Design of Area and Speed Efficient Modulo 2 n -1 Multiplier for Cryptographic Applications

Transcription

1 Iteratioal Joural of Sciece, Egieerig ad Techology Research (IJSETR) Desig of Area ad Speed Efficiet Modulo 2-1 Multiplier for Cryptographic Applicatios Abstract The ecryptio ad decryptio of PKC algorithms are performed by repeated modulo multiplicatios these multiplicatios differ from those ecoutered i sigal processig ad geeral computig applicatios. The residue umber system (RNS) has emerged as a promisig alterative umber represetatio for the desig of faster ad low power multipliers owig to its merit to distribute a log iteger multiplicatio ito several shorter ad idepedet modulo multiplicatios. The multipliers are the essetial elemets of the digital sigal processig such as filterig, covolutio, trasformatios ad Ier products. RNS has also bee successfully employed to desig fault tolerat digital circuits. The modulo multiplier is usually the ocritical data path amog all modulo multipliers i such high-dr RNS multiplier. This timig slack ca be exploited to reduce the system area ad power cosumptio without compromisig the system performace. With this precept, a family of radix-8 Booth ecoded modulo multipliers, with delay adaptable to the RNS multiplier delay, is proposed. I this paper, the radix-8 Booth ecoded modulo multipliers whose delay ca be tued to match the RNS delay. I the proposed multiplier, the hard multiple is implemeted usig small word-legth ripple carry adders (RCAs) operatig i parallel. By combiig radix-8 Booth ecoded modulo multiplier, CSA ad prefix architecture of multiplier, high speed ad low-power is achieved. Modulo multiplier desig has bee preseted usig Sklasky & Kogge-Stoe parallel-prefix structures. Idex Terms Booth algorithm, modulo arithmetic, residue umber system (RNS), Prefix structures, Public Key Cryptographic (PKC). I. INTRODUCTION Public-key cryptography plays a importat role i digital commuicatio ad storage systems. Processig public-key cryptosystems requires huge amout of computatio, ad, there is therefore, a great demad for developig dedicated hardware to speed up the computatios. Speedig up the computatio usig specialized hardware eables the use of larger keys i public-key cryptosystems. RIVEST, Shamir, ad Adlema (RSA) ad elliptic curve cryptography (ECC) are two of the most well established ad widely used public key cryptographic (PKC) algorithms. The ecryptio ad decryptio of these PKC algorithms are performed by repeated modulo multiplicatios [1] [3].These multiplicatios differ from those ecoutered i sigal processig ad geeral computig applicatios i their sheer. A.Raghavedra, K.Rajasekhar, M.Nishath operad size. To create the private ad public keys we have to deal with the modulo arithmetic operatios like additio, subtractio ad multiplicatio. Whe a umber gets bigger, the arithmetic operatios get more complex. Key sizes i the rage of 512~1024 bits ad 160~512 bits are typical i RSA ad ECC, respectively [4] [6]. Hece, the log carry propagatio of large iteger multiplicatio is the bottle-eck i hardware implemetatio of PKC. Hece, the arithmetic operatios will be simple ad ca be performed o each residue idepedetly givig the provisio of parallel operatios i.e. operatios o all the residues ca be doe at the same time. The residue umber system (RNS) has emerged as a promisig alterative umber represetatio for the desig of faster ad low power multipliers owig to its merit to distribute a log iteger multiplicatio ito several shorter ad idepedet modulo multiplicatios [7] [9]. Hece, the modulo arithmetic operatios will be simple ad ca be performed o each residue idepedetly givig the provisio of parallel operatios i.e. arithmetic operatios o all the residues ca be doe at the same time.rns has also bee successfully employed to desig fault tolerat digital circuits. The Residue Number System (RNS) is a o-weighted umber system that ca map large umbers to smaller residues, without ay eed for carry propagatios.its most importat property is that additios, subtractios, ad multiplicatios are iheretly carry-free. These arithmetic operatios ca be performed o residue digits cocurretly ad idepedetly. Thus, usig residue arithmetic, would i priciple, icrease the speed of computatios RNS has show high efficiecy i realizig special purpose applicatios such as digital filters, image processig, RSA cryptography ad specific applicatios for which oly additios, subtractios ad multiplicatios are used ad the umber dyamic rage is specific. Special moduli sets have bee used extesively to reduce the hardware complexity i the implemetatio of coverters ad arithmetic operatios. Amog which the triple moduli set {2 +1,2,2-1} have some beefits. Sice the operatio of multiplicatio is of major importace for almost all kids of processors, efficiet implemetatio of multiplicatio usig modulo 2-1 is importat for the applicatio of RNS. A RNS is defied by a set of pair-wise co-prime moduli,{l 1,L 2,.L N } such that ay iteger X withi the dyamic rage (DR) i.e.,is represeted as a N-tuple{x 1,,x 2.x N }, where xi is the residue of X modulo 26

2 Iteratioal Joural of Sciece, Egieerig ad Techology Research (IJSETR) [4]-[6]. RNS multipliers based o geeric moduli have bee reported i [1]-[6]. However, special moduli of forms 2 or 2 ±1 are preferred over the the geeric moduli due to the ease of hardware implemetatio of modulo arithmetic fuctios as well as system-level iter modulo operatios, such as RNS-to-biary coversio ad sig detectio. The most popular of these special moduli sets is the triple moduli set, {2-1,2,2 +1} which however has a DR of oly 3 bits. It is obvious that the DR of a existig moduli set ca be exteded by appedig may small word- legth moduli or a few large word-legth moduli. It has bee show that the speed of RNS processor is icreasigly domiated by the residue arithmetic operatio rather tha the oe-time forward or reverse coversio. The paper is orgaized as follows. Sectio II describes the radix8 Booth ecodig algorithm for modulo multiplicatio. Sectio III cosists of proposed desig for radix-8 booth ecoded modulo multiplier has bee preseted. I Sectio IV,a brief itroductio of modulo 2-1 additio is give ad proposed prefix structures are highlighted. The paper is cocluded i Sectio V. II. RADIX-8 BOOTH ENCODED MULTIPLICATION Booth multiplicatio is a techique that allows for smaller, faster multiplicatio circuits, by recodig the umbers that are multiplied. It is the stadard techique used i chip desig, ad provides sigificat improvemets over the "log multiplicatio" techique. The radix-8 Booth ecodig reduces the umber of partial products to which is more aggressive tha the radix-4 Booth ecodig. However, i the radix-8 Booth ecoded modulo 2-1 multiplicatio, ot all modulo-reduced partial products ca be geerated usig the bitwise circular-left-shift operatio ad bitwise iversio. Particularly, the hard multiple +3X 2-1 is to be geerated by a -bit ed-aroud-carry additio of X ad 2X. The modified Booth s algorithm (radix-8 ecodig) starts by appedig a zero to the right of x 0 (multiplier LSB). Quartets are take begiig at positio x 1 ad cotiuig to the MSB with oe bit overlappig betwee adjacet quartets. If the umber of bits i X (excludig x -1 ) is odd, the sig (MSB) is exteded oe positio to esure that the last quartet cotais 4 bits. I every step we will get a siged digit that will multiply the multiplicad to geerate a partial product eterig the Wallace reductio tree. Let ad represet the multiplicad ad the multiplier of the modulo 2-1 multiplier, respectively. The radix-8 Booth ecodig Fig.1. Modulo (2-1) multiplier architecture ca be viewed as a digit set coversio of four cosecutive overlappig multiplier bits y 3i+2 y 3i=1 y 3i (y 3i-1 ) to a siged digit, d i, d i ϵ [-4,4],for i=0,1,.the digit set coversio is formally expressed as d i = y 3i-1 + y 3 + 2y 3i+1-4 y 3i+2 (1) where y -1 = y = y +1 = y +2 =0 Table I summarizes the modulo-reduced multiples of for all possible values of the radix-8 Booth ecoded multiplier digit, where CLS(X,j) deotes a circular-left-shift of Multiplicad by j bit positios. From Table 1, the ecessary modulo-reduced partial products except ±3X ca be geerated by circular-left-shift operatio ad/or bit-wise complemetatio of the multiplicad,x. The geeratio of hard multiple ±3X i.e. (X+2X) requires a large word-legth adder which icreases the critical path delay of the multiplier sigificatly. III. PROPOSED RADIX-8 BOOTH ENCODED MODULO MULTIPLIER DESIGN Fig.2 illustrates the computatio of +3X 2-1 by a -bit ed-aroud-carry additio of X 2-1 ad 2X 2-1 usig RCAs for =8. To esure that the radix-8 Booth ecoded modulo multiplier does ot costitute the system critical path of a high-dr moduli set based RNS multiplier, the carry propagatio legth i the hard multiple geeratio should ot exceed -bits. To this ed, the carry propagatio through the HAs i Fig. 2 ca be elimiated by makig the ed-aroud-carry bit c 7 a partial product bit to be accumulated i the CSA tree. This techique reduces the carry propagatio legth to bits by represetig the hard multiple as a sum ad a redudat ed-aroud-carry bit pair. The resultat ed- Fig.2. Geeratio of +3X 2-1 usig two -bit RCAs. 27

3 Iteratioal Joural of Sciece, Egieerig ad Techology Research (IJSETR) aroud-carry bits i the partial product matrix may lead to a margial icrease i the CSA tree depth ad cosequetly, may aggravate the delay of the CSA tree. I which case, it is ot sufficiet to reduce the carry propagatio legth to merely bits usig the above techique. Sice the absolute differece betwee the ocritical modulo 2-1 multiplier delay ad the system critical path delay depeds o the degree of imbalace i the moduli word-legth of a RNS, the delays caot be equalized by arbitrarily fixig the carry propagatio legth to bits. Istead, we propose to accomplish the adaptive delay equalizatio by represetig the hard multiple i a partially-redudat form [10]. 3.1 GENERATION OF PARTIALLY-REDUNDANT HARD MULTIPLE Let X 2-1 ad 2X 2-1 be added by a group of M=(/k) k-bit RCAs such that there is o carry propagatio betwee the adders. Fig.3 shows this additio for =8 ad k=4. Fig. 3. Geeratio of partially-redudat +3X 2-1 usig k-bit RCAs Table I : Modulo-Reduced Multiples for the Radix-8 Booth Ecodig Quartet value Siged-digi t d i.x 2 value, d i X X CLS(X,1) CLS(X,1) X X CLS(X,2) CLS(,2) X X CLS(,1) CLS(,1) The proposed techique represets the hard multiple i a biased partially-redudat form. Sice the occurreces of the hard multiple caot be predicted at desig time, all multiples must be uiformly represeted. Similar to the hard multiple, all other Booth ecoded multiples listed i Table I must also be biased ad geerated i a partially-redudat form. Fig. 5 shows the biased simple multiples, B+0 2-1, B+X 2-1, B+2X 2-1, B+4X 2-1 represeted i partially redudat form for =8. From Fig. 5, it ca be see that the geeratio of these biased multiples ivolves oly shift ad selective complemetatio of the multiplicad bits without additioal hardware overhead. Fig.4. Geeratio of partially-redudat B+3X 2-1. where the sum ad carry-out bits from the RCA block are represeted as S i j ad c i j for i ϵ [0,K-1] ad jϵ [0,M-1] respectively. I Fig. 3, the carry-out of RCA 0, is ot propagated to the carry iput of RCA 1 but preserved as oe of the partial product bits to be accumulated i the CSA tree. The biary weight of the carry-out of RCA 1 has, however, exceeded the maximum rage of the modulus ad has to be modulo reduced before it ca be accumulated by the CSA tree. Fig. 4 illustrates how these bits i the sum ad the carry outputs of RCA 0 ad RCA 1 are modified. Fig.5. Geeratio of partially-redudat simple multiples. 28

4 Iteratioal Joural of Sciece, Egieerig ad Techology Research (IJSETR) Fig.6. Modulo-reduced partial products ad CC for X.Y Fig.6 illustrates the partial product matrix of X.Y with partial products i partially-redudat represetatio. Each PPi cosists of a -bit vector, pp i7,.. pp i1, pp i0 ad a vector of /k=2, redudat carry bits q i1, q i0. Sice q i0 ad q i1 are the carry-out bits of the RCAs, they are displaced by k-bit positios for a give PP i. The bits, q ij is displaced circularly to the left of q (i-1)j by 3 bits, i.e., q 20 ad q2 1 are displaced circularly to the left of q 10 ad q 11 by 3 bits, respectively q 10 ad q 11 are i tur displaced to the left of q 00 ad q 01 by 3 bits, respectively. The last partial product i Fig.6 is the Compesatio Costat (CC) for the bias itroduced i the partially- redudat represetatio. The geeratio of q ij the modulo-reduced partial products, PP 0, PP 1, ad PP 2, i a partially-redudat represetatio usig Booth Ecoder (BE) ad Booth Selector (BS) blocks are illustrated i Fig.7. The BE block produces a siged oe-hot ecoded digit from adjacet overlappig multiplier bits as illustrated i Fig. 8(a). The siged oe-hot ecoded digit is the used to select the correct multiple to geerate PP i. A bit-slice of the radix-8 BS for the partial product bit, PP ij is show i Fig.8 (b). As the bit positios of do ot overlap, as show i Fig. 6, they ca be merged ito a sigle partial product for accumulatio. The merged partial products, PP i ad the costat CC are accumulated usig a CSA tree with ed-aroud-carry additio at each CSA level ad a fial two-operad modulo 2-1 adder as show i Fig 9 Fig.7. Modulo-reduced partial product geeratio Fig.8 (a).bit-slice of Booth Ecoder (BE). 8 (b).bit-slice of Booth Selector (BS). IV. MODULO 2 N -1 ADDITION 4.1 Parallel prefix additio: The two-operad modulo adder implemeted i fial stage is a parallel-prefix structure with a additioal prefix level for the ed-aroud-carry additio. Modulo 2-1(Mersee- umbers) additio is oe of the most commo operatios that has bee put to hardware. 29

5 Iteratioal Joural of Sciece, Egieerig ad Techology Research (IJSETR) I the prefix stage, the group carry geerate/propagate sigals are computed to form the carry chai ad provide the carry-i for the adder below. Various sigal graphs/architectures ca be used to calculate the carry-outs for the fial sum. A few of them are as follows. Post-computatio: I the post-computatio stage, the sum ad carry-out are fially produced. The carry-out ca be omitted if oly a sum eeds to be produced S i =P i ^ C i Fig.9. Modulo-reduced partial product accumulatio. implemetatios because of its circuit efficiecy. The eed for a Parallel Prefix adder is that it is primarily fast whe compared with ripple carry adders. Parallel Prefix adders (PPA) are family of adders derived from the commoly kow carry look ahead adders. These adders are best suited for adders with wider word. The commo method of doig modulo additio is to utilize the carry-lookahead equatios ad use carry-geerates/propagates sigals recursively to get the fial result i just oe step.a geeral prefix additio process structure is show i fig 10. I this paper, modified parallel-prefix structure is employed to achieve the fastest architecture. May techiques ca help modulo additio. The schemes we preset here is Sklasky Parallel Prefix Structure with ed-aroud carry additio ad Kogge-Stoe prefix structure. [11] ad [12] A parallel prefix adder ca be see as a 3-stage process amely Pre-computatio, Prefix ad Post-computatio 4.2 Proposed parallel prefix structures: The square ( ) ad diamod ( ) odes form the Pre ad Postprocessig stages, respectively. The black odes ( ) evaluate the prefix operator ad White odes ( ) pass the sigals uchaged to the ext prefix level Fig.11. Proposed Ed-aroud carry Parallel Prefix adder structure (=8) where a i ad b i are the operad iput sigals, g i ad p i the geerate ad propagate, C i the carry, ad S i the sum output sigals at bit positio i. C 0 ad C correspod to the carry-i ad carry-out C out, respectively.the proposed prefix structures are show i fig12 ad fig13 Fig.10. Parallel Prefix Additio Process Steps Pre-computatio : I pre-computatio stage, each bit computes its carry geerate (g)/propagate (p) sigals ad a temporary sum as below. These two sigals are said to describe how the Carry-out sigal will be hadled. g i = a i. b i p i = a i ^ b i c i +1 = g i + p i. c i Prefix: Fig.12.Sklasky prefix structure The Sklasky prefix tree has Miimal depth ad High fa-out odes, where as Kogge-Stoe adder results i low 30

6 Iteratioal Joural of Sciece, Egieerig ad Techology Research (IJSETR) depth, high ode cout (implies more area) ad miimal fa-out of 1 at each ode (implies faster performace) of the proposed multiplier is cotrolled by the word-legth of the small parallel RCAs was proposed. These RCAs are used to compute the requisite hard multiple of the radix-8 Booth ecoded multiplicatio. REFERENCES [1] R. Rivest, A. Shamir, ad L. Adlema, A method for obtaiig digital sigatures ad public key cryptosystems, Commu. ACM, vol. 21, o.2, pp , Feb [2] V. Miller, Use of elliptic curves i cryptography, iproc. Advaces i Cryptology-CRYPTO 85, Lecture Notes i Computer Sciece, 1986, vol. 218, pp Fig.13.Kogge-Stoe prefix structure V. RESULTS [3] N. Koblitz, Elliptic curve cryptosystems, math- mat. of Comput., vol. 48, o. 177, pp , Ja [4] Natioal Istitute of Stadards ad Techology [Olie]. Available: PubsSPs.html [5] A. K. Lestra ad E. R. Verheul, Selectig cryptographic key sizes, J. Cryptol., vol. 14, o. 4, pp , Aug [6] C. McIvor, M. McLooe, ad J. V. McCay, Modified Motgomery modular multiplicatio ad RSA expoetiatio techiques, IEEE Proc Comput. ad Dig.tech que vol. 151, o. 6, pp , Nov [7] D. M. Schiiaakis, A. P. Fouraris, H. E. Michail, A. P. Kakaroutas, ad T. Stouraitis, A RNS implemetatio a FP Elliptic curve poit multiplier, IEEE Tras.Circuits Syst. I, Reg. Papers, vol. 56, o.6, pp , Ju [8] J. C. Bajard ad L. Imbert, A full RNS implemetatio of RSA, IEEE Tras. Comput. Brief Cotributios, vol.53, o. 6, pp , Ju [9] H. Nozaki, M. Motoyama, A.Shimbo, ad S.Ava mura, Implemetatio of RSA algorithm based o RNS Motgomery multiplicatio, i Proc. Workshop o Cryptographic Hardware ad Embedded Systems, Paris,Frace, May 2001, pp [10] G. W. Bewick, Fast multiplicatio: Algorithms ad implemetatio, Ph.D. dissertatio, Staford Uiv., Staford, CA, 1994 The CSA tree is applied to reduce the speed for compressio of colum size from N to two. The resultat propagated carry ad sum from CSA adder is fed to parallel-prefix adder to achieve modulo multiplier output. The simulatio results of proposed modulo multiplier have bee verified usig Skalaksy & Kogge-Stoe prefix adders. The desig has bee implemeted usig verilog HDL ad sythesized usig Xilix ISE w.r.t Sparta3E FPGA device. The proposed multiplier modulo (2-1) shows a extremely regular structure ad is very suitable for VLSI implemetatio. [11] R. Zimmerma, Efficiet VLSI implemetatio of Modulo additio ad 2 ± 1multiplicatio, iproc.14 th IEEESymp.Computer Arithmetic, Adelaide, Australia Apr. 1999, pp [12] Parallel-prefix structures for biary ad modulo {2-1, 2, 2 +1} adders JuChe,2004 VI. CONCLUSION A ew approach for low-power modulo 2-1 multiplic catio with high speed parallel prefix adders where the delay 31