By: David Noble 3 rd year CS undergraduate. From VAbeach. courses completed: CS 101,201,202,216,290

Size: px

Start display at page:

Download "By: David Noble 3 rd year CS undergraduate. From VAbeach. courses completed: CS 101,201,202,216,290"

Felicity Curtis
5 years ago
Views:

1 Montgomery Multiplication Theory Lunch By: David Noble 3 rd year CS undergraduate courses completed: CS 101,201,202,216,290 From VAbeach

2 Overview Modular Multiplication Real Life Application Goal Montgomery Multiplication Implementation

3 Modular Multiplication Example: mod 37 =????? How would YOU solve this? If no one answers this, I am going to start calling on people... Stupid answers first would be much appreciated... The traditional way: =

4 Modular Multiplication Example: The better way: mod 37 =????? How would YOU solve this? If no one answers this, I am going to start calling on people... Stupid answers first would be much appreciated... Break it into three parts: 1) the main number: 19 2) the exponent: 21 == == ) the modulus: 37

5 Example Cont d: Next we continuously square the main number until we have values for all the exponents that are powers of 2: 21 = = 16, = 4, = = = 19 1 * 19 1 = 361 (mod 37) = = 19 2 * 19 2 = 28 * 28 = 784 = 7 (mod 37) 19 8 = 19 4 * 19 4 = 7 * 7 = 49 = 12 (mod 37) = 19 8 * 19 8 = 12 * 12 = 33 (mod 37) Now we multiply the results of the squarings together: = 19 1 * 19 4 * = 19 * 12 * 33 = 13 (mod 37) Final Result being 13

6 Example Cont d: There is no real way to get away without multiplying, but what was so expensive? 21 = = 16, = 4, = = = 19 1 * 19 1 = 361 (mod 37) = = 19 2 * 19 2 = 28 * 28 = 784 = 7 (mod 37) 19 8 = 19 4 * 19 4 = 7 * 7 = 49 = 12 (mod 37) = 19 8 * 19 8 = 12 * 12 = 33 (mod 37) Reducing mod 37 was an expensive task

7 Better Example

8 Real Life Application All crypto Many one way functions in cryptography are based on modular multiplication RSA, ElGamal, Paillier, encryption,signatures,protocols, etc. Important primitive to understand/optimize

9 Goal Modular multiplication without expensive divisions

10 Mod without Div Peter Montgomery proposed a solution in 1985 Requires initial investment (only pays off when many modmults are needed) Find r Calculate r 1 and n' M85

11 Key Idea We cannot avoid the MOD But perhaps we can use MOD for a simpler case (eg, MOD 10000, or MOD 2^x) Then we work to patch everything up KAK96

12 Prerequisites to Montgomery Multiplication Prerequisites: Montgomery Multiplication is performed with two given numbers: r and n constraints: r and n must be relatively prime r > n r is best served being equal to base k, for some value k r/base < n < r *r and n are relatively prime when base = 2 and n is odd Once given r and n, you must find (r 1 and n'). The best way to do that would be to use the Extended Euclidean Algorithm. ***In practical applications, the base is always 2 and k is 512, 1024, or 2048 KAK96

13 Extended Euclidean Algorithm Extended_Euclid(Bignum r, Bignum n); will solve for r 1 and n' in the formula (r 1 *r + n *n) = gcd(r, n) It can do so recursively or iteratively, for simplicity, here's the recursive version function extended_gcd(a, b) if a mod b = 0 return {0, 1} else {x, y} := extended_gcd(b, a mod b) return {y, x y*(a div b)} WIKI

14 Example: find r 1 and n' r = 10,000 = 10 4 n = 4763 euclid_extended(10000, 4763) (1035*10000) (2173*4763) = 1 Results: r = 10,000 r 1 = 1,035 n = 4,763 n' = 2,173 ***For simplicity we will be using base 10 for our examples from here on out...

15 Residues Montgomery Multiplication takes in the n residues of two separate variables, only to return the n residue of the product of the two. KAK96

16 Example for: a and b Example: a = 706 b = 4710 a = 706 * 10,000 (mod 4763) b = 4710 * 10,000 (mod 4763) a = 1234 b = 3456

17 The algorithm Function MonPro(a, b) Step 1. t: = a * b Step 2. u: = (t + (t * n' mod r) * n) / r Step 3. if u >= n then return u n else return u KAK96

18 Step 1. t = a * b Perform for i=0 to s 1 C := 0 for j=0 to s 1 (C,S) := t[i+j] + a[ i ] * b[ j ] + C t[i+j] := S t[i+s] := C

19 i = x t =

20 i = x t =

21 i = x t =

22 i = x t =

23 Step 2: u := (t + (t * n' mod r) * n) / r So... Let's split it up: Step 2a: t * n' Step 2b: (t * n') mod r Step 2c: (t * n' mod r) * n Step 2d: ((t * n' mod r) * n) + t Step 2e: (t + (t * n' mod r) * n) / r

24 Step 2a: t * n' x

25 Step 2b: (t * n') mod r %

26 Step 2c: (t * n' mod r) * n x

27 Step 2d: ((t * n' mod r) * n) + t

28 Step 2e: u = (t + (t * n' mod r) * n) / r /

29 Citations (M85) P. L. Montgomery, Modular Multiplication Without Trial Division MATHEMATICS OF COMPUTATION, v. 44 #170, 1985, pp (KAK96) C. K. Koc, T. Acar, and B. S. Kaliski Jr., Analyzing and Comparing Montgomery Multiplication Algorithms IEEE Micro, 16(3):26 33, June 1996 (WIKI) Extended Euclidean Algorithm

Numbers. Çetin Kaya Koç Winter / 18

Numbers. Çetin Kaya Koç Winter / 18 Çetin Kaya Koç http://koclab.cs.ucsb.edu Winter 2016 1 / 18 Number Systems and Sets We represent the set of integers as Z = {..., 3, 2, 1,0,1,2,3,...} We denote the set of positive integers modulo n as