Fast Montgomery-like Square Root Computation over GF(2 m ) for All Trinomials

Transcription

1 Fast Montgoery-like Square Root Coputation over GF( ) for All Trinoials Yin Li a, Yu Zhang a, a Departent of Coputer Science and Technology, Xinyang Noral University, Henan, P.R.China Abstract This letter is concerned with an extension of square root coputation over GF( ) defined by irreducible trinoials. We introduce a new type of Montgoery-like square root forulae, which is ore efficient copared with classic square root operation. By choosing proper Montgoery factor regarding to different types of trinoials, the space and tie coplexities of our proposal outperfor or atch the best results. Furtherore, a practical application of the Montgoery-like square root in exponentiation coputation is also presented. Keywords: Finite field, Square root, Exponentiation, Cryptography 1. Introduction Arithetic in finite field GF( ) has any iportant practical applications such as public key cryptography and coding theory [1, ]. These applications usually require high efficient ipleentations of such arithetic operations, e.g., field addition, ultiplication, inversion and squaring. Particularly, square root operation has attracted any attentions during recent years as it has becoe an iportant building block in the design of soe elliptic curve priitives [4, 5]. In addition, since the square root is soewhat analogous to squaring, it has been applied in soe parallel ultiplicative inversion or exponentiation algoriths [6, 8], where both squaring and square root are utilizing as ain building blocks. Generally speaking, the efficiency of hardware ipleentation of field arithetic is evaluated by space and tie coplexity. The forer is expressed as the nuber of logic gates (XOR and AND) and the latter is expressed as the total gates delay of the circuit, denoted by T A and T X, respectively. Consider an irreducible polynoial f (x) over F. Then, a binary extension field can be defined as GF( ) F [x]/( f (x)). Let A be an arbitrary eleent in the field GF( ). The field square root coputation This work is supported by the Natural Science Foundation of China (No , ). Corresponding author Eail addresses: yunfeiyangli@gail.co (Yin Li), willow13@16.co (Yu Zhang ) of A, denoted as A or A 1/, is to find D GF( ) such that D = A. Note that square root operation is siply a circular operation under noral base (NB) representation. Hence, ost works for efficient square root coputation are based on polynoial representation (PB). Obviously, a straightforward approach for square root coputation is based on Ferat s Little Theore [3], which requires 1 squarings in all. Fong [7] proposed ore efficient algoriths by utilizing the pre-coputation value x 1/. However, this algorith requires one / bits field ultiplication by a precoputed constant x 1/, which is still an expensive operation. In [8], Rodríguez-Henríquez et al. proposed an alternative ethod using the inversion of the ultiplicative atrix, which is constructed for squaring operation. Their approach theoretically can be applied to any type of generating polynoials. When the generating polynoial f (x) is a trinoial, they derived the explicit forulae for square root coputation. It is shown that such square root operations can be ipleented with no ore logic gates than those associated with squaring of the sae field. Based upon this assertion, the authors [8] also proposed a parallel exponentiation that perfors squaring based and square root based exponentiation algoriths, siultaneously. Therefore, such an algorith could achieve twice ipleentation efficiency copared with classic squaring based exponentiation. Rodríguez-Henríquez et al. approach is efficient. N- evertheless, for certain type of irreducible trinoials, Preprint subitted to Elsevier August 10, 017

2 the circuit delay of the square root and squaring is d- ifferent. For exaple, if f (x) = x + x k + 1 with odd and even k, the squaring costs T X delay while square root costs 3T X. In this case, if these two operations are applied to perfor parallel exponentiation (inversion), the slower one will influence the perforance of the whole algorith. In this contribution, we consider a new type of square root operator by adding a specific Montgoery-like factor. Explicit forulae of such operations are presented when GF( ) is generated with an irreducible trinoial. As a result, it is shown that these forulae are quite siple and have saller space and tie coplexities in parallel ipleentation. Coincidentally, this type of Montgoery-like square root operator has the sae circuit delay copared with Montgoery squaring [9] that defined in the sae finite field. Therefore, we then describe an iproved parallel exponentiation algorith that using Montgoery squaring and Montgoery-like square root operation. The rest of this paper is organized as follows: in Section, we introduce the definition of the Montgoerylike square root and soe other notations. Then, explicit forulae for this type of square root operation are given in section. In addition, the space and tie coplexities are also evaluated. Section 3 describes a parallel exponentiation algorith based on Montgoery squaring and Montgoery-like square root operators. Finally, soe conclusions are drawn in Section 4.. Montgoery-like Square Root Let A = a ix i be an arbitrary eleent of GF( ) using PB representation. To copute the square root of A, we first partition A into two parts according to the degree parity of its interediate, i.e., where A = A even + xa odd, A even = ()/ a i x i, A odd = ( 3)/ a i+1 x i, ( is odd), A even = / 1 a i x i, A odd = / 1 a i+1 x i, ( is even). Therefore, the square root of A is given by A 1 = Aeven + x 1 Aodd. (1) It is obvious that the coputation of x 1/ is crucial to the square root coputation. Actually, the eleent x 1/ is a constant that can be pre-coputed. Thus, the square root operation can be ipleented as perforing a field ultiplication between A odd and x 1/ and then adding with A even [7]. However, this ethod requires a constant ultiplication, which is still an expensive operation. Inspired by Montgoery squaring operation, we ultiply the square root by a proper factor and introduce a Montgoery-like square root operation. Such a factor can help us siplify the calculation of x 1/ and avoid previous coplex operation, which can accelerate the ipleentation of the Montgoery-like square root operation. We first give the definition of this new type of square root operation. Definition 1. Let A be an arbitrary eleent and ω be a fixed eleent of GF( ), respectively. Then the Montgoery-like square root of A is defined as A 1/ ω, while ω is naed as the Montgoery-like factor. Let D be the result of A 1/ ω. When GF( ) is defined by an irreducible trinoial f (x) = x + x k + 1, we investigate the choice of ω and the explicit forulae with respect to D. Note that here x = x + x k and x 1 = x + x k. It follows that the optial ω relies on the coputation of x 1/, which varies according to the parities of and k. Thus, four cases are considered: Case 1: even, k odd. In this case, we know that, but k. Let n = /, then we have x 1 = x n x 1 + x k+1 x k+1 = (1 + x n ) x 1, x 1 = (1 + x n ) x k 1 Plug the above expression to (1), one can check that A 1 = Aeven + x 1 Aodd = A even + (A odd + A odd x n ) x k 1. Note that A odd consists of n ters, thus, there is no overlap between A odd and A odd x n. Let ω be x (k 1)/, the Montgoery-like square root of this case is A 1 ω = A 1 x k 1 = A even x k 1 + (A odd + A odd x n ). Since the degree of A even and A odd are n 1, deg(a even x (k 1)/ ) = n 1 + (k 1)/ n + ( 1)/ = and deg(a odd + A odd x n ) = n+n 1 =. Therefore, no further reduction is needed in above expression. At this tie, D = d ix i = A 1/ x (k 1)/. Then, a i+1, 0 i k 3, k 1 a i k+1 + a i+1, i n 1, a i k+1 + a i+1, n i n 1 + k 1, () a i+1, n + k 1 i 1,.

3 where 0 < k 1. In addition, if k = 1, () can be siplified further: { ai+1, 0 i n 1, (3) a i + a i+1, n i 1 Case : even, k = / odd. This case is actually a special case of Case 1. It is easy to check that x 1/ = (1 + x k ) x (k 1)/. Also notice that = k and x = x k +1. Hence, the preceding expression can be rewritten as x 1/ = x k (k 1)/. So, A 1 k+1 = k+ Aeven + A odd x. Notice that there are at ost (k+1)/ ters of which degrees are out of the range [0, 1] and the reduction is relatively siple. Thus, let ω = 1 and D = d ix i = A 1/, we have a i + a i+k, 0 i k 1, k+1 a i, i k 1 a (i+k) od, k i 1. (4) This forula siply coincides with the result presented in [8]. Case 3: both and k are odd. Let n = +1, then x 1 = x n + x k+1. One can check that the above forula is very easy and the corresponding square root coputation needs no ω to siplify its coputation. Analogous with Case, let ω = 1 and D = d ix i = A 1, then a i, 0 i k 1, k+1 a i + a i k, i, a i k, k i 1. Case 4: odd, k even. Let n =, then x 1 = x n+1 + x k x 1 x n+1 = (1 + x k ) x 1, x 1 = (1 + x k ) x (n+1), x 1 = (1 + x k ) x n. Plug the above expression to (1), then A 1 = A even + x 1 A odd = A even + (A odd + A odd x k ) x n Let ω be x n, then the Montgoery-like square root is A 1 ω = A 1 x n = A even x n + A odd + A odd x k. (5) 3 Please note that A odd consists of n ters and A even consists of n + 1 ters. Thus, A even x n and A odd are nonoverlapping with each other. Also notice that deg A odd = n 1, deg A even = n and k <, so deg A odd x k = n 1 + k/ n + ()/ = 1, deg A even x n = n = 1. Therefore, no further reduction is required by A 1/ x n. Let D = d ix i = A 1 x n, then a i+1, 0 i k 1, k a i+1 + a i+1 k, i n 1, a i+1 k + a i +1, n i n + k 1, (6) a i +1, n + k i 1. where 0 < k < 1. If k = 1, then a i+1, 0 i n 1, a i +1 + a i +, n i, a i +1, i = 1. According to expression () to (7), we suarize the space and tie coplexities of the Montgoery-like square root in Table 1. As a coparison, the space and tie coplexities of ordinary square root operation [8] are also given. Specially, we also give the coplexities for Montgoery squaring A x k od x + x k + 1 for 1 k /, which had been investigated in [9]. It is clear that, by choosing proper factor ω, the Montgoery-like square root costs at ost / (or ( 1)/) XOR gates with only 1 T X gate delay, which outperfors or atches the best square root coputation algoriths [8]. Moreover, the proposed new type of square root coincidentally has the identical circuit delay copared with Montgoery squaring, while their space coplexities are alost the sae. Exaple: Consider a finite field GF( 9 ) defined by x 9 + x According to previous description, x 9 + x satisfies case 4, we have ω = x (9 1)/ = x 4. Given an arbitrary eleent A = 8 a ix i, the Montgoery-like square root of A is A 1/ x 4 = 8 d ix i, where d 0 = a 1, d 3 = a 7 + a 3, d 6 = a 4, d 1 = a 3, d 4 = a 0 + a 5, d 7 = a 6, d = a 5 + a 1, d 5 = a + a 7, d 8 = a 8. (7) The coputation of above coefficients d i requires 4 X- OR gates and T X in parallel. 3. Exponentiation based on Montgoery squaring and square root In [8], the authors proposed a parallel exponentiation algorith over GF( ). Their algorith coprises two sub-exponentiations that based on squaring and square

4 Table 1: Space and tie coplexities for different square root operations and squaring operations Montgoery square root Ordinary[8] Montgoery squaring [9] Squaring [8] Cases ω #XOR Delay #XOR Delay #XOR Delay #XOR Delay 1. even, k odd x k 1 T X T X T X T X. even, k = odd T X 4 T X T X 4 T X 3., k odd 1 T X T X T X T X 4. odd, k even x T X 3T X T X T X root operation, respectively. For square root based exponentiation, it ainly utilized the equation A i = A i, i = 1,,, 1, where A GF( ) is an arbitrary nonzero eleent. The above equation can be easily proved using Ferat Little Theore [3]. Let e = (e,, e 1, e 0 ) be a -bit nonzero integer. By substituting half the squaring operations with square root operations, the exponentiation A e can be written as A e = e i = Ai i=n = e i i=n n 1 e i A ( i). Ai Ai e i n 1 Ai e i where 0 < n <. In [8], the paraeter n is chosen as. One can check that the two sub-exponentiations p- resented in above expression can be perfored siultaneously, thus, the whole algorith achieved better perforance copared with the classic one. As shown in Table 1, we note that the Montgoery-like square root operator and Montgoery squaring are usually faster than ordinary square root and squaring operations. Algorith 1 describes an iproved exponentiation algorith for A e, which utilized Montgoery squaring and square root operator. Algorith 1 Exponentiation based on Montgoery squaring and Montgoery-like Square root Input: A GF( ), f (x), e = (e, e,, e 1, e 0 ) Output: B = A e od f (x) 1: B = C = 1; : e = 0; 3: n = ; 4: for i = n 1 down to 0 do for j = n to do 5: B = B x k ; C = C 1 ω; 6: if e i == 1 then if e j == 1 then 7: B = B A od f (x); C = C A od f (x); 8: end if end if 9: end for end for 10: B = B C; 11: B = B ω ; 1: return B; 4 Description: The two procedures presented in steps 4-9 are running in parallel. Also notice that the choice of n in step 3 is slightly different fro [8], as we found that this selection can ake the nuber of squaring and square root alost equal, which can save the whole algorith delay. Since we utilize the Montgoery squaring and Montgoery-like square root operator instead of the original ones, ω in step 11 is a copensatory paraeter that used to correct the final exponentiation. The for of ω is given in following proposition. Proposition 1. The copensatory paraeter ω in Algorith 1 can be obtained as ω = ω n (x k ) n 1. (8) Proof. According to steps 4-7 of Algorith 1, it totally perfor n + 1 Montgoery-like square root operations and n Montgoery squarings. Each tie we execute the body in the loops, there are one x k (for squaring) and one ω (for square root) ultiplying the results. In the end, it follows that the extra paraeter is ω ω 1 ω 1 4 ω 1 n x k (x k ) (x k ) n 1 = ω ( n) (x k ) n 1 = (ω) n (x k ) 1 n = ω n (x k ) 1 n (9) Since ω is the copensatory paraeter that used to correct the final result, then we know that (9) is equal to the inversion of ω. Then, the result is direct. According to proposition, the explicit forula of ω depends on the for of ω. For exaple, when, k satisfy the condition of case 1, we have ω = x (k 1)/ and n = /. Plug these forulae into expression (8), we have ω = x (k 1)(n 1 1)+k( n 1). The explicit forulae for ω of other cases are suarized in Table. Furtherore, the constant ultiplication B ω can be perfored using Mastrovito approach. Since ω is constant, the corresponding product atrix is fixed, no AND gate is needed. Only certain XOR gates are required by corresponding atrix-vector ultiplication,

5 Cases Table : Explicit forulae of ω ω 1. even, k odd x (k 1)(n 1 1)+k( n 1). even, k = odd xk(n 1) 3., k odd x k(n 1) 4. odd, k even x ()(n 1 1)+k( n 1) which leads to no ore than XOR gates with at ost log XOR gate delay. Then we give a coparative analysis between the o- riginal exponentiation algorith [8] and ours. On the one hand, both their algorith and ours cost W(e) ultiplications, n + 1 square root and n squaring operations (classic or Montgoery), where W( ) is the Haing weight of the binary representation of e. In addition, our algorith requires one ore extra constant ultiplication. Assue that the nuber of bit operations for a ultiplication and a constant ultiplication are 1 and 1, respectively. We copare the bit operations of the two algoriths in the following table. As shown in the table, our algorith roughly Table 3: The bit operations for different exponentiation Algoriths Bit operations [8] ( 1) W(e) + O( /) This paper ( 1) W(e) + O(3 /) costs ore bit-operations than that in [8]. In fact, we have checked the space coplexity of B ω in GF( ) defined by all the trinoials of degree [100, 103] with cryptographic interests. It is argued that B ω only costs less than / XOR gates in roughly two thirds of such finite fields. In this case, our algorith only costs about / ore bit-operations. On the other hand, according to Table 1, it is clear that the gate delays for the ordinary squaring and square root are identical only when, k satisfy case. Note that the circuit delay for parallel ipleentation of ordinary squaring and square root is in fact equal to that of the slower operation. Thus, in other cases, it requires at least T X. Conversely, our algorith can save at least one T X for each squaring (square root) coputation in the loop. Note that the constant ultiplication presented in step 11 requires at ost log extra XOR gate delays. We finally save at least ( log )T X circuit delay except case. In case, the algorith in [8] is preferred to ours, as it has saller space and tie coplexities. Notwithstanding, in other cases, our algorith takes slightly ore space but less tie. 4. Conclusion In this paper, we have proposed a new type of Montgoery-like square root operation. By choosing a proper Montgoery factor, the proposed schee has only one T X delay and its space coplexity is at least as good as the best result. As an iportant application, we show that this type of square root cobined with Montgoery squaring can speed up parallel exponentiation algorith that based on ordinary squaring and square root. References [1] R. Lidl and H. Niederreiter, Introduction to finite fields and their applications. Cabridge University Press, New York, NY, USA, [] R. Lidl and H. Niederreiter, Finite Fields, Cabridge University Press, New York, NY, USA, [3] J.V.Z. Gathen and J. Gerhard, Modern Coputer Algebra (3rd ed.). Cabridge University Press, New York, NY, USA, 013. [4] D. Hankerson, A. Menezes and S. Vanstone, Guide to Elliptic Cryptography, Springer-Verlag, 004. [5] R. Schroeppel, C. Beaver, R. Gonzales, R. Miller and T. Draelos, A Low-Power Design for an Elliptic Curve Digital Signature Chip, Proc. Fourth Int l Workshop Cryptographic Hardware and Ebedded Systes, 00, pp [6] F. Rodríguez-Henríquez, G. Morales-Luna, N. Saqib,and N. CruzCortés, Parallel Itoh-Tsujii Multiplicative Inversion Algorith for a Special Class of Trinoials, Reconfigurable Coputing: Architectures, Tools and Applications, LNCS 4419, 007, pp [7] K. Fong, D. Hankerson, J. López, and A. Menezes, Field Inversion and Point Halving Revisited, IEEE Trans. Coputers, 004, 53, (8), pp [8] F. Rodríguez-Henríquez, G. Morales-Luna and J. Lópz, Low- Coplexity Bit-Parallel Square Root Coputation over GF( ) for All Trinoials, IEEE Transactions on Coputers, 008, 57, (4), pp [9] H. Wu, Montgoery ultiplier and squarer for a class of finite fields, IEEE Transactions on Coputers, 00, 51, (5), pp [10] Recoended Elliptic Curves for Federal Governent Use, special publication, Nat l Inst. Standards and Technology, csrc.nist.gov/csrc/fedstandards.htl, July The constant ultiplication needs no AND gates for bitwise ultiplication, as the product atrix is fixed. 5