Fast Modular Reduction Will Hasenplaugh Gunnar Gaubatz Vinodh Gopal June 27, 2007

Modular Multiplication Modular Multiplication is used in Public Key Cryptography Diffie-Hellman and RSA Prime-field Elliptic Curve Cryptography Compute AB mod M where A,B and M are typically 100’s to 1000’s of bits We present a variant of Barrett’s Modular Reduction Algorithm which exploits Karatsuba Multiplication and Modular Folding Analysis is software focused We use an abstract processor to compare algorithms fairly The native word size is w-bits (a power of 2) 1-cycle add and an m-cycle multiply We present example data on an 8-bit processor with a 2-cycle multiplier Atmel AVR series - representative of embedded handheld devices Our algorithm is also applicable to hardware acceleration Digital Enterprise Group

Digital Enterprise Group Montgomery vs. Barrett Word-Serial Montgomery Pro: Regularity Interleaved Multiply and Reduce Low-Complexity Quotient Estimation Right-to-Left computation leads to convenient hardware pipelines Con: Transformation Overhead n2 complexity Barrett Pro: No Transformation Overhead Large Digit Based Computation Allows sub-n2 multiplication techniques Flexible ‘Off the Shelf’ hardware Con: Quotient Estimation requires a ‘large digit’ multiplication Left-to-Right computation is less convenient for hardware Digital Enterprise Group

Digital Enterprise Group Barrett vs. Montgomery Performance of n2 Barrett approaches ~2/3 of Montgomery Quotient Estimation for Montgomery is amortized as operands grow Digital Enterprise Group

Karatsuba Multiplication Recursive multiplication algorithm with O( n1.585 ) complexity. ‘Schoolbook’ multiplication complexity scales as O( n2 ), but requires fewer additions per recursion. N=AB A=a12n+a0 B=b12n+b0 Schoolbook Multiplication - N=a1b122n+(a1b0+a0b1)2n+a0b0 Karatsuba Multiplication - N=a1b122n+ [(a1+a0)(b1+b0)-a1b1-a0b0]2n+a0b0 a1 A a0 x b1 B b0 a1+a0 b1+b0 a1b1 a0b0 + (a1+a0)(b1+b0) - a0b0 - a1b1 N=AB Digital Enterprise Group

Recursive Karatsuba Decomposition <= 1 <= 2 For k recursions: ‘extra’ word is <= log2k bits a1+a0 <= 3 There are fewer particles in the universe than that. Just one extra word on an 8-bit machine is sufficient to handle multiplication of numbers up to 2^258 bits. So, we probably won’t need to rewrite this code. Digital Enterprise Group

Digital Enterprise Group Carry Handling There is considerable overhead in the naïve implementation of Karatsuba. At a recursion depth of 4, ~20% of the multiplies are with sparsely populated ‘extra’ words. We turn sparsely populated multiplies into branches and adds. N=AB A=ah2n+al B=bh2n+bl ah and bh are booleans N=ahbh22n+[ahbl+bhal]2n+albl ah al x bh bl albl + if =1 al bh + if =1 bl ah + if & =1 1 ah bh N Each recursion is a conveniently-sized multiply -> No ‘extra’ words. Digital Enterprise Group

Karatsuba vs. Schoolbook Multiplication Digital Enterprise Group

Digital Enterprise Group Barrett’s Algorithm A, B and M are n-bit numbers. We seek to find R = AB mod M using Barrett’s Algorithm. A total of 3 n-bit multiplies. A x B N N / 2n N mod 2n x μ μ N / 2n ~μ N / 22n x M - ~μ NM / 22n R Digital Enterprise Group

Digital Enterprise Group Barrett vs. Montgomery Digital Enterprise Group

Digital Enterprise Group Folding We accelerate the reduction process by partially reducing N ( =AB ) with an inexpensive method called Folding: A x B N / 23s N N mod 23s x M’=23s mod M ~NM’ / 23s + N’ Digital Enterprise Group

Digital Enterprise Group Iterative Folding We can play the same trick again. F times, in fact. N / 21.5n N N mod 21.5n x M(1) + N(1) N(1) mod 21.25n x M(2) + N(2) N(2) mod 21.125n Digital Enterprise Group

Iterative Folding ( F = 2 ) Digital Enterprise Group

Digital Enterprise Group Summary This Fast Modular Reduction technique is ~2x faster than Montgomery on RSA Encryption on 512 – 1024 bit keys. As security requirements heighten, key sizes will grow to meet them and the asymptotic advantage of Karatsuba will continue to shine. We see a ~3x and ~4x advantage, respectively, for 2048 and 4096 bit keys. The speedup of a multiplier-bound, w-bit architecture is Strong encryption on low-power handheld devices is challenging Ex: A 16MHz 8-bit Atmel AVR computes a 4096-bit RSA in almost 4 minutes with Montgomery, but we can do it in 1. Digital Enterprise Group