1 Montgomery Modular Multiplication in Hard- ware

FEI KEMT
Y , with �y0 = 0 and X is concatenated with two zero bits at MSB positions. This
change simplifies the computation of qi compared to Algorithm 1 – 3. The value of
qi needed for computation of Si+1 is given directly as a LSB of Si from the previous
iteration (see step 4 of the Algorithm 1 – 4). In this way the latency caused by an
addition of operands xiY is removed and logic implementation can be simplified,
too.
Algorithm 1 – 4 Optimized radix-2 Montgomery multiplication algorithm
Require: X = � k i=0 xi2 i = (0, 0, xk, xk−1, . . . , x1, x0) < 2M, � Y = � k i=0 �yi2 i+1 =
(yk, . . . , y1, y0, 0) < 4M, R = 2 k+3 , Y < 2M, and 2 k−1 < M < 2 k .
Ensure: S = XY R −1 mod M.
1: S0 ⇐ 0
2: � Y ⇐ 2Y
3: for i = 0 to k + 2 do
4: qi ⇐ Si mod 2
5: Si+1 ⇐ (Si + xi � Y + qiM)/2
6: end for
7: S ⇐ Sk+3
8: return S
The inner loop of the Algorithm 1 – 4 is executed with three additional iterations
in comparison to the Algorithm 1 – 3. Higher number of iterations ensures that
the inequalities Si < 3M, i = 0, 1, . . . , k + 2 and S = Sk+3 = MMM(X, Y ) =
(XY R −k−3 ) mod M < 2M always hold. The result of S = MMM(X, Y ) can thus
be reused as an input X and Y for the subsequent MMM. This modification avoids
the originally proposed final correction step (comparison and subtraction in step 6
of the Algorithm 1 – 3) and makes possible a pipelined execution of the algorithm in
separated multipliers.
In typical applications (e.g. RSA), input operands X, Y are pre-multiplied
by a factor 2 2k mod M (Algorithm 1 – 3) or 2 2k+6 mod M (Algorithm 1 – 4). The
final MMM with value 1 makes the final result smaller than M (with probability
1 − 2 −(k+2) as shown in [29]) and provides the result XY mod M.
1.3 EC in Cryptography
Application of the EC in the public-key cryptography was independently proposed
by Neal Koblitz and Victor S. Miller in year 1985 [77, 87]. Advantage of using
15