Fast Modular Reduction Will Hasenplaugh Gunnar Gaubatz Vinodh

Fast Modular Reduction Will Hasenplaugh Gunnar Gaubatz Vinodh Gopal June 27, 2007

Modular Multiplication • Modular Multiplication is used in Public Key Cryptography – Diffie-Hellman and RSA – Prime-field Elliptic Curve Cryptography – Compute AB mod M where A, B and M are typically 100’s to 1000’s of bits • We present a variant of Barrett’s Modular Reduction Algorithm which exploits Karatsuba Multiplication and Modular Folding • Analysis is software focused – We use an abstract processor to compare algorithms fairly – The native word size is w-bits (a power of 2) – 1 -cycle add an m-cycle multiply – We present example data on an 8 -bit processor with a 2 -cycle multiplier – Atmel AVR series - representative of embedded handheld devices – Our algorithm is also applicable to hardware acceleration Digital Enterprise Group 2

Montgomery vs. Barrett Word-Serial Montgomery Barrett Pro: • • Regularity Interleaved Multiply and Reduce – • Right-to-Left computation leads to convenient hardware pipelines Transformation Overhead n 2 complexity No Transformation Overhead Large Digit Based Computation – Low-Complexity Quotient Estimation Con: • • • Allows sub-n 2 multiplication techniques Flexible ‘Off the Shelf’ hardware Con: • Quotient Estimation requires a ‘large digit’ multiplication • Left-to-Right computation is less convenient for hardware Digital Enterprise Group 3

Barrett vs. Montgomery Performance of n 2 Barrett approaches ~2/3 of Montgomery • Quotient Estimation for Montgomery is amortized as operands grow Digital Enterprise Group 4

Karatsuba Multiplication Recursive multiplication algorithm with O( n 1. 585 ) complexity. a 1 ‘Schoolbook’ multiplication complexity scales as O( n 2 ), but requires fewer additions per recursion. N=a 1 b 122 n+(a 1 b 0+a 0 b 1)2 n+a 0 b 0 Karatsuba Multiplication - x b 1 B b 0 b 1+b 0 a 1 b 1 A=a 12 n+a 0 Schoolbook Multiplication - a 0 a 1+a 0 N=AB B=b 12 n+b 0 A a 0 b 0 + (a 1+a 0)(b 1+b 0) - a 0 b 0 a 1 b 1 N=a 1 b 122 n+ [(a 1+a 0)(b 1+b 0)-a 1 b 1 -a 0 b 0]2 n+a 0 b 0 N=AB Digital Enterprise Group 5

Recursive Karatsuba Decomposition a 1 A a 0 <= 1 <= 2 For k recursions: ‘extra’ word is <= log 2 k bits a 1+a 0 <= 3 There are fewer particles in the universe than that. Just one extra word on an 8 -bit machine is sufficient to handle multiplication of numbers up to 2^258 bits. So, we probably won’t need to rewrite this code. Digital Enterprise Group 6

Carry Handling There is considerable overhead in the naïve implementation of Karatsuba. • ah al x At a recursion depth of 4, ~20% of the multiplies are with sparsely populated ‘extra’ words. We turn sparsely populated multiplies into branches and adds. N=AB A=ah 2 n+al bl albl + al if bh =1 + bl if ah =1 + if 1 B=bh 2 n+bl ah & bh =1 N ah and bh are booleans N=ahbh 22 n+[ahbl+bhal]2 n+albl bh Each recursion is a conveniently-sized multiply -> No ‘extra’ words. Digital Enterprise Group 7

Karatsuba vs. Schoolbook Multiplication Digital Enterprise Group 8

Barrett’s Algorithm A, B and M are n-bit numbers. We seek to find R = AB mod M using Barrett’s Algorithm. A x N / 2 n N B N mod 2 n x μ ~μ N / 22 n μ N / 2 n x - M ~μ NM / 22 n A total of 3 n-bit multiplies. R Digital Enterprise Group 9

Barrett vs. Montgomery Digital Enterprise Group 10

Folding We accelerate the reduction process by partially reducing N ( =AB ) with an inexpensive method called Folding: A N / 23 s x + B x N N mod 23 s M’=23 s mod M ~NM’ / 23 s N’ Digital Enterprise Group 11

Iterative Folding We can play the same trick again. N / 21. 5 n NN mod 21. 5 n F times, in fact. x M(1) + (1) N(1)Nmod 21. 25 n x M(2) + (2) N(2)N mod 21. 125 n Digital Enterprise Group 12

Iterative Folding ( F = 2 ) Digital Enterprise Group 13

Summary • This Fast Modular Reduction technique is ~2 x faster than Montgomery on RSA Encryption on 512 – 1024 bit keys. • As security requirements heighten, key sizes will grow to meet them and the asymptotic advantage of Karatsuba will continue to shine. We see a ~3 x and ~4 x advantage, respectively, for 2048 and 4096 bit keys. • The speedup of a multiplier-bound, w-bit architecture is • Strong encryption on low-power handheld devices is challenging – Ex: A 16 MHz 8 -bit Atmel AVR computes a 4096 -bit RSA in almost 4 minutes with Montgomery, but we can do it in 1. Digital Enterprise Group 14