Download presentation

Presentation is loading. Please wait.

Published byMateo Donn Modified about 1 year ago

1
OEO: O PTIMIZATION OF E XPONENTIATION O PERATION ~ A B RIEF D ISCUSSION ~ Kirti Chawla kirti@cs.virginia.edu

2
Outline 1.Problem definition 2.Motivation 3.Prevalent Approaches 4.Suggestion 5.Q & A/Feedback

3
Problem definition Given n, compute g n Where, g is fixed element of a group and n < N (order of group).

4
Motivation 1.Exponentiation is the most frequently used operation in algorithms including: Factorization and primality testing GCD computation RSA public key cryptosystem Verification of polynomial identities … 2.Exponentiation is also found in most widely deployed authentication protocols including: Diffie-Hellman Key Exchange Internet Key Exchange a.k.a IKE Secure Socket Layer a.k.a SSL … 3.Quick biased conclusion : Any and all optimization of exponentiation operation improves performance for aforementioned algorithms and protocols.

5
Prevalent Approach 1 Approach 1: Montgomery Multiplication Step 1. Pick A, B, R, N s.t k; (((R = 2 k ) > N) (GCD(R, N) = 1)) Step 2. Find R’ and N’ s.t. (RR’ – NN’ = 1) Step 3. Construct a function F with following details: F(T) { m (T mod R) N’ (mod R) t (T + mN)/R return t } It should evident here that F(T) returns (TR’ mod N), where T = A * B Also, RR’ 1 (mod N), NN’ -1 (mod N) Also, the output of F(T) lies in range [0, N – 1]

6
Prevalent Approach 1 cont’d Example: Let N = 79, A = 17, B = 26, R = 100; (relaxed requirement for R = 2 k ) R’ = 64, N’ = 81; (check RR’ – NN’ = 1) A’; (17 A’ * 100 mod 79) (17 * 64 A’ mod 79) (17 * 64 61 mod 79) B’; (17 B’ * 100 mod 79) (26 * 64 B’ mod 79) (26 * 64 5 mod 79) Therefore, A * B in above representation can be seen as follows: A * B = 17 * 26 = 442 (61 * 100) * (5 * 100) (305) * (100) * (100) (68) * (100) * (100) mod 79 442*64 (68) * (100) mod 79 (28228) mod 79 6 (68) * (100) mod 79 Therefore, F(T) should take 442 as input and return 6, which can be verified as under: T = 442, R = 100, R’ = 64, N’ = 81, N = 79 m (T mod R) * N’ * (mod R)t (T + mN)/R (442 mod 100) * 81 * (mod 100) (442 + 2*79)/100 (42 * 81) mod 100 600/100 6 mod 79

7
Prevalent Approach 2 Approach 2: Brickell, Gordon, McCurley and Wilson or BGMW by [Gordon et al] Premise: square-and-multiply (from: addition chains) method for g n requires 2 logN , where N is order of group. Suggestion: Pre-compute and store powers of 2 (of g). Quick inference 1: There is no reason to store powers of 2 Quick inference 2: Pre-compute g x0, g x1, … g xm-1 for some integers x 0, x 1 … x m-1 Requirement: Find a decomposition for n s.t. Where, 0 a h and 0 i < m What are the implications ?

8
Prevalent Approach 2 cont’d g n can be computed as follows: Algorithm: ComputeG(g xi ) { b 1 a 1 for (d = h; d 1; d--) { for (i=0; a i == d; i++) { b b * g xi } a a * b } return a; }

9
Prevalent Approach 2 cont’d Quick Inference 3: number of multiplications are 2h – 2 Quick Inference 4: if c d ’s have no relation amongst themselves, then aforementioned metric is optimal. 1.Approach 2 is extended to other number system as well 2.Approach 2 can be parallelized. It is shown as under: b b * g xi (calculation for c d ); spread each c d to 1 of h available a a * b (calculation of g n ); each processor can compute c d for one d using addition chain method and finally repeated multiplication in pairs to form g n. 3.This offers the speedup of (loglogN) worst-case using (logN/log 2 logN) processors.

10
Prevalent Approach 3 Approach 3: Flexibility + BGMW approach [Lim et al] Approach Step 1. Divide n (from: g n ) into h blocks n i ; where, 0 i h – 1 of size k = b/h Step 2. Further, divide n i into smaller blocks n i, j; where 0 j v – 1 of size t = k/v Step 3. This division of n for g n transforms the problem of computation as under: Step 4. if we have n i to be expressed in binary representation then g n can be written as under: Step 5. Using pre-computed and stored values of G[j][i] = (G[0][i]) 2jb

11
Prevalent Approach 3 Algorithm: ComputeG(G[0][i]) { Z 1 for (k = b – 1; k 0; k--) { Z Z*Z for (j = v – 1; j 0; j--) { Z Z*G[j][I j, k] } return Z; } 0 1 2 … h – 1 0 1 … v – 1 i j

12
Suggestion Suppose g N is to be calculated, where N can be broken into p, q s.t. N = p * q. Furthermore, p and q are s.t. p * q = 10 * (p + q) WLOG, g N = g p * q = g 10 * (p + q) Where, g 10 can be pre-computed and stored. Additionally, if N is prime, the N can be broken into p, q s.t. N = 10 * (p + q) + C Where C is any constant For example, if p = 35, q = 14, C = 1 N = 491 WLOG, g N = g 10 * (p + q) + C Where, g 10 and g C can be pre-computed and stored.

13
Suggestion cont’d

14
g C1 g C2 g C3 g C4 … g Ck + E p q g 10 gNgN p + q g 10 * (p + q) g 10 * (p + q) + c

15
Q & A/Feedback Feedback

Similar presentations

© 2017 SlidePlayer.com Inc.

All rights reserved.

Ads by Google