Date post: | 11-Jan-2016 |
Category: |
Documents |
Upload: | doris-dorthy-scott |
View: | 227 times |
Download: | 0 times |
Lecture 7
Montgomery Multipliers& Exponentiation Units
Motivation:
Public-key ciphers
Secret-key (Symmetric) Cryptosystems
key of Alice and Bob - KABkey of Alice and Bob - KAB
Alice Bob
Network
Encryption Decryption
Key Distribution Problem
N - UsersN · (N-1)
2Keys
Users Keys
100 5,000
1000 500,000
Digital Signature Problem
Both corresponding sides have the same informationand are able to generate a signature
There is a possibility of the • receiver falsifying the message• sender denying that he/she sent the message
Public Key (Asymmetric) Cryptosystems
Public key of Bob - KBPrivate key of Bob - kB
Alice Bob
Network
Encryption Decryption
Message
Hash function
Public keycipher
AliceSignature
Alice’s private key
Bob
Hash function
Alice’s public key
Non-repudiation
Hash value 1
Hash value 2
Hash value
Public key cipher
yes no
Message Signature
RSA as a trap-door one-way function
M C = f(M) = Me mod N C
M = f-1(C) = Cd mod N
PUBLIC KEY
PRIVATE KEY
N = P Q P, Q - large prime numbers
e d 1 mod ((P-1)(Q-1))
message ciphertext
RSA keys
PUBLIC KEY PRIVATE KEY
{ e, N } { d, P, Q }
N = P Q
e d 1 mod ((P-1)(Q-1))
P, Q - large prime numbers
gcd(e, P-1) = 1 and gcd(e, Q-1) = 1
d:
P, Q:
N:
e:
Mini-RSA keys
PUBLIC KEY PRIVATE KEY
{ e, N } { d, P, Q }
N = P Q = 55
3 d 1 mod 40
P = 5 Q = 11
gcd(e, 5-1) = 1 and gcd(e, 11-1) = 1
d:
P, Q:
N:
e: e=3
d=27
Mini-RSA as a trap-door one-way function
M=2 C = f(2) = 23 mod 55 = 8 C=8
M = f-1(C) = 827 mod 55 = 2
PUBLIC KEY
PRIVATE KEY
N = 5 11 5, 11 - prime numbers
3 27 1 mod ((5-1)(11-1))
message ciphertext
Basic Operations of RSA
Encryption
Decryption
ciphertext
= modplaintext public key modulus
public key exponent
plaintext
= mod
ciphertext private key modulus
private key exponent
k-bits k-bits k-bits
k-bits k-bits k-bits
L=k
L < k
C M
e
N
M C
d
N
Modular arithmetic
Quotient and remainder
Given integers a and n, n>0
! q, r Z such that
a = q n + r and 0 r < n
q – quotient
r – remainder (of a divided by n)
q = an = a div n
r = a - q n = a – an
n =
= a mod n
32 mod 5 =
-32 mod 5 =
Integers coungruent modulo n
Two integers a and b are congruent modulo n
(equivalent modulo n)
written a b
iff
a mod n = b mod n
or
a = b + kn, k Z
or
n | a - b
Rules of addition, subtraction and multiplicationmodulo n
a + b mod n = ((a mod n) + (b mod n)) mod n
a - b mod n = ((a mod n) - (b mod n)) mod n
a b mod n = ((a mod n) (b mod n)) mod n
9 · 13 mod 5 =
25 · 25 mod 26 =
Laws of modular arithmetic
Modular addition
Modular multiplication
Regular addition
Regular multiplication
a+b = a+ciff
b=c
a+b a+c (mod n)iff
b c (mod n)
If a b = a c and a 0then b = c
If a b a c (mod n) and gcd (a, n) = 1then b c (mod n)
Modular Multiplication: Example
18 42 (mod 8) 6 3 6 7 (mod 8)
3 7 (mod 8)
x
6 x mod 8
0 1 2 3 4 5 6 7
0 6 4 2 0 6 4 2
x
5 x mod 8
0 1 2 3 4 5 6 7
0 5 2 7 4 1 6 3
Basic Modular Exponentiation
How to perform exponentiation efficiently?
Problems:
Y = XE mod N = X X X X X … X X mod N
E-times
E may be in the range of 21024 10308
1. huge storage necessary to store XE before reduction
2. amount of computations infeasible to perform
Solutions:
1. modulo reduction after each multiplication2. clever algorithms
200 BC, India, “Chandah-Sûtra”
Right-to-left binary exponentiation
Left-to-right binary exponentiation
Exponentiation: Y = XE mod N
E = (eL-1, eL-2, …, e1, e0)2
Y = 1;S = X;for i=0 to L-1 { if (ei == 1) Y = Y S mod N; S = S2 mod N; }
Y = 1;for i=L-1 downto 0 { Y = Y2 mod N; if (ei == 1) Y = Y X mod N; }
Right-to-Left Binary Exponentiation in Hardware
MUL SQR
Y SE
output
X1
enable
Left-to-Right Binary Exponentiation in Hardware
MUL
Y
E
output
X
1
ControlLogic
Modular Multiplication
Algorithms for Modular Multiplication
Multiplication
Modular Reduction
Multiplication combined withmodular reduction
• Montgomery algorithm
• Classical• Karatsuba• Schönhage-Strassen (FFT)
• Classical• Barrett• Selby-Mitchell
(k2)(klg 3)
(k ln(k))
(k2)
(k2)complexity same as multiplication used
(k2)
2
Montgomery Multiplication
Montgomery Modular Multiplication (1)
Z = X Y mod M
X
Integer domain Montgomery domain
X’ = X 2n mod M
Y Y’ = Y 2n mod M
Z’ = MP(X’, Y’, M) = = X’ Y’ 2-n mod M = = (X 2n) (Y 2n) 2-n mod M = = X Y 2n mod M
Z’ = Z 2n mod M Z = X Y mod M
X, Y, M – (n-1)-bit numbers
Montgomery Modular Multiplication (2)
X’ = MP(X, 22n mod M, M) = = X 22n 2-n mod M = X 2n mod M
Z = MP(Z’, 1, M) = = (Z 2n) 1 2-n mod M = Z mod M = Z
X X’
Z Z’
Basic version of the Radix-2Montgomery Multiplication Algorithm
Montgomery ProductS[0] = 0
S[i+1] =
Z = S[n]
S[i]+xiY2
S[i]+xiY + M2
if qi = S[i] + xiY mod 2= 0
if qi = S[i] + xiY mod 2= 1
for i=0 to n-1
M assumed to be odd
Basic version of the Radix-2Montgomery Multiplication Algorithm
Project 2 Rules
- Groups consisting of 2 students (preferred) or a single student (if needed)
- Each group works on different architectures
- Each group of two works on two similar architectures. Members of the group can freely exchange VHDL code and ideas with each other.
- Students working individually work on a single architecture. They must not exchange code with other students.
- Members of the group of two are graded jointly, unless they agree to split no later than two weeks before the Project deadline.
Investigated Montgomery Multipliers
ScalableNon-Scalable
McIvor, et al.• based on 5-to-2 CSA• based on 4-to-2 CSA
Koc & Tenca• radix 2• radix 4
Huang, et al.• Architecture 2
Huang, et al.• Architecture 1
Harris, et al.• radix 2• radix 4
Suzuki• Virtex 5 DSP• Stratix III DSP
Savas et al.• radix 2• radix 4
G1 G2
G3
G4 G5
G6
Investigated Montgomery Multipliers
ScalableNon-Scalable
• dedicated to one particular operand size
• operand size is described by a generic, and can be changed only after reconfiguration
• size of the circuit varies as a function of the operand size
• flexible, can handle multiple operand sizes
• operand size is described by a special input, and can be changed during run-time
• size of the circuit is constant
Operand sizes:
Evaluated parameters:
Max. Clock Frequency [MHz]Min. Latency [clock cycles]Min. Latency [μs]Resource Utilization (CLB slices/ALUTs, DSP Units, Block Memories)Latency x Area [μs x CLB slices/ALUTs]
Assumptions (1)
Project 2 Rules
- Montgomery Multiplier - required
- Montgomery Exponentiation Unit – bonus
- Virtex 5 and Stratix III – required
- Virtex 6 and Stratix IV - bonus
- 1024 and 2048 bit operand sizes required
- 3072 and 4096 bit operand sizes bonus
• Uniform Interface (to be provided, but may need to be tweaked depending on the architecture)
• Test vectors generated using reference software implementation (may need to be extended to generate intermediate results)
• Your own testbench.
Assumptions (2)
Montgomery Multipliersbased on Carry Save Adders
Carry Save Adder (CSA)
FA
c2 s1
a0 b0
FA
c1 s0
FA
c3 s2
FA
cn sn-1 cn-1
. . .
c0
s3
a1 b1 c1a2 b2 c2an-1 bn-1 cn-1
0 1 0 1 01 1 0 1 11 0 1 1 1
24 23 22 21 20
0 0 1 1 01 1 0 1 1
xyz
sc
Operation of a Carry Save Adder (CSA)
Example
x+y+z = s + c
Carry-save adder for four operands
x3 x2 x1 x0
y3 y2 y1 y0
z3 z2 z1 z0
w3 w2 w1 w0
s3 s2 s1 s0
c4 c3 c2 c1
w3 w2 w1 w0
c4 s3 s2 s1 s0
c4 c3 c2 c1
’’’’’’’’
S5 S4 S3 S2 S1 S0
Carry-save adder for four operands
s0s1s2s3 c1c2c3c4
s0s1s2s3 c1c2c3c4’’’’’’’’
Carry-save adder for four operands
x y z
4 4 4
CSA
CSA
4
w
CPA
sc
s’c’
S
Radix-2 Montgomery Multiplication with Carry Save Addition
Carry Save Reduction 4-to-2
U+V+W+Y = S+C
Radix-2 Montgomery MultiplierBased on Carry Save Reduction 4-to-2
Montgomery Multipliersand Exponentiation Units
by Mc Ivor, et al.
5-to-2 CSA
X1+X2+X3+X4+X5 = SUM + CARRY
5-to-2 CSA Montgomery Multiplication
On the fly calculation of Ai
based on the Carry Save Representation of A
A = A1 + A2
Montgomery Exponentiation
Montgomery Exponentiationbased on the 5-to-2 CSA Montgomery
Multiplier
4-to-2 CSA
X1+X2+X3+X4 = SUM + CARRY
4-to-2 CSA Montgomery Multiplication
ScalableMontgomery Multipliers
by Koc & Tenca
Classical Design by Tenca & KocCHES 1999
Multiple Word Radix-2 Montgomery Multiplication algorithm (MWR2MM)
Main ideas:
Use of short precision words (w-bit each):• Reduces broadcast problem in circuit implementation• Word-oriented algorithm provides the support needed to
develop scalable hardware units.
Operand Y(multiplicand) is scanned word-by-word, operand X(multiplier) is scanned bit-by-bit.
X = (xn-1, …,x1,x0) Y = (Y(e-1),…,Y(1),Y(0))
M = (M(e-1),…,M(1),M(0))
The bits are marked with subscripts, andthe words are marked with superscripts.
Classical Design by Tenca & KocCHES 1999
Each operand has n bits e words e =
n+1
w
Each word has w bits
MWR2MMMultiple Word Radix-2 Montgomery Multiplication
algorithm by Tenca and Koc
Task A
Task B
Task C
e-1 times
Problem
w-1 0. . . .
2w-1 w. . . .
S(0)[0]
S(0)[1]w 1. . . .
x0 x1
w-1
1w-2
2w-2 w+1
2
Calculation dependent on x1 (xi+1 in general) can start only two clock cyclesafter the calculation dependent on x0 (xi in general)
S(1)[0]
S(2)[0] 3w-1 2w. . . .3w-2 2w+1
S(1)[1]2w w+1. . . .2w-1 w+2S(3)[0] 4w-1 3w. . . .4w-2 3w+1
• One PE is in charge of the computation of one column that corresponds to the updating of S with respect to one single bit xi.
• The delay between two adjacent PEs is 2 clock cycles.
• The minimum computation time is
2•n+e-1 clock cycles • given
(e+1)/2 PEs
working in parallel.
Data Dependency Graph by Tenca & Koci=0
i=1
i=2
j=0
j=1
j=2
j=3
j=4
j=5
Data Dependency Graph by Tenca & Koc
Example of Operation ofthe Design by Tenca & Koc
Example of the computation executed for 5-bit operands with word-size w = 1 bit
- C
n = 5
w = 1e = 5
2n + e – 1 = 25 + 5 – 1 = 14 clock cycles
(e+1)/2 =(5+1)/2 = 3 PEs sufficient to perform all computations
Example of Operation ofthe Design by Tenca & Koc
Example of the computation executed for 5-bit operands with word-size w = 1 bit
n = 5
w = 1e = 5
2PEs
Pipelined Organization with Two Processing Elements
Non-ScalableMontgomery Multiplier
by Huang et al.
Main Idea of the New Architecture
• In the architecture of Tenca & Koc– w-1 least significant bits of partial
results S(j) are available one clock cycle before they are used
– only one (most significant) bit is missing
• Let us compute a new partial resultunder two assumptions regarding the value of the most significant bit of S(j) and choose the correct value one clock cycle later
Idea for a Speed-up
w-1 0. . . . 2w-1 w. . . .
S(0) S(1)
0 1. . . .
x0
x1
w-1
1w-2 2w-2 w+1
1 1. . . . 2w-1
2
choose between the two possible results
using missing bit computed at the same time
perform two computationsin parallel using two possible
values of the most-significant-bit
Primary Advantage of the New Approach
• Reduction in the number of clock cycles
from
2 n + e - 1
to
n + e – 1
• Minimum penalty in terms of the area and clock period
Pseudocode of the Main Processing Element
Main Processing ElementType E
The Proposed Optimized Hardware Architecture
The First and the Last Processing Elements
Type D Type F
Data Dependency Graph of the Proposed New Architecture
PE#0 PE#1 PE#2 PE#3
The Overall Computation Pattern
Tenca & Koc, CHES 1999Our new proposed
architecture
Special state of each PE vs. One special PE type simpler structure of each PE
Demonstration of Computations• Sequential
S(0)S(1)S(2) ←X0S(e-1)
• Tenca & Koç’s proposal
PE#0
PE#1
PE#2
←X0
←X1
←X2
S(0)S(1)S(2)S(3)
S(0)S(1)S(2)
S(0)
S(4)
Demonstration of Computations (cont.)
• The proposed optimized architecture
PE#0
PE#1
PE#2
PE#3
PE#(e-1)
S(0)S(0)S(0)S(0)
S(1)S(1)S(1)
S(2)S(2)
S(3)
S(e-1)
S(3)
S(2)
S(1)
S(0) ←X0
←X0
←X0
←X0
←X0
←X1
←X1
←X1
←X2
←X2
←Xe-1←X3
←Xe-3
←Xe-2
←Xe-4
0.000.200.400.600.801.001.201.401.601.802.00
Normalized Latency
1024Operand size 2048 3072 4096
Huang et al. Tenca & Koc McIvor et al.
1.76
0.76
1.76
0.85
1.76
0.81
1.76
1.01
0.000.200.400.600.801.001.201.401.601.802.00
Normalized Product Latency Times Area
1024Operand size 2048 3072 4096
Huang et al. Tenca & Koc McIvor et al.
1.66
1.14
1.64
1.28
1.63
1.21
1.631.55
ScalableMontgomery Multiplier
by Huang et al.
Computations for 5-bit operands using a) 3 PEs, b) 2 PEs
Faster Modular Exponentiation