Presentation on theme: "Fast Modular Reduction Will Hasenplaugh Gunnar Gaubatz Vinodh Gopal June 27, 2007."— Presentation transcript:
Fast Modular Reduction Will Hasenplaugh Gunnar Gaubatz Vinodh Gopal June 27, 2007
Digital Enterprise Group 2 Modular Multiplication Modular Multiplication is used in Public Key Cryptography –Diffie-Hellman and RSA –Prime-field Elliptic Curve Cryptography –Compute AB mod M where A,B and M are typically 100’s to 1000’s of bits We present a variant of Barrett’s Modular Reduction Algorithm which exploits Karatsuba Multiplication and Modular Folding Analysis is software focused –We use an abstract processor to compare algorithms fairly –The native word size is w-bits (a power of 2) –1-cycle add and an m-cycle multiply –We present example data on an 8-bit processor with a 2-cycle multiplier –Atmel AVR series - representative of embedded handheld devices –Our algorithm is also applicable to hardware acceleration
Digital Enterprise Group 3 Montgomery vs. Barrett Word-Serial Montgomery Pro: Regularity Interleaved Multiply and Reduce –Low-Complexity Quotient Estimation Right-to-Left computation leads to convenient hardware pipelines Con: Transformation Overhead n 2 complexity Barrett Pro: No Transformation Overhead Large Digit Based Computation –Allows sub-n 2 multiplication techniques Flexible ‘Off the Shelf’ hardware Con: Quotient Estimation requires a ‘large digit’ multiplication Left-to-Right computation is less convenient for hardware
Digital Enterprise Group 4 Barrett vs. Montgomery Performance of n 2 Barrett approaches ~2/3 of Montgomery Quotient Estimation for Montgomery is amortized as operands grow
Digital Enterprise Group 5 BA Karatsuba Multiplication Recursive multiplication algorithm with O( n ) complexity. ‘Schoolbook’ multiplication complexity scales as O( n 2 ), but requires fewer additions per recursion. N=AB A=a 1 2 n +a 0 B=b 1 2 n +b 0 Schoolbook Multiplication - N=a 1 b 1 2 2n +(a 1 b 0 +a 0 b 1 )2 n +a 0 b 0 Karatsuba Multiplication - N=a 1 b 1 2 2n + [(a 1 +a 0 )(b 1 +b 0 )-a 1 b 1 -a 0 b 0 ]2 n +a 0 b 0 a1a1 a0a0 b1b1 b0b0 a 1 +a 0 b 1 +b 0 x a1b1a1b1 a0b0a0b0 (a 1 +a 0 )(b 1 +b 0 ) a0b0a0b0 a1b1a1b1 N=AB + - -
Digital Enterprise Group 6 Recursive Karatsuba Decomposition Aa1a1 a0a0 a 1 +a 0 For k recursions: ‘extra’ word is <= log 2 k bits Just one extra word on an 8-bit machine is sufficient to handle multiplication of numbers up to 2^258 bits. There are fewer particles in the universe than that. So, we probably won’t need to rewrite this code. <= 1 <= 2 <= 3
Digital Enterprise Group 7 + if =1 + if & =1 Carry Handling There is considerable overhead in the naïve implementation of Karatsuba. At a recursion depth of 4, ~20% of the multiplies are with sparsely populated ‘extra’ words. We turn sparsely populated multiplies into branches and adds. N=AB A=a h 2 n +a l B=b h 2 n +b l a h and b h are booleans N=a h b h 2 2n +[a h b l +b h a l ]2 n +a l b l ahah alal x bhbh blbl alblalbl alal blbl bhbh ahah 1bhbh ahah N Each recursion is a conveniently-sized multiply -> No ‘extra’ words.
Digital Enterprise Group 8 Karatsuba vs. Schoolbook Multiplication
Digital Enterprise Group 9 Barrett’s Algorithm A, B and M are n-bit numbers. We seek to find R = AB mod M using Barrett’s Algorithm. A total of 3 n-bit multiplies. B x A NN mod 2 n N / 2 n μ μ N / 2 n ~μ N / 2 2n M R x x ~μ NM / 2 2n -
Digital Enterprise Group 10 Barrett vs. Montgomery
Digital Enterprise Group 11 Folding We accelerate the reduction process by partially reducing N ( =AB ) with an inexpensive method called Folding: B x A NN mod 2 3s N / 2 3s M’=2 3s mod M x ~NM’ / 2 3s + N’
Digital Enterprise Group 12 Iterative Folding We can play the same trick again. F times, in fact. NN mod 2 1.5n N / 2 1.5n M (1) x + N (1) N (1) mod n M (2) x + N (2) N (2) mod n
Digital Enterprise Group 13 Iterative Folding ( F = 2 )
Digital Enterprise Group 14 Summary This Fast Modular Reduction technique is ~2x faster than Montgomery on RSA Encryption on 512 – 1024 bit keys. As security requirements heighten, key sizes will grow to meet them and the asymptotic advantage of Karatsuba will continue to shine. We see a ~3x and ~4x advantage, respectively, for 2048 and 4096 bit keys. The speedup of a multiplier-bound, w-bit architecture is Strong encryption on low-power handheld devices is challenging –Ex: A 16MHz 8-bit Atmel AVR computes a 4096-bit RSA in almost 4 minutes with Montgomery, but we can do it in 1.