1 Montgomery Modular Multiplication in Hard- ware

FEI KEMT
by the radix b changes to a check of the LSB. In the Step 4 the division is replaced
by a simple right shift operation.
The formulation that describes the radix-2 algorithm was used as the starting
point for derivation of a scalable design computing the MMM presented in [108,109].
Later we will discuss the features of such scalable architecture. Before that, we make
a closer look at the operations of the algorithm and consider their modifications so
they are better suitable for efficient execution on chosen FPGA hardware platform.
The decision whether perform an addition of the modulus M to the temporal
sum Si+1 is based on the value of the variable qi that can be simply implemented.
The test checks the LSB of the partial sum Si+1 = Si + xiY and stores it as variable
qi once the addition of xiY is finished (see step 3 of the Algorithm 1 – 3). The stored
value decides on the addition of M in the following iteration of the loop.
However, the second condition (see step 6 of the Algorithm 1 – 3) causes a prob-
lem for a possible pipelined execution of computations. After the loop of additions,
multiplications and shifts, the mentioned comparison and subsequent conditional
subtraction is required. Without the final reduction step the outcome of the inner
loop of multiplication can provide an improper input for the subsequent multipli-
cation operation. That may happen in the case when the final value of S is bigger
than M (S > M). We have intention to use the MMM in a series of multiplica-
tions when the transformation into the Montgomery domain brings profit over an
expensive reduction as it was showed in the Algorithm 1 – 1. Therefore we analyse
possibilities for omitting the final condition step by changes in the Algorithm 1 – 3
and make possible a use of pipelined multipliers.
Algorithm Modifications The MMM algorithm (Algorithm 1 – 2) introduced
earlier is further extended. Two variants of the algorithm are discussed and im-
plemented, both supporting scalable multiple-word oriented implementation, but
handling a carry processing in different ways.
In the modified Algorithm 1 – 4 we use the following input operands:
k�
X = xi2
i=0
i = (0, 0, xk, xk−1, . . . , x1, x0) < 2M , (1.14)
�Y =
k�
�yi2 i+1 = (yk, . . . , y1, y0, 0) < 4M , (1.15)
i=0
where R = 2 k+3 , Y < 2M, and 2 k−1 < M < 2 k is an k-bit number (the same as
in the Algorithm 1 – 3). Note that � Y in Equation 1.15 is a left shifted version of
14