1 Montgomery Modular Multiplication in Hard- ware

FEI KEMT
C’
carry chain carry chain
FA FA FA
(a) carry-propagate adder
C
FA FA . . . FA
(b) carry-save adder
Figure 2 – 2 One level of the w-bit adder implemented as CPA and CSA with FAs
final speed is dominated by the embedded memory access time or other critical path
in the logic. The value wmax may differ between technologies due to the different
routing and distinct physical layout (number of LEs in LAB). The question is if the
wmax is in the range of allowed values for the on-chip memory width of available
FPGAs. In this way we could store and also operate the variables with optimal
word width and achieve the best Area-Time product.
Carry-Save Adder Unit The whole computational complexity of both algo-
rithms lies in two additions of three w-bit operands for computing Si+1. The
propagation of the carry bits between the w adders is (in general) too slow. The
implementation of the MWR2MM CSA in [108] uses redundant representation of
intermediate sum S and carry-save adders [38]. The MWR2MM CSA w-bit PE
architecture based on Full Adders (FAs) is depicted in Figure 2 – 3.
In order to reduce the storage size and arithmetic hardware complexity the vari-
ables X, Y , and M are available in a non-redundant form. The intermediate internal
sum S is received and generated in the redundant form as 1S and 2S. The advantage
of redundant form lies in the independence of the latency from the word length w
as there is no direct connection between the FAs. The output of the adders is valid
right after appearance of the input signals and the delay is given mainly by internal
combinational logic of the FA.
The processing delay may increase for larger w as a result of the broadcast
problem only, it will not depend on the arithmetic operation itself. Conversion
into the normal non-redundant representation is only done at the very end of the
MMM computation. The intermediate result of sum S may be further shifted to
other MMM unit as operand X or Y for a new computation (e.g. next iteration
of the modular exponentiation). The redundant representation of variables that
requires twice as much memory as a non-redundant representation and a need for the
transformation to/from redundant form have been considered as the main drawbacks
27