1 Montgomery Modular Multiplication in Hard- ware

FEI KEMT
units are available, the total execution time TMMM will increase. On the other
hand the area occupation of the coprocessor can be changed according to the area
constraints of the target device. Implementation of n < nmax stages means also
more operations needed for reading from and storing in the memory. Shifting the
processed data between the stages is faster than storing the intermediate results in
the memory block and their repeated reading to finish the computations on them.
Therefore the best performance is achieved in design with maximal number of stages
nmax (n = nmax).
Parametrisation The MMM coprocessor has three variable parameters (w, e, and
n) that can be chosen for any implementation. According to the required area of
the implemented coprocessor and the required timings for the MMM computations
the number of pipelined stages and the word width (n, w) can be chosen. The
security level of public-key algorithm defines the length of operands for the multiplier
(k = we). This approach gives high flexibility to the processor and coprocessor
design.
In general, there are two possible approaches how to increase the speed of the
MMM computation in the proposed designs (check Equation 2.4 to understand the
relations between the design parameters and the computation time TMMM):
1. To increase the word length w. In this way the number of iterations given by
e is reduced what yields a shorter computation time. While the older FPGAs
provide memory blocks with dual port memory feature and configurable word
lengths only up to 16 bits (Altera Apex [8]), in the high-performance models
it can be up to 32 bits for middle-sized blocks or 128 bits for large memory
blocks (Altera Stratix II [20]). Since the capacity of the block is sufficient
for typical RSA operands it makes sense to use only one block per operand.
In case of an older technology with smaller memory blocks and chosen bigger
word width (16 < w ≤ 32) two memory blocks per variable aare required.
In dependency of the memory configuration several variables may share one
memory block. Operands mapping to the memory is especially important for
constrained SOC designs with limited number of memory blocks.
2. To increase the number of pipelined stages n. The hardware structure of the
PE for both solutions (CSA PE and CPA PE) is relatively simple and fast
and independent on the number of stages, what was a condition for a scalable
design. An addition of several pipelined stages can increase the overall speed,
31