Montgomery Multiplication Using Vector Instructions

Abstract

Abstract. In this paper we present a parallel approach to compute interleaved Montgomery multiplication. This approach is particularly suitable to be computed on 2-way single instruction, multiple data platforms as can be found on most modern computer architectures in the form of vector instruction set extensions. We have implemented this approach for tablet devices which run the x86 architecture (Intel Atom Z2760) using SSE2 instructions as well as devices which run on the ARM platform (Qualcomm MSM8960, NVIDIA Tegra 3 and 4) using NEON instructions. When instantiating modular exponentiation with this parallel version of Montgomery multiplication we observed a performance increase of more than a factor of 1.5 compared to the sequential implementation in OpenSSL for the classical arithmetic logic unit on the Atom platform for 2048-bit moduli.

Montgomery Modular Multiplication on ARM-NEON Revisited

“…In [12], Pabbuleti et al implemented the NIST-recommended prime-field curve including P192 and P224 on the Snapdragon APQ8060 within 404, 405 clock cycles via applying multiplicand reduction method into SIMD-based machine. Recently, in SAC'13, a different approach to split the Montgomery multiplication into two parts, being computed in parallel, was introduced [6]. They flip the sign of the precomputed Montgomery constant and accumulate the result in two separate intermediate values that are computed concurrently while avoiding a redundant representation.…”

“…Firstly, we re-organized operands by conducting transpose operation, which can efficiently shuffle inner vector by 32-bit wise. Instead of a normal order ((B[0], B [1]), (B [2], B [3]), (B [4], B [5]), (B [6], B [7])), we actually classify the operand as groups ((B[0], B [4]), (B [2], B [6]), (B [1], B [5]), (B [3], B [7])) for computing multiplication where each operand ranges from 0 to 2 32 − 1(0xffff ffff in hexadecimal form). Secondly, multiplication [7])) where the results are located from 0 to 2 64 −2 33 +1(0xffff fffe 0000 0001).…”

“…In [6], Bos et al introduced a 2-way Montgomery multiplication for SIMD architecture. However, the proposed 2-way Montgomery multiplication has high data interdependency because they used ordinary operand-scanning method for multiplication and reduction procedures which compute partial products in incremental order and previous partial product results are directly used in next step.…”

“…After then the higher bits are added to lower bits of upper intermediate results. For example, higher bits of (C[0], C [4]), (C [2], C [6]), (C [1], C [5]), (C [3]) are added to lower bits of (C [1], C [5]), (C [3], C [7]), (C [2], C [6]), (C [4]). These intermediate results are placed between 0 and 2 33 −2(0x1 ffff fffe) 11 .…”

“…On the other hand, a conventional non-redundant representation based on a radix of 2 32 reduces the number of partial products to only 6 × 6 = 36. At SAC 2013, Bos et al introduced a 2-way Montgomery multiplication for SIMD processors including ARM NEON [6]. Their implementation computes the multiplication and reduction operation simultaneously using a non-redundant representation, which allowed them to exploit the SIMD-level parallelism provided by the NEON engine.…”