Accelerated Modular Multiplication Algorithm of Large Word Length Numbers with a Fixed Module

Transcription

1 Accelerated Modular Multplcaton Algorthm of Large Word Length Numbers wth a Fxed Module Nkolaos Bards 1, Athanasos Drgas 1, Alexander Markovskyy, and John Vrettaros 1 1 Natonal Centre for Scentfc Research Demokrtos, DTE/YE Appled Technologes Department & Net Meda Lab, Ag.Paraskev - Athens, 15310, Greece bards@eee.org, dr@mm.demokrtos.gr, vr@mm.demokrtos.gr Natonal Techncal Unversty of Ukrane, Department of Computer Engneerng, 37, Peremohy, pr. Kev 5056, KPI 003, Ukrane markovskyy@rgcds.org Abstract. A new algorthm s proposed for the software mplementaton of modular multplcaton, whch uses pre-computatons wth a constant module. The developed modular multplcaton algorthm provdes hgh performance n comparson wth the already known algorthms, and s orented at the varable value of the module, especally wth the software mplementaton on mcro controllers and smart cards wth a small number of bts. Keywords: Modular multplcaton, Montgomery, Barrett, embedded cryptographc software, effcent mplementatons. 1 Introducton The operatons of modular multplcaton and modular exponentaton are the computatonal bass of an mportant category of the contemporary nformaton securty algorthms, whch are based on the number theory [8]. In partcular, the computatonal mplementaton of such mportant operatons for the contemporary technologes where nformaton securty mechansms are provded (Publc Key Algorthms for encrypton (RSA, ECC), Dffe-Hellman key exchange algorthm, Dgtal Sgnature Algorthms and Dgtal Sgnature Standard), are based on the operatons of modular nvoluton and modular multplcaton. In order to provde the acceptable securty level concernng attacks, the aforementoned algorthms utlze numbers wth word lengths of thousands of bts. Thus, for the maorty of applcatons, nformaton securty under contemporary condtons requres that the length of the numbers utlzed n the algorthms (based on ellptcal curves (ECC)), should range from 18 to 56 bts, whle the length of the numbers utlzed n the algorthms (based on exponental transformaton) should range from 104 to 048 bts [5]. Software mplementaton of modular multplcaton for such long bt numbers on general-purpose processors or mcro-controllers wth a fxed number of bts (from 8 to 64) s very tme consumng. Accordngly, the software mplementaton of nformaton securty, whch s based on publc key algorthms, on the unversal processors, s M.D. Lytras et al. (Eds.): WSKS 010, Part II, CCIS 11, pp , 010. Sprnger-Verlag Berln Hedelberg 010

2 498 N. Bards et al. carred out several orders slower n comparson wth the symmetrc algorthms (such as DES or AES), wth the condton of ensurng adacent levels of securty attacks. The problem of the speed performance of the modular arthmetc operatons of large numbers durng the cryptographc algorthms mplementaton, s especally grave for low-length bt mcro-controllers []. The basc operaton of the modular arthmetc utlzed n algorthms of that class, s the modular nvoluton,.e., the calculaton A К mod M. In ths case, the maorty of the cases of modular nvoluton are carred out by the method of squarng and multplcatons [1], whch uses a number of multplcatons close to the theoretcal mnmum. Based on ths, n order to ncrease the performance of the algorthms mplementaton by software, t s mportant to decrease the tme needed for the modular multplcaton. Consequently, searchng for possbltes to ncrease the performance of modular multplcatons wth the use of software mplementaton on the general purpose processors and mcro-controllers, s mportant and vtal. Prncpal Notatons and Effectveness Estmaton Model of the Modular Multplcaton Algorthms The basc operaton of the modular arthmetc, utlzed n the nformaton securty algorthms s modular multplcaton,.e., the calculaton R=A B mod M. It s assumed that the result R, coeffcent A, multplcand B and module M are n- bts bnary numbers, and that the hgh-order bt of the module s equal to one: n-1 M n, and that the co-factors are lower than the module: A<M, B<M. It s also assumed that the operaton of modular multplcaton s performed on the k- bts general purpose processors, mcroprocessors or mcro-controllers. Accordngly, each of the numbers, whch partcpate n the operaton of modular multplcaton can be represented n the form of s = n/k - bts words: A = s 1 = 0 a k, B = s 1 b = 0 where a, b, m k-bts word, {0,,s-1}. In contrast to the classcal modular multplcaton algorthm [1], contemporary algorthms [3], [6], do not use the operaton of dvson, whch s neffectvely realzed on the general purpose processors. Based on ths, as a crteron of the productvty evaluaton of the software mplementaton of modular multplcaton algorthms, the total operaton tme of multplcaton and addton, whch are the basc operatons of the contemporary algorthms of modular multplcaton, s usually examned [5]. It s assumed that the result of the multplcaton command of two k- bts numbers s a k - bts representaton. By denotng: q m as the number of the requred multplcaton commands t m as the executon tme needed for each command q a as the number of addtonal commands t a - as the executon tme of each addtonal command the estmaton tme of modular multplcaton calculaton of n- bts numbers, whch s acceptable for the comparatve accuracy analyss s: q t + q t. m m a a k, M = s 1 = 0 m k (1)

3 Accelerated Modular Multplcaton Algorthm of Large Word Length Numbers 499 If the executon tme of the multplcaton and addton commands on the processor s w = t mul /t a,, then the executon tme of the modular multplcaton can be represented as t w q + q ). a ( m a 3 Bref Analyss of the Contemporary State of the Acceleraton Problem: The Software Implementaton of the Modular Multplcaton The classcal algorthm for the modular multplcaton software mplementaton [1] wthout detalng the method of the Reduce(X) procedure executon (whch returns the modular reducton of X), s descrbed as follows n the C++ language, n Algorthm 1. Algorthm 1. Classcal scheme of word-by-word Modular Multplcaton R=0; for(=0; <s; ++) { Y=0; for (=0; <s; ++) Y+= (a *b )<<(*k); R += Reduce(Y); f (<s 1) { B<<=k; Reduce(B); } } Reduce(R); The operaton of multplcaton s performed word-by-word: each -th (=0,, s-1) the k- bts word of coeffcent a s multpled by shftng each of s words of multplcand n B. The obtaned product k- bts are added, formng (n+k) - bts, whch s a partal representaton of the product: s 1 = 0 k a B = a b () Followng ths, the modular reducton of the partal expresson s carred out, obtanng -th partal resdual R = a B mod M. The result of the modular multplcaton R=A B mod M s formed as the sum of the modular reductons of the partal expresson of the product: R=(R 0 +R 1 + +R s-1 )mod M. The classcal modular reducton algorthm s acheved wth the use of the operaton of the nteger dvson of k bts dvsble to the k- bts dvder, obtanng a quotent and a resdual.

4 500 N. Bards et al. Snce the dvson of the n- bts numbers on the k- bts processor (n>>k) s carred out very neffectvely, the calculaton of the reducton n the classcal algorthm requres s(s+ 5) operatons of multplcaton and s operatons of the nteger dvson [3]. At present, varous algorthms are proposed [], [3], [5], whch ncrease the performance of the software mplementaton of the modular multplcaton operaton. The largest part of the aforementoned algorthms realze the ncrease n the performance of modular multplcaton due to the acceleraton of modular reducton by the excepton of the operaton of nteger dvson, whch s used n the classcal algorthm [1]. Nowadays, the most effectve method of modular multplcaton s the Montgomery algorthm [6], whch s well adusted to the archtecture of unversal processors. The Montgomery algorthm substtutes the operaton of dvson nto the random module M by the dvsons nto power of, whch effectvely are realzed by SHIFTS. The operaton of modular reducton n Montgomery s algorthm requres s(s+1) operatons of multplcaton. The general computatonal complexty of the mplementaton of the Montgomery modular multplcaton algorthm on a k - bts processor s determned by s +s operatons of multplcaton and by 4s +4s+ addtons. Accordngly, the calculaton tme T M of Montgomery s algorthm on the k- bts processor can be calculated approxmately as follows: TM = ( s + s) tm + (4 s + 4 s + ) ta = ta ( s ( w + 4) + s ( w + 4) + ) (3) Known algorthms assume that each calculaton of modular multplcaton s produced wth the new values of co-factors A, B and of the module M. However, the analyss of the practcal applcaton of nformaton securty algorthms, whch use modular multplcaton, shows that both ther keys, and respectvely the module change relatvely rarely. Ths offers the potental possbltes of further decrease of the computatonal complexty of modular multplcaton by smplfcaton n the reducton. The practcal mplementaton of such possbltes requres specal research and development. On ths bass new modular multplcaton algorthms should be developed, whch wll contan a constant module. The purpose of ths work s the development of an effectve modular multplcaton algorthm of large numbers on general purpose processors wth a constant module. 4 Analyss of the Possbltes of Acceleratng the Modular Multplcaton n the Informaton Securty Systems The nformaton securty algorthms are based on cryptographc propertes. Ths partcular cryptographc property has to do wth the non soluton usng an analytcal method of number theory tasks. These algorthms requre the specal complex procedures of the generaton of keys. In partcular, the wdely used (n practce) algorthm RSA [5] uses a complex procedure to obtan the three numbers d, e and M, of length n from 104 to 048 bts, whch satsfy the dentty A de A. The process of the codng of the block A of a certan message conssts of the calculaton of C=A e mod M, and the decodng of block A s realzed wth the calculaton of A=C d mod M. The par of numbers <d,m> composes the publc key, whle the par <e,m> composes the prvate key.

5 Accelerated Modular Multplcaton Algorthm of Large Word Length Numbers 501 One of the aforementoned keys dependng on the protocol that the RSA uses s publc, whle the other s prvate. The analyss of the practcal use of an RSA algorthm shows that the keys change relatvely rarely so that wth the use of the same key, tens of thousands of nformaton blocks are processed. Ths makes t possble to consder that n the process of computatonal mplementaton, the RSA key and consequently the module are both n effect constant. Analogous reasonngs can also be appled to a number of other, standardzed and wdely utlzed n practce nformaton securty algorthms and n partcular to the Dgtal Sgnature Standard algorthm [5]. The constancy of the module M makes t possble to smplfy the calculaton of modular reducton n the multplcaton process due to the use of precomputatonal results. Such pre-computatons depend only on the value of the module M and therefore, they are carred out once wth a change n the module. The results of the precomputatons reman n the tabular memory and are used repeatedly wth each modular multplcaton calculaton. In the modular multplcaton mplementaton, the part of the computatonal resources s strctly used for the calculaton of multplcaton and the other part for the modular reducton mplementaton. In dfferent modular multplcaton algorthms [6], [7] the specfc weght of expendtures for these two procedures vares. Table 1 gves the quantty of the multplcaton operatons and the word dvsons, whch are utlzed n the most known modular multplcaton algorthms for the calculaton of the product A B and the modular reducton mplementaton [3]. It s obvous that the possbltes of decreasng the number of operatons for the calculaton of the product A B due to the pre-computatons wth a constant module, are completely lmted, snce the module tself s not used drectly n such calculatons. Therefore, the basc reserve for ncreasng the speed of the software mplementaton of modular multplcaton, s the use of pre-computatons for decreasng the computatonal complexty of modular reducton. Data analyss, gven n Table I shows that wth the use of pre-computatons, the greatest effect of the decrease n the mplementaton tme of modular multplcaton, s acheved. Ths takes place due to the reducton of the tme expendtures for the modular reducton. Algorthm Table 1. Quantty of operatons of multplcaton Quantty multplcatons k bts word for calculaton А В Quantty multplcatons k bts word for modular reducton Quantty dvsons word for modular reducton Classcal s s +.5 s s Barrett s s + 4 s 0 Montgomery s s + s 0 Quantty of multplcaton operatons and dvson above the k- bts words, utlzed by dfferent modular multplcaton algorthms and calculaton of the multplcaton of the expresson A B and the resdual of module M.

6 50 N. Bards et al. 5 Modular Multplcaton Organzaton Based on Pre-computatons wth the Fxed Module In the classcal algorthm (Algorthm 1) the modular reducton procedure, Reduce(X), s carred out from the partal products a B and by shftng the code of multplcand B by k bts to the left. In both cases, the length of the reduced number X s not more than (s+1) k- - bts words or more than (s+1) k=(n+k) bts х 0, х 1, х,,х n+k-1 : X n + k 1 = x = 0, x {0,1} The number X can be represented n the form of the sum of two components: (n 1)- bts number X, whch concdes wth (n 1) low-order dgts X and (n+k)- bts number X, whch conssts of (k+1) hgh-order dgts, concdng wth the smlar bts of X and (n 1) low-order dgts, equal to zero: X = n+ k 1 = 0 x = X ' + X '', X ' = n+ k 1 = n 1 x, X '' = n = 0 x In accordance wth the property of congruence for the modular reducton, the resdual X mod M can be represented n the form of the modular reducton as the sum of the resduals of the components X composng X and X : n k 1 X mod M = ( + x = ( X ' mod = 0 M + X ) mod M = ( X ' + X '') mod M = '' mod M ) mod M Snce the hgh order dgts, (n 1)- bts of module M are equal to one, and the Х s equal to (n 1)- bts number, then Х <M and, accordngly Х mod M = Х. Number X contans only k+1 sgnfcant dgts. The rest n 1 low-order dgts are equal to zero. Consequently, X and accordngly X mod M assume only k+1 dfferent values. All possble n- bts values of X mod M for the approprate X, can be pre-computed and stored n the memory as tables. If we desgnate through Z the bnary code, whch conssts of (k+1) hgh order sgnfcant dgts X : Z = n + k 1 x = n 1 n+ 1 and wth T(Z) n- bts code of the tabular value T(Z) = X modm, then the modular reducton procedure Reduce(X) s realzed n accordance wth the followng expresson: Re duce( X ) = X modm = ( T ( Z ) + X '') modm (7) In ths case, the computatonal complexty of the modular reducton mplementaton s determned by maxmum two operatons of addton between (n+k)- bts numbers: the frst for the calculaton of T(Z)+X and the second for executng the subtracton (T(Z)+X )-M, f T(Z)+X M. Snce 0 T(Z)+X < M, for the modular reducton (T(Z)+X ) mod M not more than one subtracton of n- bts numbers, s requred. Therefore, the executon tme of the (4) (5) (6)

7 Accelerated Modular Multplcaton Algorthm of Large Word Length Numbers 503 procedure wll not exceed (s+1) t a, wth the average value of 1.5 s t a. The storage memory, whch s requred for storng all the pre-computed possble values of T(Z) comprses k+1 n bts or k+1 s of k- bts words. The proposed approach s especally effectve n the mplementaton of modular multplcaton on the low-bts mcroprocessors, mcro-controllers and smart cards. In ths case, the memory sze for storng the results of pre-computatons wth a constant module, proves to be completely acceptable for the maorty of applcatons. For example, for the accelerated multplcaton mplementaton of the 104- bts numbers on the 8- bts mcro-controller, the capacty of the requred storage memory wll compose of ( 9 18)= 16 of bytes (64 Kbyte). For the accelerated modular multplcaton mplementaton on the 16-bts processor r, the above capacty requres storage memory, whch substantally grows and therefore decreases the effectveness of the applcaton of pre-computatons. In order to decrease the capacty of the memory requred for storng the results of pre-computatons T(Z), ts mult-secton organzaton, s proposed. The essence of the proposed tables organzaton of pre-computatons les n the fact that the value X s dvded nto q components: ' ' X ' = X 1 + X X wth lengths n+r 1, n+r 1 +r,, n+r 1 + +r q, snce r 1 +r + +r q =k+1. Each - th consttutng X (=1,,q) contans r hgh order sgnfcant dgts, whch concde wth the dgts x n+h, x n+h+1,..., x n+h+r of number X (h=0 for =1 and h =r r 1 for >1), and the rest of the low-order dgts are equal to zero: g + r 1 n+ h X ' = x n+ h, g = rt, {,..., q}, g 1 h= g Followng ths, n accordance wth the property of congruence the modular reducton X mod M can be represented n the form: X mod M = ( X ' 1 mod M + X ' mod M X ' q mod M + X '') mod M In order to determne each of the values of X mod M, the use of the precomputatons results s proposed, where the results are prevously calculated for all possble codes X. Snce a quantty of sgnfcant (non zero) bts n code X s equal to r, then the r number of dfferent values X wll comprse, and the memory capacty for storng all possble values of X mod M respectvely wll be ( r n ) bt. If we denote through Z the bnary r - bts code, whch contans only r hgh order sgnfcant dgts X, then, g + r h= g t = 1 ' q = 0 1 h g n+ h, g = rt, {,..., q}, g 1 = t = 1 Z = x 0 If we denote through T (Z ) n bts code of the tabular value T (Z ) = X mod M, then the modular reducton procedure s realzed n accordance wth the followng expresson: (8) (9) X mod M q = ( T ( Z = 1 ) + X '') mod M (10)

8 504 N. Bards et al. The total volume of the tabular memory for storng T 1 (Z 1 ),T (Z ),,T q (Z q )) comprses n q = 1 r bts. The aforementoned example of storng T(Z) n one table, can be examned as a specal case of the results organzaton wthn subdvded tables, wth precomputatons for q=1. The use of mult-secton tables makes t possble to substantally decrease the memory capacty of ther storage. For example, under the condtons of the example gven above, for the accelerated multplcaton mplementaton of 104- bts numbers on the 8- bts mcro-controller wth the two-secton memory (q=, r 1 =5, r =4=), the requred memory capacty wll compose of 104 ( ) = bts or 6144 bytes or tmes less than durng the sngle-secton organzaton of tabular memory. From another pont of vew, the use of mult-secton organzaton of the tabular memory s combned wth the ncrease of the executon tme of the modular reducton. The calculaton of the sum of expresson (10) requres q(s+1) operatons of summng up k- bts words. The number of sgnfcant dgts of the sum code wll not exceed n ths case n+q, so that, f r 1 q+1, then for executng the modular reducton of sum wth the use of the frst table T 1 (Z 1 ), 1.5(s+1) addton operatons are requred, on average. The total number of the addtonal operatons s: (q+1.5) (s+1). 6 Conclusons The problem of ncreasng the performance of the modular multplcaton software mplementaton, whch s the basc computatonal operaton used n a wde crcle of nformaton securty algorthms was researched. It s shown that durng the practcal applcaton of nformaton securty algorthms, based on the analytcally nsoluble tasks of the number theory, the keys and consequently the module, change relatvely rarely. Based on the conducted research, a new algorthm was proposed for the modular multplcaton that dffers from the classcal organzaton of the modular reducton executon. Reducton n the computatonal complexty of the software mplementaton s acheved by the use of pre-computatons results, whch depend only on the module and whch are stored n the tabular memory. The performance estmaton of the proposed algorthm and memory use for storng the pre-computatons tables are theoretcally substantated. The executed analyss showed that the speed of the software mplementaton of modular multplcaton on the mcro-controllers wth the use of the proposed algorthm grows 1.5-, n comparson wth the most effectve algorthm today, the Montgomery algorthm. References 1. Bosselaers, A., Govaerts, R., Vandewalle, J.: Comparson of three modular reducton functons. In: Stnson, D.R. (ed.) CRYPTO LNCS, vol. 773, pp Sprnger, Hedelberg (1994)

9 Accelerated Modular Multplcaton Algorthm of Large Word Length Numbers 505. Dhem, J.-F., Qusquater, J.-J.: Resent results on modular multplcatons for smart cards. In: Schneer, B., Qusquater, J.-J. (eds.) CARDIS LNCS, vol. 180, pp Sprnger, Hedelberg (000) 3. Hars, L.: Long Modular multplcaton for Cryptographc Applcatons. In: Joye, M., Qusquater, J.-J. (eds.) CHES 004. LNCS, vol. 3156, pp Sprnger, Hedelberg (004) 4. Hong, S.M., Oh, S.Y., Yoon, H.: New modular multplcaton algorthms for fast modular exponentaton. In: Maurer, U.M. (ed.) EUROCRYPT LNCS, vol. 1070, pp Sprnger, Hedelberg (1996) 5. Menezer, A.J., Van Oorschot, P.C., Vanstone, S.A.: Handbook of Appled Cryptography. CRC Press, Boca Raton (1997) 6. Montgommery, P.L.: Modular multplcaton wthout tral dvson. // Mathematcs of Computaton 44, (1985) 7. Barrett, P.: Implementng the Rver Shamr and Adleman publc key encrypton algorthm on a standard dgtal sgnal processor. In: Odlyzko, A.M. (ed.) CRYPTO LNCS, vol. 63, pp Sprnger, Hedelberg (1987) 8. Cohen, H.: A Course n Computatonal Algebrac Number Theory, nd edn. Graduate Texts n Mathematcs. Sprnger, Hedelberg (1995)