Relationship between GF(2 m ) Montgomery and Shifted Polynomial Basis Multiplication Algorithms

Transcription

1 elaonsp beeen GF( ) Mongoery and Sfed Polynoal Bass Mulplcaon Algors Hanng Fan and M Anar Hasan Deparen of Elecrcal and Copuer Engneerng Unersy of Waerloo, Waerloo, Onaro, Canada, NL 3G1 Eals: fan@lsuaerlooca and aasan@eceuaerlooca Absrac - Applyng e ar-ecor produc dea of e Masroo ulpler o e GF( ) Mongoery ulplcaon algor, e presen a ne ulpler for rreducble rnoals Ts ulpler and e correspondng sfed polynoal bass (S) ulpler ae e sae crcu srucure for e sae se of paraeers Furerore, by esablsng soorpss beeen e Mongoery and e S consrucons of GF( ), e so a e Mongoery algor can be used o perfor e S ulplcaon ou any canges, and ce ersa Inde Ters - Fne feld, ulplcaon, Mongoery ulplcaon algor, polynoal bass, sfed polynoal bass, rreducble rnoal 1 INTODUCTION Effcen VLSI pleenaon of ulplers for e fne feld GF( ) s poran for any cryposyses To s end, seeral algors and ardare arcecures ae been proposed n e leraure (see, for eaple, [1 _ 13]) Aong e esng algors and arcecures, e use of a polynoal bass () o represen eleens of GF( ) appears o be ore coon an oer bases, suc as noral and dual bases For ardare pleenaon of a GF( ) ulpler usng, ere are o ypes of approaces: 1) Type-I: ulplcaon of o bnary polynoals, eac of degree -1 or less, folloed by a odulo reducon operaon usng an rreducble polynoal f() of degree ) Type-II: foraon of a bnary ar, c depends on one npu and e reducon rreducble polynoal, folloed by a ulplcaon of e ar and e oer npu ecor Type-II approac s suable en e reducon polynoal s fed or s cosen fro a sall se of polynoals For e purpose of represenng eleens of GF( ), a generalzaon of s e so-called sfed polynoal bass (S) proposed n [11] As e nae ples, for any neger, e se { - 1} s a S For GF( ) ulplcaon, e use of S also resuls n o approaces, c are slar o ose of, naely, ype- I and ype-ii For ulplcaon C=AB, ere A, B GF( ), eer or S s used, bo ype-i and ype-ii approaces generae C as e oupu, c s represened n e sae bass as e npus A slgly dfferen nd of ulplcaon scee ess, non as e Mongoery ulplcaon for fne felds, ere for npus A and B, e oupu s AB od f() beng e nerse of a carefully cosen feld eleen GF( ) Ts ype of ulplcaon scee s ereafer referred o as e Mongoery for (MF) Te esng MF algors for GF( ) n [6], [7] fall 1

2 under e ype-i approac enoned earler Aloug e ype-ii approac s possble, ere appears o be no enon of s n e leraure One of e conrbuons of e repor s a ulplcaon scee based on s approac Te follong able suarzes e ree represenaons and e aalable approaces for e ulplcaon n GF( ) TABLE 1: Approaces for, S and MF ulplcaons S MF Type-I [4, 5, 9, 1] [11] [6, 7, 13, 14] Type-II [1,, 3, 8] [11] Ts or Eac of S and MF can be descrbed n ers of a nuber of paraeers Usng rreducble rnoals, e frs so a f S and MF ae e sae paraeers en e ype-ii approac resuls n e sae ulpler srucure for ese o represenaons We en use e feld soorps o nesgae s penoenon furer Te ooorps s no only a poerful eod o sudy algebrac relaonsp of dfferen algebrac srucures bu also an poran ool o desgn effcen algors, eg, e Dscree Fourer Transfor based polynoal ulplcaon algor We deerne all soorpss aong ree represenaons of GF( ): e represenaon, e Mongoery represenaon, and e S represenaon Te an resul of s repor s a e Mongoery ulplcaon algor can be used o perfor e S ulplcaon ou any cange for e sae paraeers, and ce ersa Ts repor s organzed as follos: In Secon, e suarze e preous or on and S ulplcaon algors Deals of e ype-ii approac based ulpler usng MF s proposed n Secon 3 Te relaonsp beeen e Mongoery ulplcaon and e S ulplcaon s presened n Secon 4 Fnally, concludng rears are ade n Secon 5 PEVIOUS WOK 1 Mulplcaon Algors Le f(u) be an rreducble polynoal oer GF() All eleens of GF( )=GF()[u]/(f(u)) can be represened usng a { 1}, ere s a T 1 roo of f Gen o feld eleens A ( a, a,, a a and T, b1,, b 1) 1 1 1) B ( b b, ere a, b GF (), e ype-i ulplcaon algor copues e produc C follong o seps: () Polynoal ulplcaon: T AB a b, ere a b 1 ( c T, c1,, c 1), 1 a b 1 1, 1 c of A and B usng e ; (1)

3 () educon odulo e rreducble polynoal f : C 1 c T od f ( ) Masroo proposed a srucure for e VLSI pleenaon usng e ype-ii approac based on e ar-ecor produc, e, C=(c,c 1,,c -1 ) T =Z(a,a 1,,a -1 ) T [8] Te srucure s soea odular Te ar Z ( z, ), c s, 1 referred o as e Masroo ar [1], depends on bo B and f In order o copue C=Z(a,a 1,,a -1 ) T, Z s copued frs, en c ( 1) s copued n a ecor 1 nner-produc odule ose oupu s c a z S Mulplcaon Algor, Te S of GF( ) oer GF() s a odfcaon of e, and s defned as follos [11]: Defnon 1 Le be an neger and e ordered se M={ 1 } be a polynoal bass of GF( ) oer GF() Te ordered se - M := { - 1} s called e sfed polynoal bass (S) respec o M Usng S, an eleen A GF( ) can be represened as 1 A a Correspondng o e o parallel ulplers as gen n subsecon 1, o S analogues for e rreducble rnoal are proposed n [11], naely, e S ype-i and ype-ii ulplers 3 Mongoery Mulplcaon Algor for Fne Felds Te GF( ) Mongoery ulplcaon algor s presened n [7], and a generalzed erson s proposed n [6] Tey follo e ype-i approac Le f(u) be an rreducble polynoal oer GF() and { 1 } be a of GF( )=GF()[u]/(f(u)) oer GF(), ere s a roo of f Le be e ulplcae nerson of GF( ) ( 1) We non a ere ess ( ) ( f GF ) suc a f ( ) f ( ) 1 Te ype-i Mongoery ulplcaon algor s as follos [6]: Algor A1: Type-I Mongoery ulplcaon algor for GF( ) Inpu: A, B,, f ( ) represened n and f() Oupu: D AB od f() represened n S1: T AB ( ) ( ) ( ), ere ( ), 1 ( ) and M L ( ) M H S: U = L () f ( ) od ; S3: D' = (T+Uf())/; S4: If deg(d')>-1 en D = D' od f() else D= D' H L 1 Snce e oupu of algor A1 s no AB od f() bu AB od f(), c s represened n, soe pre- and pos-processngs are lely o be requred n e 1, 1 3

4 case of eponenaon operaon Ts s slar o e neger case [16, 17], e, e ay frs cange npus of algor A1 fro A and B o A od f() and B od f(), respecely, and en perfor e Mongoery ulplcaon Te oupu, c s AB od f() = AB od f(), ay no be used as an npu o a subsequen ulplcaon We noe a no conerson s requred for eponenaon operaons usng or S ulplcaon algors, snce e oupu of eac of ese algors s e eac produc represened n e sae bass as e npus 3 TPE-II MONTGOME MULTIPLIE FO IEDUCIBLE TINOMIALS In s secon e assue a f(u)=u +u +1 s an rreducble rnoal In [11], s son a e bes alues of e S paraeer are and -1 for e pleenaon of e rreducble rnoal-based b parallel ulpler We no deerne e bes alues of n Mongoery ulplcaon algor A1 If f(u)=u +u +1 en f ( ) =1, and seps S, S3 and S4 of Algor A1 ay be splfed as follos: S': D' = ( ) L ()+ M ()+ ( +1) H (); S3': If deg(d')>-1 en D = D' od f() else D= D' If degrees of all ers of D' are n e range of and -1, en e od operaon n S3' s no perfored Hence f s condon s alays sasfed, for ardare pleenaon no gae s requred for S3' I s easy o see a s condon s equalen o e follong nequales: 1 1, 1, 1 Afer solng ese nequales, e fnd a e alues of are and -1 Hence, e bes alues of for e Mongoery ulplcaon and ose of for e S ulplcaon are e sae In s secon, e assue a s eer or -1 Te copuaonal procedure of e Mongoery ulplcaon Algor A1 s slar o a of e ype-i ulpler, e, e produc of e o polynoals A and B s calculaed frs, and en e reducon operaon s perfored We no apply e ype-ii approac o e copuaon of D AB od f(), and oban a forula of e Mongoery ulplcaon algor for e rreducble rnoal, c s called e ype-ii Mongoery ulpler Te ype-ii Mongoery algor copues D AB od f()=(d,d 1,,d -1 ) T by a sngle ar-ecor produc, e, D=(d,d 1,,d -1 ) T =Z(a,a 1,,a -1 ) T Te ar Z ( z, ), c s also called e Masroo ar, depends on, B, 1 and f In order o copue D, Z s copued frs, en d a z ( 1) s 1, copued n a ecor nner-produc odule So e need o deerne eplc epressons of enres of Z Fro S1 and S4, e ae D

5 1 1 1 () To oban eplc epressons of enres of Z, e ay frs apply (1) o () and en copare e coeffcens of n e ne epresson Ts eod as been used n [11] Afer obanng e enres of ar Z, e ay fnd a ype-ii ulplers based on MF and S sare e sae Masroo ar Z f = In e follong, e do no adop s eod snce s que coplcaed We ge a spler eplanaon Te S ulplcaon forula s obaned fro equaons (3), (6), (7) of [11], e, C (3) Mulplyng o (3) and cangng e range of e eponen of fro [-, --1] o [, -1], e ae C (4) Careful coparsons of forulae () and (4) reeal a D=C f = Snce e ype-ii S ar s dered fro (3), and ulplyng o (3) does no cange s ar, e oban a ype-ii ulplers based on MF and S sare e sae Masroo ar f = Terefore e ay conclude a bo ulplers ae e sae arcecure, and suarze coplees of e ype-ii Mongoery ulpler for e rreducble rnoal f(u)=u +u +1 as follos [11]: Te delay = T ( 1 log ) T ; A AND gaes = ; X XO gaes = 1 /, 4 ELATIONSHIP BETWEEN THE MONTGOME MULTIPLICATION AND THE S MULTIPLICATION In s secon, f(u) denoes a general rreducble polynoal oer GF() and s a roo of f Le M={ 1} be e of GF( )=GF()[u]/(f(u)) oer GF() and { - 1} be e S respec o M 1 Frs, e nroduce soe noaons Le se S a a {, 1}, A 1 a and 1 B b be o eleens of S Le se 1 1 L p {, 1} p, P p and Q 1 q be o eleens of L Le X =(1,,,, -1 ) T and =( -, -+1,, --1 ) T denoe e bass colun ecors of e and S To faclae descrpon, e use sybols A and P o denoe e coordnae ro ecors of and P =(p,p 1,,p -1 ), respecely Le e sybol en A S and P L, e, A =(a,a 1,,a -1 ) A S and P L ay also be ren as A= A X and P= P denoe e ecor nner produc, 5

6 We no presen defnons of e ree consrucons of GF( ) Defnng o 1 operaons + and n S as follos: A B : ( a b ) and A B :=AB od f(), ere denoes e bnary XO operaon and AB denoes e conenonal polynoal ulplcaon, e no a e algebrac srucure F :=<S, +, > s e ell-non represenaon of GF( ) Le = S and s e ulplcae nerse of n F =<S, +, > Le e sybol * denoe e Mongoery ulplcaon operaon We use e ulplcaon operaon of F =<S, +, > o descrbe e operaon *, and oban A*B :=A B I s easy o erfy a e algebrac srucure F M :=<S, +, *> s a feld, and e deny eleen of e * operaon s Le e sybol denoe e S ulplcaon operaon We also use e ulplcaon operaon of F =<S, +, > o descrbe e operaon Te operaon s defned as follos: P Q ( P ) ( Q ) : (( P X ) ( Q X ) (5) Here, e also use e sybol + o denoe e addon operaon n L, c s 1 defned as P Q : ( a b ) I s easy o erfy a e algebrac srucure F S :=<L, +, > s also a feld, and e deny eleen of e operaon s 1 Te aboe dscussons ay be suarzed as follos: Proposon 1 F =<S, +, >, F M =<S, +, *> and F S =<L, +, > are ree soorpc represenaons of e fne feld GF( ) Before analyzng er soorpc appngs, e ge e follong bass conerson forulae beeen e and S represenaons Tey address e por and epor probles of [15] Epor fro o S: A A X A ( A Ipor fro o S:, (6) A ( A (( A X ) ( X ) ( A ) ( ), (7) Epor fro S o : P= P P ( P ) X, (8) Ipor fro S o : P= P ( P X ) ( P X ) X (9) In (7), = denoes e square of n F =<S, +, > In (8), - s an eleen of e feld F S =<L, +, > Please noe a s e ulplcae nerse of n F =<S, +, > In e follong, e ll fnd all soorpss aong e aboe ree represenaons of GF( ) Fro Teore 1 of [14], e no a e dsnc 6

7 auoorpss of GF( ) are eacly e appngs, 1,,, defned by 1 ( ) for ( ) GF and 1 Slar o e proof of Teore 1, e no proe e follong proposon Proposon Te dsnc soorpss of F =<S, +, > ono F M =<S, +, *> are eacly e appngs g, g 1,, g -1 defned by 1 Proof I s easy o see a eac g s one-o-one, and for all g ( A g ( A ( A ( A ( for A F and g A) A A B g ( A) g ( ; ( A ) ( B ) g ( A)* g ( A, B F, e ae So eac g s an soorps of F ono F M Le be a pre eleen of F Te appngs g, g 1,,g -1 are dsnc snce g ) g ( ) for 1 ( No suppose a eleen F, le s an arbrary soorps of F ono F M For e pre e 1 ( ) be s nal polynoal oer e pre feld <{,1}, +, >, ere e1 e e 1 e Usng e deny 1 ( A ) ( A), ere A F and s a non-negae neger, e ae ( ) 1 e 1 ( ) e e 1 1 ( ) So ( ) s a roo of () n F Hence fro Teore 14 of [14] e no a ( ) for soe, 1 Snce s an soorps, en e ae ( A) A for all A F Because g s are becons, e ae e follong corollary fro e aboe proposon Corollary 1 Te dsnc soorpss of F M =<S, +, *> ono F =<S, +, > are eacly e appngs g -1, g -1 1,, g -1-1 defned by 1 Especally, g 1 ( A) A e g 1 A) A ( for A F and M Please noe a e eponenal operaon n e feld F M s no defned n s repor, so e use e ulplcaon operaon of e feld F =<S, +, > o represen e appng g -1 Ts s also one of e reasons a e do no proe Corollary 1 drecly Te oer reason s a eac of e non-zero coeffcens of e nal polynoal of e eleen n F M s, c s e deny eleen of e * operaon n F M =<S, +, *> Te dsnc soorpss of F ono F S are deerned by e follong proposon Proposon 3 Te dsnc soorpss of F =<S, +, > ono F S =<L, +, eacly e appngs, 1,, -1 defned by ( A) > are ( A for A F and ) 1 Especally, ( A) ( A X ) ( A, and s ap s us e bass 7

8 conerson forula (6) Proof I s easy o see a eac s one-o-one, and for all A, B F, e ae ( A (( A ( A ( B ( A) ( ; ( A) ( ( A ( B ((( A X ) (( B X ) ) ( A B ) (( A ( A So eac s an soorps of F ono F S Le be a pre eleen of F Te appngs, 1,, -1 are dsnc snce ) ( ) for 1 ( No suppose a pre eleen F s an arbrary soorps of F ono F S For e, le e 1 ( ) be s nal polynoal oer e pre feld <{,1}, +, >, ere e1 e e 1 e Fro (5) and (9), e ae P Q ((( P X ) ( Q X ) X ) ( P X ) ( Q X ) So e oban e deny neger Tus e ae 1 1 e e ( ) ( ( ) X ) ( A ) ( ( A) X ), ere s a non-negae Terefore ( ( ) X ) s a roo of () n F, and fro Teore 14 of [14], e no a ( ( ) X ) for soe, 1 So e ge ( ) Snce s an soorps, e ge en ( A) ( A for all A F No e deerne soorpss of F M ono F S Snce e coposon of ooorpss s a ooorps, e ay copose e soorpss 1 g : F F and : F F S o oban all soorpss fro F M ono F S : M g ( A) A A, ere, 1 1 Usng e deny ( GF ( ) ), e ae e follong proposon Proposon 4 Te dsnc soorpss of F M =<S, +, *> ono F S =<L, +, > are eacly e appngs,,, defned by 1 1 ( A) (( A for A FM and 1 Especally, A ) ( A X ) A ( ) No e ae found all soorpss aong e ree represenaons of GF( ), naely, F =<S, +, >, F M =<S, +, *> and F S =<L, +, > Gen an soorps 1 of F M ono F S, say, e ae A * B ( ( A) ( ) Snce e focus on e 8

9 effcen copuaon of GF( ) ulplcaon, sould be cosen suc a e copuaon procedure of 1 ( ( A) ( ) s as sple as possble Te soorps s suc a canddae One eod o copose s by coosng g -1 and Te follong couae dagra llusraes e ree soorpss F F S A X A g -1 A X F M Fg 1 Isoorpss, g -1 and In sofare or ardare pleenaons of e Mongoery and e S ulplcaon algors, only coordnaes of e ulpler and ulplcand are noled Terefore e soorps ap ples a an pleenaon of e Mongoery ulplcaon algor n eer ardare or sofare, for eaple, [5], [7] [1] and [13] ec, can be used o perfor e S ulplcaon ou any canges, and ce ersa 5 CONCLUSIONS In s or, e ae found all soorpss aong ree represenaons of GF( ): represenaon, e Mongoery for represenaon and e S represenaon We ae son a e Mongoery ulplcaon algor can be used o perfor e S ulplcaon ou any canges for e sae paraeers, and ce ersa Especally, e ae presened a ne desgn of e GF( ) b-parallel Mongoery ulpler, e, e ar-ecor produc-based Mongoery ulpler, for rreducble rnoals 9

10 EFEENCES [1] B Sunar and C K Koc, "Masroo Mulpler for All Trnoals," IEEE Transacons on Copuers, ol 48, no 5, pp 5-57, May 1999 [] T Zang and K K Par, "Syseac Desgn of Orgnal and Modfed Masroo Mulplers for General Irreducble Polynoals," IEEE Transacons on Copuers, ol 5, no 7, pp , July 1 [3] A Halbuogullar and C K Koc, "Masroo Mulpler for General Irreducble Polynoals," IEEE Transacons on Copuers, ol 49, no 5, pp , May [4] C Paar, "A Ne Arcecure for a Parallel Fne Feld Mulpler Lo Copley based on Copose Felds," IEEE Transacons on Copuers, ol 45, no 7, pp , July 1996 [5] H Wu, "B-parallel Fne Feld Mulpler and Squarer Usng Polynoal Bass," IEEE Transacons on Copuers, ol 51, no 7, pp , July [6] H Wu, "Mongoery Mulpler and Squarer for a Class of Fne Felds," IEEE Transacons on Copuers, ol 51, no 5, pp 51-59, May [7] C K Koc and T Acar, "Mongoery Mulplcaon n GF( )," Desgns, Codes, and Crypograpy, ol 14, pp 57-69, 1998 [8] E D Masroo, "VLSI Arcecures for Mulplcaon oer Fne Feld GF( )," Appled Algebra, Algebrac Algors and Error-Correcng Codes, T Mora, ed, pp 97-39, Sprnger-Verlag, 1988 [9] A eyan-masole and MA Hasan, "Lo Copley B Parallel Arcecures for Polynoal Bass Mulplcaon oer GF( )," IEEE Transacons on Copuers, ol 53, no 8, pp , Aug 4 [1] S O Lee, S W Jung, C H K, J oon, J Ko, and D K, "Desgn of B Parallel Mulpler Loer Te Copley," In Proc ICICS'3, LNCS 971, pp , Sprnger-Verlag, 4 [11] H Fan and Da, "Fas B-Parallel GF( n ) Mulpler for All Trnoals," IEEE Transacons on Copuers, ol 54, no 4, pp , 5 [1] A Sao and K Taano, "A Scalable Dual-Feld Ellpc Cure Crypograpc Processor," IEEE Transacons on Copuers, ol 5, no 4, pp , 3 [13] E Saas, AF Tenca, and CK Koc, "A Scalable and Unfed Mulpler Arcecure for Fne Felds GF(p) and GF( )," Crypograpc Hardare and Ebedded Syses-CHES, CK Koc and C Paar, eds, pp 77-9, Sprnger-Verlag, Aug [14] Ldl and H Nederreer, Fne Fleds, Mass: Addson-Wesley publsng copany, 1983 [15] BS Kals Jr and L n, "Sorage-Effcen Fne Feld Bass Conerson," Seleced Areas n Crypograpy, S Taares and H Meer, eds, pp 81-93, Sprnger-Verlag, 1998 [16] SE Eldrdge and CD Waler, "Hardare pleenaon of Mongoery's odular ulplcaon algor," IEEE Transacons on Copuers, ol 4, no 6, pp , 1993 [17] S Dusse and BS Kals Jr, "A crypograpc lbrary for e Moorola DSP56," In Adances n Crypology - EUOCPT 9, IB Dagard, edor, LNCS-473, pp 3 44, Sprnger-Verlag, 199 1