Design and Implementation of Fast Multiplication Algorithms in Public Key Cryptosystems for Smart Cards

Transcription

1 Design nd Implementtion of Fst Multipliction lgorithms in Public Key Cryptosystems for Smrt Crds G. Joseph nd W.T. Penzhorn bstrct Most prcticl public-ey cryptosystems re bsed on modulr exponentition. modulr exponentition is composed of repeted modulr multiplictions. Severl methods hve been proposed to reduce the execution time of modulr exponentition, essentilly iming to reduce the execution time of ech modulr multipliction. The gol of this pper is to investigte three different integer multipliction techniques, s used in conjunction with vrious public-ey cryptogrphic lgorithms s used stndrd smrt crd. The im is to obtin exct numericl results for stndrd multipliction lgorithms used in industry. Keywords Public-ey cryptosystems, Montgomery multipliction, rrett reduction, Clssicl multipliction Obtin s public ey (e,n) Represent messge m in intervl [0,n-] c = m e mod n I. INTRODUCTION The need for security in e-commerce hs led to the study of public ey cryptogrphy. Since 976, numerous public-ey cryptosystems hve been proposed, mostly bsed on modulr exponentition. The most well-nown public-ey cryptosystems in use tody re bsed on the difficulty of fctorizing lrge integers (RS lgorithm []) nd on the difficulty of computing discrete logrithms (Diffie-Hellmn ey exchnge [], ElGml [3], Digitl Signture Stndrd(DSS) [4]). In this pper we will introduce three different lgorithms for the modulr multipliction of lrge integers. The simplest lgorithm for modulr multipliction is utilizing norml integer multipliction, s well s some method for performing modulr reduction [5]. rrett introduced one of the first methods to perform modulr multipliction without modulr division [6]. It involves pre-computtion step for the reduction step before ctully implementing the multipliction. Montgomery proposed n lterntive method in 985, which llows efficient implementtion of modulr multipliction without explicitly performing the reduction step [7]. These three pproches will be discussed in detil in Section III. II. OVERVIEW OF PULIC-KEY CRYPTOSYSTEMS. The RS lgorithm The RS cryptosystem, nmed fter its inventors R. Rivest,. Shmir, nd L. dlemn, is the most widely used publicey cryptosystem []. It cn provide both encryption, decryption nd digitl signtures. Of ll the public-ey lgorithms proposed over the yers, RS is by fr the esiest to understnd nd implement. The security of the RS cryptosystem depends on the problem of fctoring lrge integers. The RS lgorithm opertes s follows: Two eys p nd q re generted nd the modulus n = pq is computed. The encryption ey e is chosen such tht gcd(e, (p )(q )) =. The decryption ey d is computed such tht ed (mod(p )(q )). The public ey is (e, n) nd the privte ey is (d). To encrypt messge m, compute c i = m d i mod (n). Decryption is done s follows:m i = c d i mod (n). Send ciphertext c Use s privte ey (d,n) Decipher c into messge m m = c d mod n Fig.. The RS encryption nd decryption lgorithms. The Diffie-Hellmn Key Exchnge Diffie-Hellmn ws developed in 976, nd its security is bsed on the difficulty of clculting discrete logrithms in finite field. The Diffie-Hellmn lgorithm is used in ey distribution protocols. The bsic version provides pssive protection, but my be prone to interception or modifiction (mn-in-the-middle ttcs). However Diffie-Hellmn cn be extended, in order to prevent mn-in-the-middle ttcs [8,9]. The objective of the lgorithm is tht two prties nd re enbled to derive common secret ey () over n open, insecure chnnel, s shown in Fig. II-. C. The ElGml lgorithm This lgorithm is n extension of the bsic Diffie-Hellmn lgorithm, nd lso depends on the difficulty of computing discrete logrithms over finite fields. The ElGml scheme cn be used for encryption, decryption nd digitl signtures. Pretty good privcy (PGP), the well-nown worhorse for encrypting nd signing e-mil messges nd documents, uses the ElGml procedure for its ey mngement. The ey genertion requires ech entity needs to crete public ey nd corresponding privte ey. In order to crete the eys, lrge rndom prime p nd genertor α of the multiplictive group Z p in modulo p is generted. Then select rndom integer, < < p, nd compute α mod p. Entity s public ey is (p, α, α ) nd the privte ey is ().

2 Use s privte ey (d,n) to sign messge m c = m d mod n Send ciphertext c & m Use s public ey (e,n) to verify c m'= c e mod n Messge m with privte ey d Hsh function H(n) : {0,} for q r = ( g mod p) mod q s = ( H( n) + dr) mod q Send ( r, s, n) Verify tht 0 < r, s < q Using s public ey e from for verifiction using Hsh function H w = s mod q u = ( H ( n). w)mod q u = r. wmod q u u v = ( g e mod p) mod q Verify tht v = r ccept if m = m Fig. 4. DSS signing nd verifiction Fig.. The Diffie-Hellmn ey exchnge Obtin s public-ey: ( α, α ) Represent messge m Select in [,n-] Compute: c = α mod p K = ( α ) mod p c = Km mod p Send c ciphertext, c ) ( Using s privte ey to compute: K = ( c ) mod p c m = mod p K Fig. 3. The ElGml encryption nd decryption lgorithms D. The Digitl Signture Stndrd (DSS) The U.S. Ntionl Institute of Stndrds nd Technology (NIST), hs proposed n lgorithm for digitl signtures. The lgorithm is nown s DS, Digitl Signture lgorithm. s proposed stndrd it is now nown s the Digitl Signture Stndrd (DSS). The DS lgorithm is due to Krvitz [0] nd ws proposed s Federl Informtion Processing Stndrd in ugust 99 by NIST. It becme the Digitl Signture Stndrd (DSS) in My 994, s specified in FIPS 86 [4]. DSS uses the ElGml lgorithm s its bsis. For the genertion of DS primes p nd q in the lgorithm below, it is required to select the prime q first, nd then try to find prime p such tht q divides (p ). Ech prty cretes public ey nd corresponding privte ey. III. MODULR MULTIPLICTION TECHNIQUES In recent yers, considerble endevours were invested in the design of efficient modulr multipliction lgorithms. Modulr exponentition is composed of sequence of modulr multipliction opertions. Modulr multipliction is more involved thn -bit multipliction, requiring both -bit multipliction nd method to perform modulr reduction. In this pper we re looing t the complexity of the following opertion: b = x mod m. Reducution of the time nd memory complexity of the opertion x mod m, gretly influences the prcticl fesibility of cryptosystem s signture nd encryption scheme.. Clssicl Modulr Multipliction Modulr multipliction relies on both -bit multipliction nd method of modulr reduction. The esiest wy to perform modulr reduction is to compute the reminder r by division with the modulus m, using the division lgorithm. This combintion will be referred to s the clssicl lgorithm for performing modulr multipliction. Prmeter definition: Given w = (w n...w w 0 ) b nd m = (m t...m m 0 ) b with n t, m t 0. When w is divided by m we obtin the quotient q nd the reminder r = (r t...r r 0 ) b. The division step follows the eqution w = qm + r, 0 r < m.. rrett Modulr Multipliction rrett [6] introduced the ide of estimting the quotient xdivm with opertions tht either re less expensive in time thn division by m, or cn be done s preclcultion for given m. The rrett reduction computes r = x mod m given x nd m. The lgorithm requires the precomputtion of the quntity γ = [b /m], it is dvntgeous if mny reductions re performed with single modulus. The precomputtion tes fixed mount of wor, which is negligible in comprison to modulr exponentition cost. Prmeter definition: Two positive integers nd b produces x = (x...x x 0 ) b nd m = (m...m m 0 ) b, with m 0 nd γ = [b /m]). The output will be the reminder r = x mod m.

3 . Compute w = x.y (using multiple-precision multipliction).. Compute the reminder r when w is divided by m. m, R = b n nd gcd(m, b) =. To obtin xyr m = m mod b is computed. () While (w mb n t ) do w mb n t w.. 0. Nottion: = ( n... 0 ) b (b) For i from n down-to (t + ) do the following:. For i from 0 to (n ) do: i. If w i = m t then set b q; else set q (w i b + w i )/m t. () u i ( 0 + x i y 0 ) m mod b. ii. While (q(m t b + m t ) > w i b + w i b + w i ) (b) ( + x i y + u i m)/b. do: q q. iii. w qmb i t 3. If m then m. w. iv. If w < 0 then 4. Return(). set w + mb i t w nd q q. (c) w r. Fig. 7. Montgomery modulr multipliction up slightly 3. Return(r). by normlizing m, such tht m [ References b ]. This wy l + single-precision multiplictions cn be trnsformed into s mny dditions. [] P.L. IV. Montgomery, Modulr multipliction without tril division, Mthem EXPERIMENTL RESULTS Fig. 5. Clssicl modulr multipliction vol. 44, pp. 59 5, 985. References. comprison of the multipliction lgorithms [] K. Hensel, Theorie der lgebrischen Zhlen, Leipzig, 908. []. D.E. Compute Knuth, x = The.b rt (Using of Computer -bit multipliction) In this section we present experimentl results of the performnce[3] of M. theshnd, vrious J. Vuillemin, multipliction Fst lgorithms. implementtionthe of RS per- cryptogrphy, P Progrmming - Seminumericl lgorithms, vol.. Msschusetts: ddision-wesley, ed., 98.. Compute reminder r using rrett reduction formnce of the IEEElgorithm Symposiumison ttributed Computertorthimetic, the multiplictions pp. 5 59, 993. [] C.K. Koc, High-speed RS implementtion, Version.0, RS Lbortories, November 994. () q [x/b ], q q, q3 [q /b + nd divisions ]. [4]. required osselers, to reduce R. Goverts, n -bit J. Vndewlle, integer. Comprison The reson of three modulr for these investigtions [3]. (b) osselers, x mod br. + Goverts, r, qj. 3.mVndewlle, mod b + Comprison r, r r of three r. modulr reductions, dvnces Cryptology is-tht Crypto the 93 multipliction (LNCS 773), pp. nd75 86, division994. in Cryptology - Crypto 93 (LNCS 773), pp , 994. re the most time consuming opertions in the inner loop of (c) If r < 0 then r + b + r. [5] S.R. Dusse,.S. Klisi JR., cryptogrphic librry for the Motorol D ll three lgorithms. [4] N. (d) Koblitz, While rcourse m do: in rnumber m Theory r. nd Cryptogrphy. Grdute Texts in Mthemtics in Cryptology - EUROCRYPT 90 (LNCS 473), pp , 99. Springer-Verlg, 987. In Tble I[6] wec. show Koc, the T. cr, theoreticl.s. Klisi, number nlyzing of multiplictions nd compring Montgomer 3. Return r = x mod m. [5] P. rrett, Implementing the Rivest Shmir dlemn public-ey encryption nd divisions lgorithm, rithms, required IEEE for Micro, the reduction no. 6, pp. 6 33, opertion 996. only i.e. they do not include the multiplictions nd divisions of the Fig. 6. rrett modulr multipliction [7] D. Nccche, D.M. Rihi, D. Rpheli, Cn Montgomery prsites b 3 preclcultion, References methodology ny trnsformtion bsed on ey ornd postclcultion cryptosystem modifictions, [5]. The Designs, Co results refersno. to the 5, pp. reduction 73 80, 995. of -digit number with - [] C. P. Montgomery rrett, Implementing Modulr the Multipliction Rivest Shmir dlemn public-ey encryption digit modulus lgorithm, m. [8] C.D. Wlter, S.E. Elridge, Hrdwre implementtion of Montgomery m [] The. osselers, third pproch R. Goverts, to modulr J. Vndewlle, multipliction Comprisonws of three sug-modulgested in Cryptology by Montgomery - Crypto 93 [7].(LNCS Montgomery 773), pp , reduction994. is techrithms, corresponding [9] S.E. Elridge, to the C.D. theoreticl Wlter, Montgomery s results in Tble lgorithm I. Thefor fst modulr In Tble reductions, II we lgorithm, present dvnces the IEEE simultion Trns. Comp., results vol. for 4, the pp. three , lgo nique which does efficient implementtion of modulr multipliction without explicitly crrying out the clssicl mod- C, utilizing some of the functions of the MIRCL librry. three multipliction Trns. Comp., lgorithms to pper. were implemented in NSI ulr reduction step. Montgomery multipliction combines [0] J.C. jrd, L.S. Didier, P. Komerup, n RNS Montgomery modulr mu These results were obtined on 550MHz Pentium III bsed IEEE Trnsction on Computers, pp , July 998. Montgomery reduction nd multiple-precision multipliction PC using the 3-bit orlnd C pltform. ll times re to compute the Montgomery reduction of the product of two given in [] microseconds, T. lum, C.Pr, unless Montgomery otherwise modulr stted. exponentition on reconfigurble integers. It is generliztion of much older technique due Symposium on Computer rithmetic, pp , 999. to Hensel []. TLE I COMPLEXITY [] P. OF ehrooz, MULTIPLICTION Computer LGORITHMS rithmetic lgorithms IN REDUCING nd hrdwre designs. O Inc., 000. Montgomery reduction cn be described s follows: Let m be -DIGIT NUMER [5] positive integer, nd R nd T re integers (such tht R > m, [3] R.L. Rivest,. Shmir, L. dlemn, method for obtining digitl sig lgorithm gcd(m, R) =, 0 T < mr). method is described for cryptosystems, CCM, Clssicl vol., rrett pp. 0 6, Montgomery 978. computing T R Multiplictions ( +.5) ( + 4) ( + ) mod m without using the clssicl method. T R Divisions 0 mod m is clled Montgomery reduction of T modulo m with respect to R. In other words, the m-residue of T /m m 0 mod b 4 0 Preclcultions Normliztion b rgument trnsformtion None None m-residue with respect to R. With suitble choice of R, Montgomery Postclcultions Unnormliztion None Reduction reduction cn be efficiently computed. Restrictions None x < b x < mb Mthemticlly, Montgomery s reduction cn be stted s follows: Given integers m nd R let m = m mod R. If gcd(m, R) =, then for ll integers T (where 0 T < mr),. Comprison of the Public-Key Cryptosystems U = T m mod R is integer stisfying: In this section we present simultion results for the four T + Um R T R (modm) () Prmeter definition: Integers m = (m n...m m 0 ) b, x = (x n...x x 0 ) b, y = (y n...y y 0 ) b stisfying 0 x, y < public-ey cryptosystems. These public-ey cryptosystem provide differing environments for the evlution of the three MIRCL is portble C librry which implements multi-precision integer nd rtionl dt-types, nd provides routines to perform bsic rithmetic on them

4 TLE II EXECUTION TIMES FOR REDUCTIONS OF -DIGIT NUMER m Clssicl (µs) rrett (µs) Montgomery (µs) multipliction lgorithms. For the exponentition process, ech cryptosystem requires the repetition of modulr multiplictions. Tble III implements left-to-right binry exponentition [] for its modulr exponentition nd Montgomery multipliction for the modulr multipliction. The implementtion ws written with the id of the MIR- CL librry. The cryptosystems were optimized for speed not security in order to test time required per multipliction / exponentition cycle with precomputtion. precomputtion in n lgorithm is the computtion of required prmeters before the lgorithm is executed. postclcultion is the performing function on the result fter the lgorithm hs been executed. TLE III EXECUTION TIMES FOR PULIC-KEY CRYPTOSYSTEMS OF -DIGIT NUMER The RS lgorithm Decryption Encryption e = 3 Encryption e = The Diffie-Hellmn ey exchnge m No precomputtion With precomputtion) The ElGml lgorithm Encryption Decryption Decryption m With precomp. With precomp. No precomp The Digitl Signture Stndrd m Signing Signing Verifiction m No precomp. With precomp. No precomp V. DISCUSSION Tble I indictes tht, if only the reduction opertion is considered (i.e. without the preclcultions, rgument trnsformtions nd postclcultions) Montgomery s lgorithm is clerly fster thn rrett s nd the clssicl lgorithm. rrett s lgorithm is only slightly fster thn the clssicl lgorithm, nd these observtions re confirmed by the simultion results given in Tble II. If the precomputtion nd post-clcultion nd the m-residue trnsformtion re compensted by fster modulr reduction n opertion using rrett s or Montgomery s modulr reduction methods will only be fster thn the corresponding opertion using the clssicl modulr reduction if the pre- nd post-clcultions nd the m-residue trnsformtion only for Montgomery re compensted by fster modulr reductions (i.e. modulr exponentition). From Tble III it follows tht the ElGml lgorithm s execution time for decryption (with nd without precomputtion) is pproximtely the sme s creting DSS signture. This cn explined due to the sme mount of multiplictions nd exponentitions required by both lgorithms. similr ind of explntion pplies to DSS signture verifiction nd El- Gml encryption. In terms of processing speed, RS encryption for smll nd fixed exponents is preferred to ElGml encryption. However, RS decryption is much slower thn encryption. The decryption time cn be improved utilizing the Chinese reminder theorem s described in [3]. Precomputtion reduces the execution time s shown in Tble III. n integrtion of multipliction techniques in its public-ey cryptosystem environment will give comprehensive comprison of multipliction lgorithms utilizing 8-bit processor (i.e. smrt crd). The results require n integrtion of the public-ey cryptosystem with its multipliction counterprts. Further reserch will emphsis to obtin detiled comprison between stndrd multipliction lgorithms used in industry cryptosystems. VI. CONCLUSION bsic opertion in modern public ey cryptosystems is the modulr multipliction of lrge integers. Since the initil multiple-precision multipliction is common, the difference comes in the reduction step. n efficient implementtion of this opertion is the ey to high performnce. Three well nown multipliction lgorithms re investigted, implemented nd evluted with respect to their softwre performnce. Four public-ey glorithms implemented nd compred. It ws shown tht they ll hve their specific behvior resulting in specific field of ppliction (i.e. public-ey cryptosystem). theoreticl nd prcticl comprison hs been mde of three lgorithms for the multipliction of lrge numbers. It hs been shown tht from the softwre implementtion the three lgorithms, Montgomery is the fstest between the three for -bit modulus. However good implementtion will leve minor differences in performnce between the three lgorithms. REFERENCES [] R.L. Rivest,. Shmir, L. dlemn, method for obtining digitl signtures nd public-ey cryptosystems, CCM, vol., pp. 0 6, 978. [] W. Diffie, M.E. Hellmn, New directions in cryptogrphy, IEEE Trnsctions on Computers, vol. IT-, pp , June 976. [3] T. ElGml, public-ey cryptosystem nd signture scheme bsed on discrete logrithms, IEEE Trnsctions on Informtion Theory, vol. IT-3, no. 4, pp , 985.

5 [4] FIS 86 Federl Informtion Processing Stndrds Publiction 86, Digitl Signture Stndrd, U.S. Deprtment of Commerce/N.I.S.T., Ntionl Technicl Informtion Service, 994. [5]. osselers, R. Goverts, J. Vndewlle, Comprison of three modulr reductions, dvnces in Cryptology - Crypto 93 (LNCS 773), pp , 994. [6] P. rrett, Implementing the Rivest Shmir dlemn public-ey encryption lgorithm, [7] P.L. Montgomery, Modulr multipliction without tril division, Mthemtics of Computtion, vol. 44, pp. 59 5, 985. [8] E. Hughes, n encrypted ey trnsmission protocol, CRYPTO 94, ugust 994. [9] W. Diffie, P.C. vn Oorschot, M.J. Wiener, uthentiction nd uthenticted ey exchnges, Designs, Codes nd Cryptogrphy, vol., pp. 07 5, 99. [0] D.W. Krvitz, Digitl Signture lgorithm, U.S. Ptent no. 5, 3, 668, July 993. [] K. Hensel, Theorie der lgebrischen Zhlen, Leipzig, 908. []. Menezes, P. vn Oorschot, S. Vnstone, Hndboo of pplied Cryptogrphy. CRC Press, first edition ed., 997. [3] J.J. Quisquter, C.Couvreur, Fst decipherment lgorithm for RS public-ey cryptosystem, Electronics Letters, pp , October 98. George Joseph holds.eng(00) degree from the University of Pretori with speciliztion in networ security nd publicey cryptogrphy. He is currently busy with M.Eng degree t the University of Pretori, looing into methods to improve performnce of public-ey cryptosystems used for smrt crds. He is n employee of Telom S Ltd. since 00. Wlter Penzhorn holds degrees from University of Pretori nd University of London. fter woring for the CSIR for 7 yers, he joined the Deprtment of Electricl, Electronic nd Computer Engineering t the University of Pretori in 990 s ssocite Professor. Since 999 he is the director of Telom s Centre of Excellence in Teletrffic t the Universtiy of Pretori. He is senior member of the IEEE, nd member of the SIEE nd ECS. He hs more thn 5 yers of experience in the design nd nlysis of cryptosystems.