Simulation Model for a Hardware Implementation of Modular Multiplication

Transcription

1 Smulato Model for a Hardware Implemetato of Modular Multplcato NADIA NEDJAH AND LUIZA DE MACEDO MOURELLE Departmet of de Systems Egeerg ad Computato, State Uversty of Ro de Jaero São Fracsco Xaver, 54, 5 O. Adar, Ro de Jaero, BRAZIL Abstract:- Modular multplcato s fudametal to several publc-key cryptography systems such as the RSA ecrypto system. It s also the most domat part of the computato performed such systems. The operato s tme cosumg for large operads. Ths paper exames the characterstcs of yet aother archtecture to mplemet modular multplcato. A expermetal modular multpler prototype s descrbed VHDL ad smulated. The smulato results are preseted. Key-Words:- Modular multplcato, smulato, cryptosystems. 1 Itroducto The modular expoetato s a commo operato for scramblg ad s used by several publc-key cryptosystems, such as the RSA ecrypto scheme [1]. It cossts of a repetto of modular multplcatos: C = T E mod M, where T s the pla text such that T < M ad C s the cpher text or vce-versa, E s ether the publc or the prvate key depedg o whether T s the pla or the cpher text, ad M s called the modulus. The decrypto ad ecrypto operatos are performed usg the same procedure,.e. usg the modular expoetato. The performace of such cryptosystems s prmarly determed by the mplemetato effcecy of the modular multplcato ad expoetato. As the operads (the pla text of a message or the cpher or possbly a partally cphered) text are usually large (.e. 14 bts or more), ad order to mprove tme requremets of the ecrypto/decrypto operatos, t s essetal to attempt to mmse the umber of modular multplcatos performed ad to reduce the tme requremet of a sgle modular multplcato. A RSA cryptosystem cossts of a set of three tems: a modulus M of aroud 14 bts ad two tegers d ad e called prvate ad publc keys that satsfy the property T de = T mod M. Pla text T obeyg T < M. Messages are ecrypted usg the publc key as C = T d mod M ad decrypted as T = C e mod M. So the same operato s used to perform both processes: ecrypto ad decrypto. Hardware mplemetatos of the RSA cryptosystem are wdely studed as [, 3, 4]. I the rest of ths paper, we start off by descrbg the algorthms used to mplemet the modular operato. The we preset the archtecture of the hardware modular multpler ad expla detals how t executes a sgle multplcato. The we commet the smulato results obtaed for such archtecture.. Multplcato algorthm Algorthms that formalse the operato of multplcato geerally cosst of two steps: oe geerates a partal product ad the other accumulates t wth the prevous partal products. The most basc algorthm for multplcato s based o the add-adshft method: the shft operato geerates the partal products whle the add step sums them up [5]. The straghtforward way to mplemet a multplcato s based o a teratve adderaccumulator for the geerated partal products. However, ths soluto s qute slow as the fal result s oly avalable after clock cycles, s the sze of the operads. A faster verso of the teratve multpler should add several partal products at oce. Ths could be acheved by ufoldg the teratve multpler ad yeldg a combatoral crcut that cossts of several partal product geerators together wth several adders that operate parallel. I ths paper, we use such a parallel multpler as descrbed Fgure 1. Now, we detal the algorthms used to compute the partal products ad to sum them up.

2 Fg. 1: Parallel multpler. Now, we cocetrate o the algorthm used to compute partal products as well as reducg the correspodg umber wthout deteroratg the space ad tme requremet of the multpler. Let X ad Y be the multplcad ad multplcator respectvely ad let ad m be ther respectve szes. So, we deote X ad Y as follows: X = = x X Y= = ad Y = x Y m = y Ispred by the above otato of X, Y ad that of XY, the add-ad-shft method [5] geerates partal products: x Y, <. Each partal product obtaed s shfted left or rght depedg o whether the startg bt was the less or the most sgfcat ad added up. The umber of partal products geerated s boud above by the sze (.e. umber of bts) of the multpler operad. I cryptosystems, operads are qute large as they represet blocks of text (.e. 14 bts). Aother otato of X ad Y allows to halve the umber of partal products wthout much crease space requremets. Cosder the followg otato of X ad XY: ( 1)/ 1 ~ x = = x x 1 x 1 X =, where ~ x X Y = ( 1)/ 1 = ~ x Y ad ~ x ~ x = ~ x = 1 = 1 The possble values of x~ wth the respectve values of x 1, x, ad x 1 are (1), 1 (11, 11), (, 111), 1 (1, 1) ad (11). Ths recodg wll geerate ( ) partal products. Ispred by the above otato, the modfed Booth algorthm [6, 7, 8] geerates the partal products x~ Y. These partal products ca be computed very effcetly due to the dgts of the ew represetato x~. The hardware mplemetato wll be detaled Secto 3. I the algorthm of Fgure 3, the terms 4 1 ad 3 1 are suppled to avod workg wth egatve umbers. The sum of these addtoal terms s cogruet to zero modulo ( 1) 1. So, oce the sum of the partal products s obtaed, the rest of ths sum the dvso by ( 1) 1 s fally the result of the multplcato XY. Algorthm ModMult(x -1,x,x 1, Y) { t product = t pp [ ( 1 )/ 1] pp[]= ( ~ x Y 4 1 ) for = to ( 1 )/ 1 { pp[] = ( x~ Y 3 1 ) product = product pp[] } retur product mod ( 1)/ 1 } Fg. : Multplcato algorthm. 3 Reducto algorthm A modular reducto s smply the computato of the remader of a teger dvso. It ca be deoted by: X X mod M = X M M However, a dvso s very expesve eve compared wth a multplcato. Usg Barrett s method [9, 1], we ca estmate the remader usg two smple multplcatos. The approxmato of the quotet s calculated as follows: X M = X 1 1 M 1 1 X 1 M 1 The equato above ca be calculated very effcetly as dvso by a power of two x are smply a trucato of the operad x-least sgfcat dgts. The term M depeds oly o the modulus M ad s costat for a gve modulus hece, ca be precomputed ad saved a extra regster. Hece the approxmato of the remader usg Barrett s

3 method [9, 1] s a postve teger smaller tha (M 1). So, oe or two subtractos of M mght be requred to yeld the exact remader. 4. Modular multpler archtecture I ths secto, we outle the archtecture of the multpler, whch s depcted Fgure 3. Later o ths secto ad for each of the ma parts of ths archtecture, we gve the detaled crcutry,.e. that of the partal product geerator, adder ad reducer. The multpler of Fgure 4.1 performs the modular multplcato XY mod M three ma steps: 1. Computg the product P = XY. Computg the estmate quotet Q = P/M Q P 1 M 3. Computg the product QM 4. Computg the fal result P QM. Durg the frst step, the modular multpler frst loads regster 1 ad regster wth X ad Y respectvely the wats for PPG to yeld the partal products ad fally wats for the ADDER to sum all of them. Durg the secod step, the modular multpler loads regster 1, regster ad regster 3 wth the obtaed product P, the pre-computed costat M ad P respectvely the wats for PPG to yeld the partal products ad fally wats for the ADDER to sum all of them. Durg the thrd step, the modular multpler frst loads regster 1 ad regster wth the obtaed product Q ad the modulus M respectvely the awats for PPG to geerate the partal products, the wats for the ADDER to provde the sum of these partal products ad fally wats for the REDUCER to calculate the fal result P QM, whch s subsequetly loaded the accumulator acc. Fg. 3: The modular multpler archtecture. Fg. 4: The partal product geerator terface. The terface of the Booth decoder s descrbed Fgure The multpler The multpler terface s show Fgure 4. It s composed of a partal product geerator ad a adder. The partal product geerator s tur composed of k Booth recoders [6, 7, 8] that commucate drectly wth k partal product selectors. Fg. 5: The Booth recoder terface. The Booth selecto logc crcutry used s very smple. The puts are the three bts formg the Booth dgt ad outputs are three bts: the frst oe

4 SelectY s set whe the partal product to be geerated s Y are Y, the secod oe SelectY s set whe the partal product to be geerated s Y are Y, the last bt s the smply the last bt of the Booth dgt gve as put. It allows us to complemet the bts of the partal products whe a egatve multple s eeded. The output sgal are yelded from the put oes as Fgure 6: SelectM <= lsb mdle SelectM <= ( (mdle msb)(lsb mdle)) Sg <= msb Fg. 6: Selecto logc of the Booth decoder. The requred partal products,.e. x~ Y are easy multple. They ca be obtaed by a smple shft. The egatve multples s complemet form, ca be obtaed form the postve correspodg umber usg a bt by bt complemet wth a 1 added at the least sgfcat bt of the partal product. The addtoal terms troduced the prevous secto ca be cluded to the partal product geerated as three/two/oe most sgfcat bts computed as follows, whereby, s the bts cocateato operato, A s the bary otato of teger A, s a ru of zeros ad B<:> s the selecto of the less sgfcat bts of the bary represetato B. pp = s s s ~ x Y s s pp = ( s x Y s s ) 1 ~ for 1 < k 1 ad for = k 1 = k, we have: pp ( s x Y s s ) = ~ pp = ~ x Y k k k [ : ] The terface of the partal product selector s gve Fgure whle the logc of the compoet s show Fgure 8 ad the correspodg logc Fgure 7. PP()<= (SelectM.M()) Sg PP(1)<= (SelectM.M()SelectM.M(1)) Sg... PP()<=(SelectM.M(-1)SelectM.M()) Sg... PP()<=(SelectM.M(-1)SelectM.M()) Sg PP(1)<=(SelectM.M()) Sg Fg. 7: The logc of the partal product selector. Fg. 8: The partal product selector terface. 4. The adder I order to mplemet the adder of the geerated partal products, we use a hybrd ew kd of adder. It cossts of a tal stage of carry save adders followed by a cascade of stages of delayed carry adders [11] ad a fal stage of full adder. The carry save adder (CSA) s smply a parallel esemble of f full adders wthout ay horzotal coecto. Its fucto s to add three f-bt tegers a, b ad c to yeld two ew tegers carry ad sum such that carry sum = a b c. The par (carry, sum) wll be called a delayed carry teger. The delayed carry adder (DCA) s a parallel esemble of f half adders. Its fucto s to add two delayed carry tegers (a 1, b 1 ) ad (a, b ) together wth a teger c to produce a delayed carry teger (sum, carry) such that sum carry = a 1 b 1 a b c. The geeral archtecture of the proposed adder s depcted Fgure 9, where the partal products PP, 15 are the put operads. Usg the carry save adder, the th bt of carry ad sum are defed as sum = a b c ad carry = a b a c b c respectvely. The archtecture of the delayed carry adder uses 5 half adders as descrbed Fgure The reducer The ma task of the reducer cossts of subtractg QM,.e. the product obtaed the thrd step of the modular multpler from P,.e. the product yelded the frst step of the modular multpler. A subtracto of a p-bts teger K s equvalet to the addto of p x. Hece the reducer smply performs the addto P ( m QM). The latter value s smply the two s complemet of QM. The addto s performed usg a carry look-ahead adder. It s based o computg the carry bts C pror to the actual summato. The adder takes advatage of a relatoshp betwee the carry bts C ad the put bts A ad B. C G ( G ( G ( G ( G C P) P) P ) P ) = whereby G = A B ad P = A B. The geeral structure of the used carry look-ahead adder s gve Fgure 1. 5 Smulato results The proect of the modular multpler descrbed throughout ths paper was specfed Very Hgh Speed Itegrated Crcut Descrpto Laguage - VHDL [1], ad smulated usg the MyVHDL Stato of MyCad Ic. [13].

5 Fg. 9: The ma cell of the proposed adder. Fg. 9: The structure of the carry delayed adder. I order to sychrose the work of the MULTIPLIER, ADDER ad REDUCER, we desged a module called the CONTROLLER that cossts of a smple state mache, that has 13 states defed as follows, where ext(s ) = S 1 ad ext(s 1 ) = S. S : talsato of the state mache S 1 : loads multplcator to regster 1 loads multplcad to regster S : wats for the MULTIPLIER S 3 : wats for the ADDER S 4 : wats for the SHIFTER S 5 : loads the product obtaed P to regster 1 loads the costat to regster loads P to regster 3 S 6 : wats for the MULTIPLIER S 7 : wats for the ADDER S 8 : loads the product obtaed Q to regster 1 loads the modulus M to regster S 9 : wats for the MULTIPLIER S 1 : wats for the ADDER S 11 : wats for the REDUCER S 1 : loads regster acc the fal result. I Fgure 1 ad 13, we show how the dfferet regsters of the modular multpler are loaded,.e. whch state, wth the put data X, Y, M ad Cte ad/or wth the results obtaed from the three-steps multplcatos,.e. P, Q, ModProd. 6 Cocluso Fg. 1: The structure of the carry look-ahead adder. I ths paper, a alteratve archtecture for computg modular multplcato based o Booth algorthm ad o Barrett s relaxed resduum method s descrbed.

6 Fg. 1: Cotrolg a 8-bts modular multpler - frst as secod multplcatos. The Booth algorthm s used to compute the product whle Barrett's method s used to calculate the remader. The archtecture was valdated through behavoural smulato results usg the.6µm CMOS-AMS stadard cell lbrary. The total executo tme s 357 aosecods for 14-bt operads. Oe of the advatages of ths modular multplcato mplemetato resdes the fact that t s easly scalable wth respect to the multpler ad modulus legths. 7 Refereces [1] R. Rvest, A. Shamr ad L. Adlema, A method for obtag dgtal sgature ad publc-key cryptosystems, Commucatos of the ACM, 1:1-16, [] E. F. Brckell, A survey of hardware mplemetato of RSA, I G. Brassard, ed., Advaces Cryptology, Proceedgs of CRYPTO'98, Lecture Notes Computer Scece 435:368-37, Sprger-Verlag, [3] C. D. Walter, Systolc modular multplcato, IEEE Trasactos o Computers, 4(3): , [4] S. E. Eldrdge ad C. D. Walter, Hardware mplemetato of Motgomery s Modular Multplcato Algorthm, IEEE Trasactos o Computers, 4(6):619-64, [5] J. Rabaey, Dgtal tegrated crcuts: A desg perspectve, Pretce-Hall, Fg. 13: Cotrolg a 8-bts modular multpler - thrd multplcato. [6] A. Booth, A sged bary multplcato techque, Quarterly Joural of Mechacs ad Appled Mathematcs, pp. 36-4, [7] O. MacSorley, Hgh-speed arthmetc bary computers, Proceedgs of the IRE, pp , [8] G. W. Bewck, Fast multplcato algorthms ad mplemetato, Ph. D. Thess, Departmet of Electrcal Egeerg, Staford Uversty, Uted States of Amerca, [9] P. Barrett, Implemetatg the Rvest, Shamr ad Adlema publc-key ecrypto algorthm o stadard dgtal sgal processor, Proceedgs of CRYPTO'86, Lecture Notes Computer Scece 63:311-33, Sprger-Verlag, [1] V. Shdler, Hgh-speed RSA hardware based o low-power ppled logc, Ph. D. Thess, Isttut für Agewadte Iformato-sverarbetug ud Kommukatos-techologe, Techshe Uverstät Graz, Jauary [11] C. D. Walter, A verfcato of Brckell sfast modular multplcato algorthm, Iteratoal Joural of Computer Mathematcs, 33:153:169. [1] Z. Navab, VHDL - Aalyss ad Modellg of Dgtal Systems, McGraw Hll, Secod Edto, [13] MyCad, Ic. ad Seodu Logc, Ic., MyVHDL Stato V 4. Tutoral, or