1 Montgomery Modular Multiplication in Hard- ware

FEI KEMT
In the Algorithm 1 – 1 the input operand X is transformed to the Montgomery
domain X at the beginning (Step 1). Afterwards follows the series of the MMM in
the Montgomery domain. Finally, in the last step (Step 9) the result is transformed
back to normal domain. In this way the advantage of computing in Montgomery
domain is fully exploited. The MMM is considered as the most effective method for
modular exponentiation operations applied e.g. in the RSA cryptographic algorithm.
1.2.2 Hardware Implementations of the MMM
Achieving short computation time of the MM as the most time-consuming opera-
tion in RSA and ECC algorithms has a significant impact on the performance of
the elementary cryptographic operations. Therefore efficient implementation of the
algorithm has been an attractive field for research. Due to long operands on which
the operations are performed the hardware platform seems to be a natural choice
before software implementation. Since the size of operands may change according
to requirements and is different for RSA and ECC, the parameterized design in
programmable logic would offer an universal design for fast prototyping.
The implementations bring in life specifically adjusted general algorithms that
take into account the hardware platforms features and prefer operations easily im-
plementable in digital logic gates. The designs in general tend towards providing
an universal and elastic solution or have a priority in best usage of resources and
achievement of shortest computation times.
One of the most cited hardware implementation of the MMM was introduced at
CHES 1999 by Tenca and Koç [108]. A cheap and flexible modular exponentiation
hardware accelerator can be also achieved using FPGAs. Results presented in liter-
ature, e.g. [29, 41, 51] are mainly concentrated to systolic-like implementations that
provide a very fast but less flexible solution.
Pre-computing partial results as presented in [72] allows to reduce the number
of clock cycles required for performing of a single MMM operation. Such approach
needs marginally more area in comparison to original proposal [108] and as far as the
latency is concerned it is comparable to the design presented in [85] that is based on
processing multi-precision operands in carry-save form. High-radix implementations
[110] also provide reduction of computational steps, but the complexity of logic part
increases substantially.
Current FPGAs provide an alternative hardware platform even for system-level
integration of a cryptographic hardware. A SOC concept can typically include an
12