1 Montgomery Modular Multiplication in Hard- ware

FEI KEMT
in shorter words taking into account the physical limitations of the structures in se-
lected hardware platform. Optimal solution in case when the operands length may
change would provide a design for which the length of operands determines only the
computational time for an operation but not the overall performance of the unit
that is constant for arbitrary length.
Montgomery Methods The MMM provides a very efficient way for computing
the modular exponentiation. Input operands for the baseline algebraic operations
of the RSA algorithm described by Equations 1.5-1.8 have very long length due
to security reasons. Nowadays, the key length for the RSA is switched from 1024
to 2048 bits as the factorisation effort brings better results, closer to the bottom
standard value. Having a need to use operands with doubled precision it is even more
desirable to find algorithms that minimise the number of the algebraic operations
together with their complexity.
The Montgomery reduction allows efficient implementation of the MM without
using the classical modular reduction step that is even more expensive operation in
comparison to the multiplication. Therefore it pays off to minimise the number of
required reductions or to use algorithms avoiding the division.
In Montgomery exponentiation algorithm (Algorithm 1 – 1 [86]) the modular ex-
ponentiation unrolls into series of the MMM. Thanks to the transformation to a
Montgomery domain and application of the MMM, it is possible to avoid the un-
wanted modular reduction during computations.
We continue with description of the MMM and conversion operations applied in
the Algorithm 1 – 1.
Given two integers X and Y (X, Y < M < R), and the prime k-bit modulus M,
the MMM algorithm computes
S = MMM(X, Y ) = (XY R −1 ) mod M , (1.9)
where R −1 is the inverse of R = b k and b denotes a base or radix. The M-residue
X, of an integer X < M is defined as [41]:
X = XR mod M (1.10)
For conversion to the Montgomery domain we can use the MMM function as follows:
MMM(X, R 2 ) = XR 2 R −1 mod M (1.11)
= XR mod M
= X
9