New Algorithm for Classical Modular Inverse

Transcription

1 New Algorithm for Classical Modular Inverse Róbert órencz C in Prague CR 9/8/00 CHE 00 1

2 Introduction - Modular Inverse Inseparable part of cryptographic algorithms. Always needed classical modular inverse (CMI). Computation CMI over GF(p) is based mainly on algorithms derived from Euclidean algorithm. Efficiency of computing CMI for large integers depends on adaptability of the algorithm to the architecture. CHE 00

3 Algorithms solving CMI suitable for HW implementation Penk s binary algorithm (right-shift) Algorithm based on the Montgomery algorithm (right-shift) Proposed left-shift algorithm All algorithms are based on solving gcd with extended Euclidean algorithm. CHE 00

4 CHE 00 4 < < < < > > I I I gcd integer, positive and Algorithm computing CMI Euclidean Algorithm Guarding conditions Guarding conditions of Ordinary Euclidean Algorithm J I J J J J I I I mod mod < < tarting conditions, guarding conditions, and recurrent equations for computing CMI.

5 Penk s Algorithm for CMI escription i 0 1 q i operations r 0 r 1 r 1 /4 values 17Conversion 1of negative integers 0 g i mod(17) 10mod(17) Conversion of f i odd integers g i g i. Guarding conditions r 1/ / 1/6 /-6 r i r i- qr i r 1 /4 6/ (-6)/-9 q i x, q i 1 r ¼ r r 0 r 1 q r 0 q (17-)14 r 1 (19)- x (# zeros of r i- ) (# r / 17 zeros 1/4of r 14/7 i ) -/ 0 < r i < r i r 17 1/4 (17.1)/4 (17.1)/4 r 1 /4-9 if (r i < 0) then r 17(-) 1(4) 14 ½ /(r r 1 qr )/ (7-)4 (9)-4 r i r i qr i-, x : pf x i ag i 0 < r /4 4/ -4/- i < r i- g r /8 /1 (-)/-7 i > (117)/9 (917)/1 (0)174 4/ 1 ()176 6/ (17)/10 1 CHE 00 5

6 Montgomery Algorithm for CMI escription r r 0 q r 1 I. phase of the Montgomery Algorithm r 17 1/4[1] 14 computes k a mod ( p), )r r 0 ) r 1 where k is the number of deferred halvings. (4)14 17(4) 1(1) q r pf ag Guarding conditions r i r i- q i r i q i x, q i 1 x (# zeros of r i- ) (# zeros of r i ) 0 < r i < r i if (r i < 0) then r r q r 1 r 17 1(1/4) 1/[1] 8 his condition is )r r ) r 1 eliminated by multiplying q )r r 0 ) ) r 1 q ) equation r i r q i- i r i q )r pf ag deferred with q halvings in each i iteration. hen we obtain (8)8 17(8) 1(6) r i r i q i r i-, x : x iophantine equations r 4 r 1 q0 4 r< r i < r q 1 q q i r i pf i ag i, i- r 4 1 1/[17 1(1/4) 1(1/)] 8 where q 1 q q i induce (16)(8) 17(8) 1() deferred halvings. g i > (8) 1(5 17) 7 1 mod (17) mod (17) 5 CHE 00 6

7 rawbacks of previous algorithms ummary Common guarding conditions for the right-shift algorithms : r i r q i- i r i, q i x, q i 1, x ( # zeros of r i- ) (# zeros of r i ), 0 < r < r i i, if (r i < 0) then (r i r qr i i-, x : x, 0 < r < r i i- ). Both algorithms convert odd integers, and test conditions for performing operations /- (r i >0). Penk s Algorithm: conversions of odd and negative values (includes testing) /- operations, conversions are carried out simultaneously with computing remainders less shifts. Montgomery Algorithm for CMI: computation without negative numbers no conversions and testing less /- operations, computing a mod p in nd phase conversion of odd integers (deferred halvings) in k iterations more shifts steps. more CHE 00 7

8 New eft-shift () Algorithm for CMI escription It computes efficiently CMI without redundancies of arithmetical operations in extended Euclidean Algorithm. eft-shifting approach needs no conversions of odd or negative values. s complementary code allows to work with negative integers and choose easily operations /- in computing CMI. CHE 00 8

9 New Algorithm for CMI escription r r 0 q r 1 r 17 [1] (1) 1() r pf ag r r 1 q r r 1 [17(1) 1()] 17() 1() r 4 r q 4 r r 4 17(1) 1() [17() 1()] 17() 1(4) operands. r 5 r 4 q 4 r r 5 17() 1(4) [17() 1()] (5 ) 1(7) Guarding conditions r i r i- ± q i r i q i x, q i 1 x ( # needed bits of r i- ) (# needed bits of r i ) 0 < r i < r i negative integers r i if i < 0) then simple bit test r i r i ± qr i-, x : x 0 < r i < r i- Operation /- is chosen according to sign bits of 1 mod( ) J ) mod( ) 7)mod(17) 10 CHE 00 9

10 A circuit implementation of Algorithm 08; 08; 5X 5Y 5 5V $'' $'' 08; 08; 6)7 6)7 Registers, counters, and flip-flops, combination circuits. G &RWROOH, CHE 00 10

11 Performance analysis and comparison imulation for p < 14 Valid only if special imulation of computation of CMI was HW performed is employed. for p < 14. More than inverses was computed by each algorithm. Algorithm /- min, max av. shifts min, max av. /- & tests min, max av Montgomery Penk s Algorithm is optimized for reducing the # of /- operations. he /- operations are critical in integer arithmetic due to carry propagation in long words. he table does not include tests v > 0 (this is essentially v 0). CHE 00 11

12 Performance analysis and comparison Algorithm for cryptographic primes Primes n /- min, max av. shifts min, max av. inverses ,99, ,78, ,11,179 he average # of /- operations approximately grows linearly with n. he multiplicative coefficient is 0.7 for all primes. he average # of shifts is nearly n. imilar results hold for primes p < 14. CHE 00 1

13 Performance analysis and comparison ummary ime complexity of a /- operations increases approximately with log (# of bits of a word), shift complexity remains constant. In case of >160 bit words the coefficient is >7 Algorithm is: x faster than Mongomery Algorithm and.7x faster than Penk s Algorithm. CHE 00 1

14 Conclusion he new algorithm is always faster and in case of larger word lengths, it is at least x faster. it is suitable for cryptographic systems. It was designed with the aim to allow easy and efficient HW implementation. he future work will concentrate on embedding into FPGA or AIC circuitry used in cryptographic coprocessors, accelerators,etc. CHE 00 14