1 Montgomery Modular Multiplication in Hard- ware

FEI KEMT
so a final operation required to convert the M-residue S back into S is defined as:
S = SR −1 mod M (1.13)
= 1SR −1 mod M
= MMM(1, S)
The algorithm works for any modulus M provided that gcd(M, R) = 1. This is
always case in the RSA since M = pq, product of two primes, and therefore odd.
And since R is a power of 2, it is always even.
The MMM algorithm for k-bit operands X = (xk−1, . . . , x1, x0), Y , and M is
given as Algorithm 1 – 2 [86].
Algorithm 1 – 2 The Montgomery modular multiplication algorithm for k-bit
operands X = (xk−1, . . . , x1, x0), Y , and M
Require: M = (mk−1 . . . m0)b, X = (xk−1 . . . x0)b, Y = (yk−1 . . . y0)b, with 0 ≥
X, Y < M, R = b n with gcd(M, b), and M ′ = −M −1 mod b.
Ensure: S = XY R −1 mod M.
1: S ⇐ 0 , S = (sk−1 . . . s0)b
2: for i = 0 to k − 1 do
3: qi ⇐ (s0 + xiy0)M ′ mod b
4: S ⇐ (S + xiY + qiM)/b
5: end for
6: if S ≥ M then
7: S ⇐ S − M
8: end if
9: return S
Thanks to the reduction during a pre-computation step of Algorithm 1 – 2 it is
possible to avoid an expensive operation of the modular division during the com-
putations. In case of a single multiplication operation the classical algorithm for
modular multiplication would be faster than the MMM. Due to a need of rather
expensive transformation to the Montgomery domain (M-residue) and back, it is
more effective to stay in that domain as long as possible and transform the operands
back to the ordinary only at the very end of the computations. That requires a long
sequence of the MMMs as it is in case of the modular exponentiation (Algorithm 1 –
1).
11