1 Montgomery Modular Multiplication in Hard- ware

FEI KEMT
the sequence, altogether ϕ(D) + 6 numbers. The computational costs consist of the
generation of T and the calculation of mDQ which amounts to at most D
4
+ B2
D
elliptic curve operations (mostly additions) and at most 3(π(B2) − π(B1)) modular
multiplications, π(x) being the number of primes up to x. The last term can be
lowered if D contains many small prime factors since this will increase the number
of pairs (m, k) for which both mD − k and mD + k are prime. Neglecting space
considerations a good choice for D is a number around √ B2 which is divisible by
many small primes.
4 Elliptic Curve Method in Hardware
We present the first published hardware implementation of the ECM for integer fac-
toring. The ECM implementation includes a complete hardware logic that supports
the ECM factoring of numbers up to approximately 200 bits. The proposed solution
applies parameters best suited to find factors of up to about 42 bits. The ECM
design features a supporting logic for computation of the modular operations as ad-
dition, subtraction, multiplication and squaring. The multiplication and squaring
is computed in the MMM unit analysed in the Chapter 2. The circuit has a good
scalability also to larger and smaller bit lengths. For a proof-of-concept purpose,
the ECM architecture has been implemented as a software-hardware co-design on a
FPGA and an embedded micro-controller in a SOC. Such a design perfectly fits the
needs of recent proposals for hardware architectures for the GNFS (see, e.g. [64])
and can reduce the overall costs of a GNFS device considerably.
Parts of this section were published in papers [65,94,120]. The research achieve-
ments described in this chapter include the following:
• ECM algorithm for hardware – algorithm adaptation and parametrisation,
• ECM implementation – unit design, parallelisation, case study for GNFS.
The ECM implementation was done as a joint work, mainly with Jan Pelzl from
Ruhr University Bochum (in SHARK project that includes the ECM design, have
cooperated also Christine Priplata and Colin Stahlke (Edizone GmbH, Germany),
and Jens Franke and Thorsten Kleinjung (University of Bonn, Germany)).
The Section 4.1 describes the details on selection of the parameters in the ECM.
The architecture of the implementation and discussion on the chosen algorithms
for the modular operations is presented in the Section 4.2. Implementation details
55
+ 7