Unbridle the Bit-Length of a Crypto-coprocessor with Montgomery Multiplication

Abstract

Abstract. We present a novel approach for computing 2n-bit Montgomery multiplications with n-bit hardware Montgomery multipliers. Smartcards are usually equipped with such hardware Montgomery multipliers; however, due to progresses in factoring algorithms, the recommended bit length of public-key schemes such as RSA is steadily increasing, making the hardware quickly obsolete. Thanks to our doublesize technique, one can re-use the existing hardware while keeping pace with the latest security requirements. Unlike the other double-size techniques which rely on classical n-bit modular multipliers, our idea is tailored to take advantage of n-bit Montgomery multipliers. Thus, our technique increases the perenniality of existing products without compromises in terms of security.

Bipartite modular multiplication with twice the bit-length of multipliers

“…These techniques are faster than the previous technique proposed by Fischer et al [6] with software approach if C > 1.1c and with hardware approach if C > 3.8c; both of these ratios are satisfied on many platforms [7] due to the difference of computational cost, square order for the multiplications and linear order for the other arithmetic operations. In the case of Montgomery multiplications, the proposal shows better performance than the previous technique proposed by Yoshino et al [20] with the software approach if C > 0.4c, and the proposal with hardware approach is also faster if C > 1.9c: The former ratio is definitely satisfied on most platforms, and the latter is also often satisfied. In the case of bipartite multiplications, our proposal is the only available solution.…”

“…In the case of a pure software approach, our 2 -bit bipartite modular multiplication requires only 12 calls to the multipliers, which is the same calls as the best 2 -bit classical modular multiplications proposed by Chevallier-Mames et al [2] and less calls than 2 -bit Montgomery multiplications proposed by Yoshino et al [20]. The hardware approach for computing the quotient results in half the number of calls compared to the software approach in similar conditions.…”

“…Later, Fischer et al [6] optimized the scheme for the 2 -bit case and Chevallier-Mames et al [2] showed further improvements. Furthermore, Yoshino et al [20] extended the double-size techniques to Montgomery multiplications.…”

A Black Hen Lays White Eggs

“…Algorithm 7 shows how to use the mmu instruction and the cmu instruction to build the BU instruction; the correctness is proven in Appendix A.2. Since the cmu instruction based on Algorithm 6 requiring three calls to the Montgomery multiplier is costlier than the mmu instruction requiring only two calls [YOV07a], Algorithm 7 minimizes calls to the cmu instruction, which appears only once in Step 1. mmu instruction. There are two kinds of modular reductions in the other steps: One is to subtract Z from the most significant (left) side, which is based on the cmu instruction, and the other adds Z from the least significant (right) side based on the mmu instruction.…”

“…On the other hand, the Chinese Remainder Theorem is no help for public operations, and double-size techniques without using private keys are necessary. Following Paillier's seminal paper [Pai99], several solutions were proposed for simulating double-size classical modular multiplications with single-size classical modular multipliers [FS03,CJP03], and later, the techniques were adapted in order to simulate double-size Montgomery multiplications with the commonly used single-size Montgomery multiplier [YOV07a]. Finally, the less common but nonetheless promising bipartite multiplier [KT05], which includes a Montgomery and a classical multiplier working in parallel, was taking advantage of for simulating double-size bipartite multiplications [YOV07b].…”