Revisiting Sum of Residues Modular Multiplication

Abstract

In the 1980s, when the introduction of public key cryptography spurred interest in modular multiplication, many implementations performed modular multiplication using a sum of residues. As the field matured, sum of residues modular multiplication lost favor to the extent that all recent surveys have either overlooked it or incorporated it within a larger class of reduction algorithms. In this paper, we present a new taxonomy of modular multiplication algorithms. We include sum of residues as one of four classes and argue why it should be considered different to the other, now more common, algorithms. We then apply techniques developed for other algorithms to reinvigorate sum of residues modular multiplication. We compare FPGA implementations of modular multiplication up to 24 bits wide. The sum of residues multipliers demonstrate reduced latency at nearly 50% compared to Montgomery architectures at the cost of nearly doubled circuit area. The new multipliers are useful for systems based on the Residue Number System (RNS).

1. Introduction

Modular multiplication is important for many applications including cryptography and image processing. Many different modular multiplication algorithms have been published [1–5] and have been deployed for public-key cryptography or digital signal processing. In this paper, we reinvigorate the sum of residues class of modular multipliers by describing a new modular multiplication algorithm and implementation.

Section 3 surveys the literature of modular multiplication to arrive at 4 classes of algorithm: sum of residues, classical, Barrett and Montgomery. The goal of this section is not a comprehensive survey all publications, but to support the claim that sum of residues is a distinct class that has been largely ignored. In Section 4, we apply optimizations, originally proposed for other classes of reduction, to breathe new life into sum of residues modular multiplication. Section 5 evaluates the reinvigorated sum of residues approach by comparing it with Montgomery multiplication on an FPGA.

2. Motivation: The Residue Number System

Our interest in modular multiplication at word length up to around 24-bits stems from its application to systems built using the Residue Number System (RNS). By representing integers in independent short-word length channels, residue number systems offer advantages for digital signal processing [6–8] and long word length arithmetic, especially for crypto-operations [9, 10].

A residue number system [11] is characterized by a set of 𝑁 coprime moduli {𝑚₁,𝑚₂,…,𝑚_𝑁}. In the RNS, a number 𝑋 is uniquely represented in 𝑁 channels: 𝑋={𝑥₁,𝑥₂,…,𝑥_𝑁}, where 𝑥_𝑖 is the residue of 𝑋 with respect to 𝑚_𝑖, that is, 𝑥_𝑖=⟨𝑋⟩_𝑚𝑖=𝑋mod𝑚_𝑖.

If 𝑋, 𝑌, and 𝑍 have RNS representations given by 𝑋={𝑥₁,𝑥₂,…,𝑥_𝑁}, 𝑌={𝑦₁,𝑦₂,…,𝑦_𝑁}, and 𝑍={𝑧₁,𝑧₂,…,𝑧_𝑁}, then denoting * to represent the operations +, −, or ×, the RNS version of 𝑍=𝑋∗𝑌 satisfies 𝑍=⟨𝑥₁∗𝑦₁⟩_𝑚1,⟨𝑥₂∗𝑦₂⟩_𝑚2,…,⟨𝑥_𝑁∗𝑦_𝑁⟩_𝑚𝑁. (1) Thus, addition, subtraction, and multiplication can be concurrently performed on the 𝑁 residues within 𝑁 parallel channels, and it is this high-speed parallel operation that makes the RNS attractive. The multipliers described in this paper are intended for the modular multiplications ⟨𝑥_𝑖×𝑦_𝑖⟩_𝑚𝑖 within RNS channels. These typically have a word length from 4 to 24 bits.

2.1. Contribution

This paper contributes to the literature of modular multiplication by (1)identifying sum of residues as a separate class of modular reduction algorithm, (2)presenting a new algorithm and implementation for sum of residues modular multiplication, and (3)demonstrating that this approach can deliver performance benefits, particularly for channel-width modular multipliers for RNS systems on FPGA.

2.2. Notation

We consider the modular multiplication 𝐶=𝐴×𝐵mod𝑀, where 𝐴, 𝐵, and 𝑀 are 𝑛-digit integers of the form 𝑋=∑^𝑛−1_𝑖=0𝑥_𝑖𝑟^𝑖. The radix 𝑟 is typically a positive power of 2.

Note that it is common for modular multiplication algorithms to produce a result 𝐶>𝑀 such that a few subtractions of 𝑀 are required to fully reduce the result. The usual approach is to design the algorithm so 𝐶 can be fed back to the input without overflow, even if 𝐶 is not fully reduced.

3. Classes of Modular Multiplication

Some early modular multipliers [4, 12–15] proceed by accumulating residues modulo 𝑀. Equation (2) is a typical starting point. The residues, typified by (𝐵𝑟^𝑖mod𝑀) in (2), may be precomputed and retrieved from a table (e.g., [12]) or evaluated recursively during the modular multiplication (e.g., [13]). A typical algorithm will be shown in the next section, from which point the sum of residues algorithm will be analyzed and improved 𝐶=^𝑛−1_𝑖=0𝑎_𝑖𝐵𝑟^𝑖mod𝑀. (2)

Instead of accumulating residues modulo 𝑀, reduction can be performed by subtracting multiples of 𝑀. Papers that take this approach include [5, 16–19]. Algorithm 1 is typical. Reduction in this way can be understood as a division in which the quotient is discarded and the remainder retained. Development of modular multipliers along this line has, therefore, closely followed the development of division, especially SRT division (as originally in [20]).

Ensure: 𝐶≡𝐴×𝐵mod𝑀  𝐶=0 for 𝑖=𝑛−1 downto 0 do   𝐶=𝑟𝐶+𝑎𝑖𝐵 {Partialproductaccumulation}   𝑞𝑖=QDS(𝐶,𝑀) {Quotientdigitselection}   𝐶=𝐶−𝑞𝑖𝑀{Reductionstep} end for

Algorithm 1 

A Typical Example of Classical Modular Multiplication.

The Quotient Digit Selection function (QDS) has received a great deal of attention to: permit quotient digits (𝑞_𝑖) to be trivially estimated from only the most significant bits of the partial result 𝐶, allow the partial result to be stored in a redundant form, and move the QDS function from the critical path (e.g., [17, 18]).

The relationship between division and modular multiplication is made explicit in 𝐴×𝐵mod𝑀=(𝐴×𝐵)−𝐴×𝐵𝑀×𝑀. (3) This equation suggests an alternative mechanism: one may perform the division ⌊(𝐴×𝐵)/𝑀⌋ by multiplying by 𝑀⁻¹. Papers that follow this line include [1, 21, 22]. Note that 𝑀⁻¹ is a real number so that correct evaluation of (3) using fixed-point arithmetic requires careful design of the representation. A typical example is the improved Barrett algorithm (named after Barrett's reduction in [1]) described in [22] and shown in Algorithm 2.

Require: 𝛼, 𝛽 {Pre-definedparameters} Require: 𝐾=⌊2𝑛+𝛼/𝑀⌋ {Aprecomputedconstant} Ensure: 𝐶≡𝐴×𝐵mod𝑀  𝐶=𝐴×𝐵  𝐶1=⌊𝐶/2𝑛+𝛽⌋ {Rightshiftby𝑛+𝛽}  𝐶2=𝐶1×𝐾  𝑄=⌊𝐶/2𝛼−𝛽⌋  𝐶=𝐶−𝑄×𝑀

Algorithm 2 

Improved Barrett modular multiplication.

Most recently, modular multipliers based on Montgomery's reduction algorithm [2] have been popular [3, 23, 24]. A typical form is shown in Algorithm 3. Note that the quotient digit selection step examines only the least significant digit of the partial result 𝐶. Also, note that Montgomery's method does not produce a fully reduced residue 𝐶=𝐴×𝐵mod𝑀 directly, but rather the Montgomery residue 𝐶×𝑅⁻¹mod𝑀. Computation can proceed with Montgomery residues as an internal representation. An extra modular multiplication is required to convert the final result to a fully reduced residue.

Require: 𝑅=𝑟𝑛 Require: 𝑚0−1s.t.𝑚0×𝑚0−1≡1mod𝑟 Ensure: 𝐶≡𝐴×𝐵×𝑅−1mod𝑀  𝐶=0  for 𝑖=0 to 𝑛−1 do   𝐶=𝐶+𝑎𝑖𝐵 {Partialproductaccumulation}   𝑞𝑖=−𝑐0×𝑚0−1mod𝑀 {Quotientdigitselection}   𝐶=(𝐶+𝑞𝑖𝑀)/𝑟{Reductionstep}  end for

Algorithm 3 

Montgomery modular multiplication.

We have, therefore, identified 4 different classes of modular multiplication algorithm according to the way in which they perform reduction. (1)Sum of Residues: reduction is achieved by accumulating residues modulo 𝑀. (2)Classical: multiples of the modulus 𝑞_𝑖𝑀 are subtracted according to a QDS function that examines the most significant digits of the partial result 𝐶. (3)Barrett: multiplication by 𝑀⁻¹ is used to reduce modulo 𝑀. (4)Montgomery: multiples of the modulus 𝑞_𝑖𝑀 are accumulated according to a QDS function that examines the least significant digits of the partial result 𝐶.

We note here that each of the 4 classes permits separated and interleaved implementations. In a separated implementation, 𝐴×𝐵 is evaluated before being reduced modulo 𝑀. The alternative is to interleave the multiplication and reduction steps. This has the benefit of keeping intermediate values to the approximate magnitude of 𝑀 but does not take advantage of any preexisting nonmodular multiplier. In this paper, we are largely concerned with interleaved implementations.

Surveys of modular reduction offer different classifications. References [25–27] identify three classes: classical, Barrett, and Montgomery. References [22, 28] include the Barrett algorithms with other classical algorithms and therefore divide the field into only two classes: classical and Montgomery. None of these surveys cover sum of residues papers. Other publications, [4, 29, 30], have made note of the sum of residues technique but categorize it along with other classical algorithms.

4. Reinvigorating Sum of Residues

4.1. Tomlinson's Algorithm

We take the modular multiplier developed by Tomlinson in [4] as our starting point for further development. Tomlinson's algorithm is shown in Algorithm 4.

Ensure: 𝐶≡𝐴×𝐵mod𝑀, 𝐶<2𝑛+1  𝐶=0  𝑞=0  for 𝑖=𝑛−1 downto 0 do   𝐶=2𝐶+𝑎𝑖𝐵   𝐶=𝐶+(𝑞×2𝑛+1mod𝑀) {Theresidue(𝑞×2𝑛+1mod𝑀)isprecomputed.}   𝑞=⌊𝐶/2𝑛⌋ {𝑞istheupper2bitsof𝐶}   𝐶=𝐶−𝑞×2𝑛 {Settheupper2bitsof𝐶tozero}  end for  𝐶=2𝐶+(𝑞×2𝑛+1mod𝑀)

Algorithm 4 

Tomlinson's sum of residues modular multiplication.

At first sight, this may look like a classical algorithm as the quotient digit 𝑞 is selected from the most significant bits of the partial result. The difference is that a classical algorithm then performs reduction by subtracting the multiple of the modulus 𝑞_𝑖𝑀; Tomlinson's algorithm performs the reduction by setting the most significant bits to zero and accounting for this change by adding the precomputed residue (𝑞×2^𝑛+1mod𝑀).

An architecture for Tomlinson's algorithm is shown in Figure 1. Note that the intermediate result 𝐶 at iteration 𝑖 is denoted 𝐶[𝑖]. As the loop is from 𝑛−1 down to 0, 𝐶[𝑖+1] denotes the value 𝐶 in the previous iteration.

Figure 1 

An architecture for Tomlinson's interleaved modular multiplication algorithm.

A Carry-Save Adder (CSA) is used to perform the three-term addition 𝐶[𝑖]=2𝐶[𝑖+1]+𝑎_𝑖𝐵+(𝑞×2^𝑛+1mod𝑀). To make sure 2𝐶[𝑖+1] is 𝑛 bits long, the same as the other two addends, 𝑞 is set to be the upper 3 bits instead of 2 bits of the current partial result.

Note that the carry-save representation is a type of redundant representation that has been applied to other modular multiplication algorithms [15, 19, 31]. We will keep using this technique to enhance the sum of residues modular multiplier.

Reference [15] gives an similar algorithm but sets 𝑞 only two bits long. This means that the partial result 𝐶[𝑖] may be 𝑛+1 bits long. To bound it within 𝑛 bits, a subtracter is used to constantly subtract 𝑀 until 𝐶[𝑖] has only 𝑛 bits. This redundant step greatly increases the latency of the algorithm. In the following sections, we describe new enhancements to improve the performance of this algorithm.

4.2. Eliminating the Carry-Propagate Adder

There two obvious demerits of the architecture in Figure 1. Firstly, a Carry-Propagate Adder (CPA) is used to transform the redundant representation of 𝐶[𝑖] to its nonredundant form. This is required because the upper 3 bits of 𝐶[𝑖] have to be known to look up 𝑞×2^𝑛 mod 𝑀 before the next iteration. The CPA delay contributes significantly to the latency of the implementation. The second problem is that the lookup of 𝑞×2^𝑛 mod 𝑀 is on the critical path.

Both of these problems can be solved by keeping the intermediate result in a redundant carry-save form. The CPA of Figure 1 is eliminated so that the calculation of the partial result becomes 𝐶₁[𝑖]+𝐶₂[𝑖]=𝐶₁[𝑖+1]+𝐶₂[𝑖+1]+𝑎_𝑖𝐵+((𝑞₁+𝑞₂)×2^𝑛mod𝑀), where 𝐶₁[𝑖] and 𝐶₂[𝑖] are the redundant representation of 𝐶[𝑖] as sum and carry terms, respectively. A modified architecture is shown in Figure 2. The CPA is replaced by a second CSA.

Figure 2 

Modified sum of residues modular multiplier architecture.

The precomputed residue (𝑞₁+𝑞₂)×2^𝑛mod𝑀, which must be retrieved from a lookup table (LUT), can be sent to the second CSA rather than the first. All three addends to the first CSA are available at the beginning of each iteration and the table lookup step can be performed in parallel with the first CSA.

In Figure 1, it can be seen that the carry output of the first CSA is 𝑛+1 bits wide. This cannot be input directly to the second CSA which is only 𝑛-bits wide. Thus, in Figure 2, the MSB of the (𝑛+1)-bit carry is sent to the LUT circuit instead. The LUT retrieves two possible values of (𝑞₁+𝑞₂)×2^𝑛 mod 𝑀 corresponding to the case of either a 0 or 1 in the MSB of the carry output from the first CSA. An MUX selects the appropriate value of (𝑞₁+𝑞₂)×2^𝑛 mod M once the MSB is available. Thus, although the LUT executes in parallel with the first CSA, an additional MUX appears on the critical path.

4.3. Further Enhancements

If the second CSA in Figure 2 can be modified to accept an (𝑛+1)-bit input, the MUX can be eliminated. The left of Figure 3 shows a conventional 𝑛-bit CSA. Note that the output sum is only 𝑛 bits wide. To accept an (𝑛+1)-bit input, we can just copy the MSB of the (𝑛+1)-bit input to the MSB of output sum. This is illustrated in the right of Figure 3. This modified CSA accepts 1 (𝑛+1)-bit input and 2 𝑛-bit inputs and produces 2 (𝑛+1)-bit outputs.

Figure 3 

𝑛-bit carry-save adders.

Figure 4 shows the resulting modular multiplication architecture. The algorithm corresponding to this new architecture is given as Algorithm 5. The CPA has been eliminated from the iteration, and the residue lookup has been shifted from the critical path. Also, no subtraction is needed at the end of the algorithm to bound the output within 𝑛+1 bits. If 𝐶₁[0] and 𝐶₂[0] are simply summed using a CPA, the resulting output 𝐶 could be 𝑛+2 bits, which needs some further subtraction to be reduced. Therefore, the same technique as in the loop is applied. Both 𝐶₁[0] and 𝐶₂[0] are set to 𝑛−1 bits and the 𝑛-bit residue corresponding to the 2 upper reset bits is retrieved from another LUT. The final sum yields an (𝑛+1)-bit output 𝐶.

Ensure: 𝐶≡𝐴×𝐵mod𝑀, 𝐶<2𝑛+1  𝐶1[𝑛]=𝐶2[𝑛]=𝑞1=𝑞2=0  for 𝑖=𝑛−1 downto 0 do   {𝑇1[𝑖],𝑇2[𝑖]}=2𝐶1[𝑖+1]+2𝐶2[𝑖+1]+𝑎𝑖𝐵 {Carrysaveaddition}   {𝐶1[𝑖],𝐶2[𝑖]}=𝑇1[𝑖]+𝑇2[𝑖]+((𝑞1+𝑞2)×2𝑛mod𝑀)   {Carrysaveaddition} {Theresidue((𝑞1+𝑞2)×2𝑛mod𝑀)isprecomputed}   {𝑞1,𝑞2}={𝐶1[𝑖]≫(𝑛−1),𝐶2[𝑖]≫(𝑛−1)} {𝑞1 and 𝑞2 are the upper 2 bits of 𝐶1[𝑖] and 𝐶2[𝑖] respectively.}   {𝐶1[𝑖],𝐶2[𝑖]}={2𝐶1[𝑖] & (2𝑛−1),2𝐶2[𝑖] & (2𝑛−1)}   {Settheupper2bitsof𝐶1[𝑖]and𝐶2[𝑖]tozero}  end for  {𝐶1[0],𝐶2[0]}={2𝐶1[0],2𝐶2[0]} {Rightshiftsotheyareboth𝑛−1bits}  𝐶=𝐶1[0]+𝐶2[0]+((𝑞1+𝑞2)×2𝑛−1mod𝑀)

Algorithm 5 

New sum of residues modular multiplication.

Figure 4 

New sum of residues modular multiplier architecture.

The LUTs have a 4-bit input and an 𝑛-bit output so that a (2⁴×𝑛)-bit ROM can be used. Moreover, note that the sum of (𝑞₁+𝑞₂) is at most 110, which occurs when (𝑞₁ and 𝑞₂) are both 11. This implies that the possible sum of (𝑞₁+𝑞₂) is in the range from 000 to 110, which has 7 values only. Therefore, a ROM with a further reduced size of (7×𝑛) bits can be used for (𝑞₁+𝑞₂)×2^𝑛mod𝑀. For example, a 128-bit modular multiplier only needs a 1K-bit ROM, which is reasonable for a RNS channel modular multiplier.

Figure 5 shows an example of the new algorithm for the case 𝑟=2, 𝑛=4, 𝐴=15=(1111)₂, 𝐵=11=(1011)₂, and 𝑀=9=(1001)₂. It is noted that at the last step, a second LUT of the same size is needed. Also, because the output 𝐶 from the 4-bit CPA is at most 5 bits long, the final subtraction might not be necessary if a 𝑛+1-bit 𝐶 is acceptable, as the case in quite a few other algorithms. Even if a 4-bit 𝐶 is required, only one subtraction will do.

Figure 5 

An example for the new algorithm 𝑛=4, 𝐴=(1111)2, 𝐵=(1011)2, and 𝑀=(1001)2.

4.4. Higher Radix

High radix is another popular technique that has been adopted by other algorithms [17, 24]. It also contributes to the new sum of residues algorithm. A radix-𝑟 version of the algorithm can be produced as in Figure 6. If 𝑟=2^𝑘, this version executes in 𝑛/𝑘 iterations; however, a larger LUT and (𝑛+𝑘)-bit CSAs are required.

Figure 6 

New higher-radix sum of residues modular multiplier architecture.

5. Evaluation

5.1. Evaluation Environment

FPGA implementations have been prepared. A Xilinx Virtex2 FPGA was used as the implementation target. All the implementations have been performed using the Xilinx ISE environment using XST for synthesis and ISE standard tools for place and route with standard effort for all speed optimizations (see Table 2).

Pure delays of the combinatorial circuit were measured excluding those between pads and pins. They were generated from the post-place and route static timing analyzer with a standard place and route effort level.

5.2. Results

Implementation results are listed in Table 1 for 𝑛=4 to 𝑛=24 at radix-2, the most popular word lengths of RNS channel modular multipliers [6, 9, 32]. The table includes results for the old architecture based on Tomlinson's algorithm (Figure 1) as well as for a carefully optimized Montgomery architecture.

Table 1 

Latency and space overhead of three interleaved modular multipliers.

Table 2 

The Montgomery architecture have incorporated various published techniques for optimization. For example, the techniques in [3, 23] have been applied to improve performance by making the quotient digit selection step trivial and moving it from the critical path. The cost of these techniques is that they impose limits on the possible values of the modulus 𝑀 which may impact on other enhancements such as the use of higher radices. Consequently, the Montgomery architecture is interleaved, uses radix 2 and trivial quotient digit selection (as in [3, 33] described in Section 3) and was arrived at by varying these parameters to find the multiplier with lowest delay.

These multipliers are compared with the new binary sum of residues architecture of Figure 4. It can be seen that the new sum of residues modular multiplier is a competitive alternative implementation on FPGA. It demonstrates better timing performance than both Tomlinson's architecture and the Montgomery architecture although its hardware cost is the highest among the three.

6. Conclusions and Future Work

Sum of residues is a distinct class of modular multiplication that has been overlooked in recent years. We have shown that techniques pioneered for other modular multiplication algorithms, such as the use of redundant representations and higher radices, can also be applied to sum of residues. By doing this, we have arrived at a new sum of residues modular multiplier that uses carry-save adders and redundant number representation to achieve a more parallel structure than previous versions. FPGA implementations of the new architecture demonstrate low latency relative to previous sum of residues and Montgomery architectures at the cost of increased space overhead.

Future work will be focused on reducing the space overhead. More advanced programmable logic devices will be attempted to utilize hardware resources more efficiently. ASIC design will be investigated, where a lot of the hardware redundancy expects to be reduced. For example, our new CSA shown in Figure 3 accepts one extra bit input without extra hardware resources needed. However, this benefit is hard to see in the FPGA implementation because splitting bits is impossible in the used configurable logic blocks (CLB) embedded on the FPGA. Nor do the embedded 18-bit multipliers. However, this gets easily illustrated in an ASIC implementation. Therefore, the new sum of residues modular multiplication algorithm is expected to be suitable for an ASIC application.