacks is carefully explored. An overall comparison among all the considered algorithmic approaches and cell architectures is presented, with the aim of providing the reader with an extensive overview of the Montgomery exponentiation opportunities in RNS

Single Base Modular Multiplication for Efficient Hardware RNS Implementations of ECC

“…2) [28,25,18], and those using an intermediate representation called mixed radix system (MRS) [30,7,3]. In hardware, the most efficient BE implementations in state-of-art use the CRT based solution [12,14]. Our proposed modular multiplication algorithm can be used with both types of BE algorithm.…”

“…The modular multiplication, one of the most important arithmetic operation in asymmetric cryptography, is significantly more costly than a simple multiplication. Thus, many algorithms and optimizations have been proposed for RNS modular multiplication, see [26,1,18,2,14,24,12,9,27].…”

Improving Modular Inversion in RNS Using the Plus-Minus Method

“…Full RSA in RNS implementations can be found in [23,2,21]. As far as we know, the best RNS exponentiation algorithm is described in [12]. It introduces a new representation in the second base B which provides faster modular reduction.…”

“…This method has been used for hardware RNS inversion in cryptographic applications [14,7]. In [12], a modular exponentiation algorithm has been proposed. Using the same property, it can be used to compute modular inversion.…”

“…We estimate the number of idle cycles about 60 to 65 % in this architecture. Our FLT-RNS implementation only has from 25 (for NIST primes) to 40 % (for random primes) idle cycles and does fewer operations thanks to the trick proposed in [12].…”