1 Montgomery Modular Multiplication in Hard- ware

FEI KEMT
Algorithm 2 – 2 The multiple word radix-2 Montgomery multiplication MWR2-
MM CPA algorithm
1: S ⇐ 0
2: � Y ⇐ 2Y
3: for i = 0 to k + 3 do
4: C ⇐ 0
5: qi ⇐ S (0)
0
6: for j = 1 to e2 − 1 do
7: (C, S (j) ) ⇐ C + xi � Y (j) + qiM (j) + S (j)
8: S (j−1) ⇐ (S (j)
0 , S (j−1)
w−1..1)
9: end for
10: S (e2−1) ⇐ (C, S (e2−1)
w−1..1)
11: end for
of the final sum S to M at the end of the loop in the Algorithm 1 – 3 for the price
of some extra loops in the Algorithm MWR2MM CPA. Another difference is in
computation of the variable qi that decides on addition of M. Its value in the MW-
R2MM CPA algorithm is given directly as LSB of the zeroth word of the internal
sum S computed in the previous loop. Contrary of the Algorithm MWR2MM CPA
the Algorithm MWR2MM CSA uses a value obtained after addition of item xiY
what increase a latency for computing the qi.
The most important difference between MWR2MM CSA and MWR2MM CPA is
introduced in a way by which the variable S is represented. In carry-save redundant
form applied in our implementation of the Algorithm MWR2MM CSA the sum S
is represented by formulation:
S (j) = 1S (j) + r2S (j) , (2.2)
where r is the radix (in our implementation r = 2) and 1S, 2S are two w-bit com-
ponents of the sum S. Advantage of such representation is in no carry propagation
inside the inner loop of the MMM algorithm. On the other hand, for storing the
partial sum variable S it required to use two w-bit registers instead of one. Only at
the very end of the computations, the redundant form is transformed to the normal
representation applying the Equation 2.2. The CSA PE which executes the MW-
R2MM CSA Algorithm is in this direction independent on hardware platform and
does not require any special features for hardware implementation of the adders.
In the implementation of the MWR2MM CPA algorithm all operands are op-
24