US20050246406A9 - Emod a fast modulus calculation for computer systems - Google Patents
Emod a fast modulus calculation for computer systems Download PDFInfo
- Publication number
- US20050246406A9 US20050246406A9 US10/140,885 US14088502A US2005246406A9 US 20050246406 A9 US20050246406 A9 US 20050246406A9 US 14088502 A US14088502 A US 14088502A US 2005246406 A9 US2005246406 A9 US 2005246406A9
- Authority
- US
- United States
- Prior art keywords
- modulus
- emod
- value
- mod
- result
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
- G06F7/60—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers
- G06F7/72—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers using residue arithmetic
- G06F7/722—Modular multiplication
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
- G06F7/60—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers
- G06F7/72—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers using residue arithmetic
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2207/00—Indexing scheme relating to methods or arrangements for processing data by operating upon the order or content of the data handled
- G06F2207/72—Indexing scheme relating to groups G06F7/72 - G06F7/729
- G06F2207/7276—Additional details of aspects covered by group G06F7/723
- G06F2207/728—Additional details of aspects covered by group G06F7/723 using repeated square-and-multiply, i.e. right-to-left binary exponentiation
Definitions
- the present invention relates to modulus calculations.
- it relates to modulus calculations that may be performed with high degrees of efficiency.
- a modulus calculation determines the remainder of a division operation.
- the expression A mod N determines a result that is the remainder obtained by dividing the number A by N.
- Example: 17 divided by 3 is 5 with a remainder of 2.
- “17 mod 3” yields a result having value 2.
- Mod calculations are performed in many computing applications including key negotiation conducted between two parties before engaging in encrypted communication.
- evaluation of equations having the form (A B ) mod n is performed at two terminals.
- the A and B values may be quite large—from 1024 to 2048 bits long.
- the result may have a length of up to 2l.
- multiplication results are generated, they typically are truncated by applying the mod calculation to each product. Because the mod calculation divides each product by a modulus having its own length (say, j), the result always has a length less than j.
- FIG. 1 illustrates a method according to an embodiment of the present invention.
- FIG. 2 illustrates a method according to an embodiment of the present invention.
- FIG. 3 illustrates another method according to an embodiment of the present invention.
- FIG. 4 is a block diagram illustrating an interstitial product generator according to an embodiment of the present invention.
- FIG. 5 is a block diagram illustrating an IPG according to an alternate embodiment of the present invention.
- FIG. 6 illustrates a multiplier according to an embodiment of the present invention.
- FIG. 7 illustrates a multiplier circuit according to an embodiment of the present invention.
- FIG. 8 illustrates a multiplier circuit according to another embodiment of the present invention.
- FIG. 9 illustrates a multiplier circuit according to an embodiment of the present invention.
- FIG. 10 illustrates a multiplier circuit according to another embodiment of the present invention.
- FIG. 11 illustrates another method according to an embodiment of the present invention.
- Embodiments of the present invention introduce an “emod” operation for use in mod calculations.
- the emod is a computational substitute for a traditional mod operation, one that is computationally less expensive but also less precise.
- the emod operation may be used in connection with interstitial multiplications that may be generated during evaluation of an A B mod n calculation or an (A ⁇ B) mod n calculation.
- a B mod n calculation of an A B mod n
- (A ⁇ B) mod n calculation an (A ⁇ B) mod n calculation.
- a traditional mod operation may be performed to obtain a final result.
- the embodiments of the present invention avoid the computational expense of perhaps thousands of mod operations that might otherwise be performed at interstitial stages of operation.
- the example illustrated above also works in a binary scheme.
- n a multiple is chosen that closely approximates some 2 k for some arbitrary k.
- the decimal example above included a consecutive series of 9s in the most significant bit positions
- the binary example the phantom modulus will include a consecutive series of 1s in the most significant bit positions. This property simplifies the subtraction that takes place when reducing the operand A by the phantom modulus.
- FIG. 1 illustrates a method 1000 according to an embodiment of the present invention.
- a variable c may be initialized to be zero (box 1010 ).
- the method 1000 iteratively may consider each word of the multiplicand B, starting with the word corresponding to the most significant bit position of B and working toward the word corresponding to the least significant bit position.
- the method 1000 may shift left the c value from a prior iteration by the length of a word (box 1020 ).
- the value of A multiplied by the new B word (labeled, “B[i]”) may be added to the shifted value of c (box 1030 ).
- the emod operation may be performed on the result obtained from box 1030 (box 1040 ).
- the result of the emod may be used as the initial value c of a subsequent iteration.
- the c value obtained is the result of the calculation.
- the method of FIG. 1 may be implemented in software according to the following pseudocode.
- shiftleft(w,c) merely shifts left the c operand by w bits. This is equivalent to a multiplication by 2 w in binary.
- FIG. 2 illustrates a method 1100 according to an embodiment of the present invention.
- a dummy variable c may be initialized to be zero (box 1110 ).
- the method iteratively may consider each word of the multiplicand B, starting with the word corresponding to the most significant bit position of B and working to the word corresponding to the least significant bit position.
- the method may calculate a quotient value q and a remainder value r from the value c obtained from a prior iteration (boxes 1120 , 1130 ).
- the quotient q may be taken as a span of bits from c extending from the most significant bit position to the k th bit position, shifted left by w bits.
- the method of FIG. 2 may be implemented in software according to the following pseudocode.
- the method may complete a current iteration without having the d ⁇ q product available. Instead, it may advance to the next iteration of i and integrate the d ⁇ q product from a previous iteration.
- FIG. 3 illustrates this embodiment.
- FIG. 3 illustrates a method 1200 according to an embodiment of the present invention.
- a variable c may be initialized to be zero (box 1210 ).
- the method iteratively may consider each word of the multiplicand B, starting with the word corresponding to the most significant bit position of B and working to the word corresponding to the least significant bit position.
- the method 1200 may calculate a quotient value q[i] and a remainder value r[i] from the value c obtained from a prior iteration (boxes 1120 , 1130 ).
- the quotient q[i] may be taken as a span of bits from c extending from the most significant bit position to the k th bit position, shifted left by w bits.
- the remainder r[i] may be taken as the remaining bits of c, extending from the k ⁇ 1 th bit position to the least significant bit position, shifted left by w bits.
- the quotient from the final iteration may be added to c (box 1260 ).
- the value obtained from this operation may be taken as the result from the emod operation.
- the method of FIG. 3 may be implemented in software according to the following pseudocode.
- the d ⁇ q product from a prior iteration (relabeled as d ⁇ q1) is shifted left to account for positional differences between the two words.
- FIG. 3 need not be stalled while waiting for evaluation of a d ⁇ q operation.
- This embodiment may find application in a high-load application where avoidance of computational latencies may be at a premium.
- FIG. 4 is a block diagram illustrating an interstitial product generator (“IPG”) 100 according to an embodiment of the present invention.
- the IPG 100 generates an interstitial product from a multiplicand A. It may include a multiplicand register (called, an “A register” herein) 110 , a pair of shifters 120 , 130 (labeled “shift 1” and “shift 2 respectively) and a “3A” register” 140 .
- the A and 3A registers are illustrated in phantom because they may (but need not) be placed within the IPG 100 itself; alternatively, they may be provided in some other circuit but their contents may be provided as an input to the IPG 100 .
- the IPG 100 also may include a pair of multiplexers (colloquially, “MUXes”) 150 , 160 and an inverter 170 .
- MUXes multiplexers
- the shifters 120 , 130 each present values representing the value stored in the A register shifted by a predetermined number of bit positions.
- the first shifter 120 may present an A value shifted one bit position toward the most significant bit position. It is labeled “shift 1.”
- the second shifter 130 may present the A value having been shifted two bit positions toward the most significant bit position, labeled “shift 2.”
- shift 1. A value shifted one bit position toward the most significant bit position
- shift 2. In binary data systems, a single or double bit shift causes a two-fold or four-fold multiplication of a source data value respectively.
- the shifters 120 , 130 may be provided as any number of embodiments. Perhaps the simplest embodiment is to provide a shifter as a wired interconnection between the A register 110 and the MUX 150 . For example, each bit position i in the A register 110 may be connected to a position i+1 of the MUX 150 to constitute the “shift 1” shifter 120 . Similarly, each bit position i in the A register may be connected to a position i+2 of the MUX 150 to satisfy the “shift 2” shifter 130 . The least significant bit position of the shift 1 shifter may be grounded. The two least significant bit position of the shift 2 shift inputs to the MUX 150 also may be grounded. This architecture provides the desired shift functions with the least implementation cost in terms of area or control hierarchy.
- the shifters 120 , 130 could be provisioned as formal shift registers complete with storage cells (not shown) for storage of shifted values. Although there is no performance advantage for this alternative, it may find use in applications where such shift registers are employed for other purposes.
- the 3A register 140 is a register to store a value representing three times the value in the A register.
- the values stored in this register may be obtain from a straightforward addition of the values from the A register 110 and the shift 1 register 120 or, alternatively, from a subtraction of the values in the shift 1 register 120 from the value in the shift 2 register 140 . Circuitry to implement these functions is straightforward and omitted from the illustration of FIG. 1 to keep the illustration simple.
- the 3A register 140 also may be provided in a location external to the IPG 100 ; it is illustrated in phantom accordingly.
- Outputs from the A register 110 , the two shifters 120 and 130 and the 3A register 140 may be input to the first MUX 150 .
- An output from the first MUX 150 may be input to both the second MUX 160 and the inverter 170 .
- An output from the inverter 170 may be provided as a second input to the second MUX 160 .
- the inverter 170 may generate a two's complement inversion of the multibit output from the first MUX 150 .
- the second MUX 160 may have a third input coupled directly to a zero value “ ⁇ .” Alternatively, the zero value could be input to the first MUX 150 .
- the IPG 100 may generate any of the following outputs: A, ⁇ overscore (A) ⁇ , 2A, ⁇ overscore (2A) ⁇ 3A, ⁇ overscore (3A) ⁇ , 4A, 4 ⁇ overscore (A) ⁇ and ⁇ .
- the IPG 100 may include a controller 180 that governs operation of the two MUXes 150 , 160 .
- the controller 180 may generate a control signal (labeled c i ) that causes the MUXes 150 , 160 to output a selected one of the possible outputs on each cycle of a driving clock (not shown).
- FIG. 5 is a block diagram illustrating an IPG 200 according to an alternate embodiment of the present invention.
- the IPG 200 may include a plurality of inverters 210 , 220 , 230 - 1 , 230 - 2 , a 3 ⁇ multiplier 240 , a pair of shifters 250 - 1 , 250 - 2 and a multiplexer 260 .
- the IPG 200 is illustrated as connected to an external multiplicand register rather than including the multiplicand register as part of it.
- the multiplicand may be input to the IPG 200 on a first terminal 270 thereof.
- One of the inverters 210 may be coupled to the first terminal 270 , to invert a multiplicand when presented.
- the 3 ⁇ multiplier may generate a value that is three times a multiplicand when presented at the input terminal.
- a second inverter 220 may be coupled to the 3 ⁇ multiplier 240 to invert the output thereof.
- the shifters 250 - 1 , 250 - 2 provided shifted versions of the multiplicand as in the embodiment of FIG. 2 .
- One of them (say, shifter 250 - 1 ) shifts the input multiplicand by a single bit position; the other 250 - 2 shifts the multiplicand by two bit positions.
- Inverters 230 - 1 , 230 - 2 from the respective shifters 250 - 1 , 250 - 2 may generated inverted shifted values of the multiplicand.
- the shifters 250 - 1 , 250 - 2 may be provided according to any of the embodiments described above.
- Outputs from the inverters 210 , 220 , 230 - 1 , 230 - 1 , the 3 ⁇ multiplier 240 and the shifters 250 - 1 , 250 - 2 may be input to the multiplexer 260 .
- the multiplexer 260 also may be controlled to output none of the inputs from the IPG 200 . In this condition, the multiplexer 260 causes the IPG 200 to generate a zero output therefrom.
- the multiplicand A when it is desired to perform a multiplication based on a long multiplicand A and a shorter multiplier B, the multiplicand A may be input to the IPG 200 .
- Values of A, 3A, ⁇ overscore (A) ⁇ and ⁇ overscore (3A) ⁇ will be available to the multiplexer 260 after a short initialization period.
- shifted values of A and ⁇ overscore (A) ⁇ also will be available to the multiplexer 260 . Once these values are available, they may be retrieved from the IPG and forwarded to a remainder of a multiplication circuit (not shown in FIG. 5 ) based on values of multiplier segments.
- the IPG may include a controller 290 responsive to these multiplier segments to cause the multiplexer 260 to retrieve one of the previously stored values from within the IPG.
- controller 290 may be integrated into these known controllers or may be provided as a separate element as may be desired.
- FIG. 5 illustrates the controller 290 as being separate from the IPG 200 for convenience only.
- the multiplier B may be parsed into several four bit segments s i .
- Each segment s i includes the bits B 3i+2 -B 3i ⁇ 1 from the multiplier B. From these segments, a control signal CTRL may be generated to determine which value from within the IPG should be output from the multiplexer.
- the IPG may generate outputs according to the scheme shown in Table 1 below.
- the zero th bit position which would be a fictional bit position “B ⁇ 1 ,” may be set to 0 to render the response of the controller to segment s 0 consistent with Table 1.
- a multiplier B will not fill all segments completely unless the length of the multiplier is a multiple of 3.
- the length of the multiplier when the length of the multiplier is not a multiple of 3, it may be sign extended in sufficient length to fill an otherwise unused portion of the last segment. This typically involves copying the sign bit, the most significant bit B MSB , to fill fictional bit positions beyond the most significant bit.
- IPG embodiments described above may be applied to multiplier circuits of a variety of architectures.
- use of an IPG permits the multiplier circuit to achieve faster operation essentially by permitting additions to occur once every three bit positions rather than once per bit position as is conventional.
- FIG. 7 is a diagram of an application of an IPG in a combinatorial multiplier 300 according to an embodiment of the present invention.
- the combinatorial multiplier 300 may include first and second registers 310 for storage of a multiplicand A and a multiplier B respectively. It may include an IPG 330 , a controller 340 , a plurality of interstitial product registers 350 . 1 - 350 .L, an adder tree 360 a product register 370 .
- the IPG 330 may be initialized to create the values A, ⁇ overscore (A) ⁇ , 3A and ⁇ overscore (3A) ⁇ and shifted values of A and ⁇ overscore (A) ⁇ .
- the controller 340 may parse the multiplier B into segments and, responsive to the bit pattern in each segment, cause the IPG 330 to load one of the values into a corresponding interstitial product (say, 350 . 1 ).
- the number of interstitial products 350 . 1 - 350 .L may be based upon the number of segments supported by the multiplier B.
- the number of interstitial products 350 . 1 - 350 .L may be tied to the length of the multiplier register 320 .
- the combinatorial multiplier 300 may cause a final product to be stored in the product register 370 by summing across all the interstitial product registers 350 . 1 - 350 .L.
- An adder tree 360 accepts the interstitial product values from each product registers and sums them in a manner that is cognizant of the respective bit offsets among the interstitial product registers. Adder trees are well known per se and may be modified for this purpose.
- the product register 370 may have a length n+m just as in the traditional combinatorial multiplier.
- Interstitial product registers 350 . 1 - 350 .L may have a length m+2 whereas in traditional combinatorial multipliers, they would have a length m.
- Traditional combinatorial multipliers include one interstitial product register for each bit position of a multiplier B.
- the adder tree include one-third the number of adders to compute the final summation. Products are expected to be generated faster in the present embodiment because the final addition is carried out across fewer interstitial values and, therefore, is available more quickly. This embodiment, therefore, yields higher throughput with less logic.
- FIG. 8 is a block diagram of an application of an IPG integrated with a shift-add multiplier circuit 400 according to an embodiment of the present invention.
- the multiplier circuit 400 may include a pair of registers 410 , 420 for storage of the multiplicand A and the multiplier B.
- the shift-add multiplier circuit 400 also may include an IPG 430 , a controller, a carry save adder 450 and a product register 460 .
- the multiplier circuit 400 may be initialized.
- the product register 460 may be cleared to zero and the interstitial product generator 430 may be initialized with the value of the multiplicand A.
- the controller 440 may shift each segment out of the multiplier register 420 and, responsive to the new segment, may cause a selected value to be output from the IPG 430 to a first input of the carry save adder 450 .
- the most significant bits from the product register 460 may be shifted 3 places and input to a second input of the carry save adder.
- the carry save adder 450 may add the values presented on each of its two inputs together and write the value back to the product register 460 . This process may repeat in an incremental fashion for as many segments as are supported by the multiplier B.
- the embodiment of FIG. 8 provides for improved performance over traditional shift-add multiplier circuits.
- the traditional circuits perform an addition for each bit position of a multiplier B.
- the embodiment shown in FIG. 8 provides an addition only once for every three bit positions of the multiplier B. Again, a fewer number of additions permit the shift-add multiplier of FIG. 8 to generate multiplication products in a shorter amount of time than would be available from traditional circuits.
- a multiplier circuit may omit use of a multiplier register (such as the multiplier 420 of FIG. 8 ).
- FIG. 9 illustrates a multiplier 500 populated by a multiplicand register 510 , an IPG 520 , a controller 530 , a carry save adder 540 and a product register 550 .
- a multiplicand value (A) may be input to the IPG 520 as an initialization step.
- a multiplier value (B) may be loaded into the least significant bit positions of the product register 550 .
- the contents of the product register 550 may be downshifted by three bit positions.
- the controller 530 may cause the IPG 520 to generate an output as shown above in Table 1.
- the IPG output may be provided to a first input of the carry save adder 540 .
- the downshifted value from the product register 550 may be provided to a second input of the carry save adder 540 .
- the carry save adder 540 may add the two input values and store them to the product register in the most significant bit positions.
- FIG. 10 illustrates a multiplication circuit 600 according to another embodiment of the present invention.
- the multiplier 600 may include a pair of IPGs 610 , 620 .
- a first IPG 610 may evaluate the A ⁇ B[i] term of equation of equation 7
- the second IPG 620 may evaluate the d ⁇ q[i ⁇ 1] term.
- the first IPG 610 may accept as inputs values of A and 3A from respective registers 630 , 640 .
- the first IPG 610 may be controlled by a controller 650 which in turn may be controlled by the respective word of B (input not shown).
- the second IPG 620 may accept values of d and 3d from respective sources 660 , 670 .
- the second IPG 620 may be controlled by a q value 680 .
- the multiplication circuit 600 may include a carry save adder 690 that accepts, as inputs, outputs from the two IPGs 610 , 620 and a result value from a product register 700 .
- An output of the carry save adder 690 may be input to the product register 700 .
- the product register 700 may be provided as a shift register to implement the shifts described in connection with FIG. 3 .
- a span of bits from the least significant bit positions may output to the carry save adder 690 as the r[i] value.
- Carry save adders generates a result in the so-called “redundant form.”
- Carry save adders are faster than other types of adders because they generate results of addition operations without performing a traditional carry propagation (a time consuming operation). Instead, the addition results are stored using multiple bits per “bit position.” Multiple additions can be performed in redundant form. After a final addition, a single carry propagation may be performed to obtain a result in non-redundant form.
- a portion of the product register 700 corresponding to the quotient q may be input to a second adder 710 such as a carry lookahead adder.
- the second adder 710 may generate a non-redundant result which may be fed back to the second IPG 610 as the q value.
- Embodiments of the emod operation are described below in the context of an A B mod n calculation. Resolution of the calculation may proceed as a nested loop process, constituting an outer loop and an inner loop.
- the outer loop may scan the bits of the exponent and to control the multiplications.
- FIG. 11 illustrates another method 1300 according to an embodiment of the present invention.
- a dummy variable c may be initialized to be zero (box 1210 ).
- the method iteratively considers each bit i of the exponent B.
- the method may evaluate equation 9 using an inner loop (box 1320 ).
- the method 1300 may determine whether the i th bit of the exponent B (B[i]) is 1. If so, the method 1300 may evaluate equation 10 using an inner loop (box 1330 ). When the operation of box 1330 concludes or if the ith bit was not a 1, the operation may advance to a next successive iteration.
- the method 1300 may invoke a traditional mod operation upon the value c (box 1340 ). This result obtains the result of A B mod n.
- the inner loop of the operation may be performed using any of the methods described hereinabove with respect to FIGS. 1-3 .
- both cases may be implemented using the same hardware. There need be no special handling to accommodate the squaring case.
- the operands c and mn are of the same size and a is somewhat smaller.
- the number of significant bits in n, size(n), may be determined so that: 2 size(n) ⁇ 1 ⁇ n ⁇ 2 size(n) .
- the parameter mn when viewed in binary format, has a number of leading 1s equaling or exceeding the precision value.
- u i+1 ( u i (2 k+1 ⁇ u i ⁇ n ))/2 k .
- the calculation of (2 k+1 ⁇ u i ⁇ n) where (u i ⁇ n) ⁇ 2 k+1 can be done simply by setting the leading ones of the negative number ⁇ (u i ⁇ n) to zero from position (k+1) and up. That is equivalent to keeping the bits from position k down to 0.
- the calculation of m and d may be implemented in software according to the following pseudocode.
- the embodiments presented hereinabove provide a computational substitute for a mod operation, labeled “emod,” that incurs much less computational expense at the cost of lost precision. It is useful when performing a mod operation in connection with multiplications or exponential operations.
- emod a computational substitute for a mod operation
- the length operands may be maintained to be within some predetermined length window.
- a traditional mod operation may be applied to obtain a final result. This scheme obtains a final result with much less processing than would be possible using only the mod operation.
Abstract
An emod operation is a computational substitute for a traditional modulus operation, one that is computationally less expensive but also less precise. Where a modulus operation may be defined for some base number n, the emod operation determines a modulus of an operand using a “phantom modulus,” one that is an integer multiple of n. The phantom modulus is chosen to make emod calculations computationally inexpensive when compared to a modulus operation. Thus, the emod operation is particularly useful for multiplications or exponential operations using very large operands. Upon conclusion of interstitial processing associated with the multiplications or exponential operations, a single, traditional modulus operation may be used to obtain a final result.
Description
- The present invention relates to modulus calculations. In particular, it relates to modulus calculations that may be performed with high degrees of efficiency.
- A modulus calculation (colloquially, a “mod” calculation) determines the remainder of a division operation. Thus, the expression A mod N determines a result that is the remainder obtained by dividing the number A by N. Example: 17 divided by 3 is 5 with a remainder of 2. “17 mod 3” yields a
result having value 2. - Mod calculations are performed in many computing applications including key negotiation conducted between two parties before engaging in encrypted communication. In the key negotiation context, evaluation of equations having the form (AB) mod n is performed at two terminals. Often, the A and B values may be quite large—from 1024 to 2048 bits long. Of course, when two operands having length l are multiplied, the result may have a length of up to 2l. With such large operands, it is impractical to build result registers in a processor that have the full width of the multiplication result. Instead, as multiplication results are generated, they typically are truncated by applying the mod calculation to each product. Because the mod calculation divides each product by a modulus having its own length (say, j), the result always has a length less than j.
- Assuming operands of length l and an equal number of 0s and 1s therein, evaluation of AB mod n may require l multiplications and l mod operations. This involves considerable computational expense. The expense associated with such computations becomes particularly severe in high-load environments such as computer servers where it can be expected that several thousand key negotiation requests (maybe more) would be received per hour.
- Accordingly, there is a need in the art for a fast, computationally inexpensive technique for resolving mod operations with large operands.
-
FIG. 1 illustrates a method according to an embodiment of the present invention. -
FIG. 2 illustrates a method according to an embodiment of the present invention. -
FIG. 3 illustrates another method according to an embodiment of the present invention. -
FIG. 4 is a block diagram illustrating an interstitial product generator according to an embodiment of the present invention. -
FIG. 5 is a block diagram illustrating an IPG according to an alternate embodiment of the present invention. -
FIG. 6 illustrates a multiplier according to an embodiment of the present invention. -
FIG. 7 illustrates a multiplier circuit according to an embodiment of the present invention. -
FIG. 8 illustrates a multiplier circuit according to another embodiment of the present invention. -
FIG. 9 illustrates a multiplier circuit according to an embodiment of the present invention. -
FIG. 10 illustrates a multiplier circuit according to another embodiment of the present invention. -
FIG. 11 illustrates another method according to an embodiment of the present invention. - Embodiments of the present invention introduce an “emod” operation for use in mod calculations. The emod is a computational substitute for a traditional mod operation, one that is computationally less expensive but also less precise. The emod operation may be used in connection with interstitial multiplications that may be generated during evaluation of an AB mod n calculation or an (A·B) mod n calculation. At the end, when a final product is available, a traditional mod operation may be performed to obtain a final result. In this way, the embodiments of the present invention avoid the computational expense of perhaps thousands of mod operations that might otherwise be performed at interstitial stages of operation.
- Although computers perform arithmetic operations having binary values (base 2), the advantages of the emod operation might best be understood with an example using traditional decimal numbers (base 10). To evaluate the operation 23754 mod 3331, it would be conventional to divide 23754 by the modulus 3331 to obtain the remainder 437. However, such division is computationally expensive. It would be far easier to use some multiple of the modulus that is closer to 10k for some arbitrary number k. Using such a multiplier (say 9993 instead of 3331), one may employ a series of subtractions instead of a division operation. After twice subtracting 9993 from 23754, one is left with a residual of 3768 (which includes the correct remainder 437 plus 3331). This residual is sufficient for use with the interstitial products obtained at intermediate stage of computation. When a final result is obtained and a true mod operation is employed, the correct remainder will be isolated from any multiples of the modulus that may have been carried over from the intermediate stages. Use of this “phantom modulus,” however, improves processing speed.
- The example illustrated above also works in a binary scheme. In the
base 2 domain, for some modulus n, a multiple is chosen that closely approximates some 2k for some arbitrary k. Just as the decimal example above included a consecutive series of 9s in the most significant bit positions, in the binary example, the phantom modulus will include a consecutive series of 1s in the most significant bit positions. This property simplifies the subtraction that takes place when reducing the operand A by the phantom modulus. - Given a modulus n, a phantom modulus mn may be chosen such that m·n=2k−d, where d<n. Then the emod operation may be employed as a recursive subtraction in which mn is subtracted from the source operand until the residual is less than mn. These two parameters, d and m, control the emod operation.
- Evaluation of (A·B) emod n
- According to an embodiment, evaluation of:
c=(A·B)emod n (1)
may be performed by parsing the operand B into multiple words of w bits each. Thus:
Equation 1, then becomes:
The emod operation is distributive and may be replicated within the parenthetical. This property leads to the method illustrated inFIG. 1 . -
FIG. 1 illustrates amethod 1000 according to an embodiment of the present invention. According to themethod 1000, a variable c may be initialized to be zero (box 1010). Thereafter, themethod 1000 iteratively may consider each word of the multiplicand B, starting with the word corresponding to the most significant bit position of B and working toward the word corresponding to the least significant bit position. During each iteration, themethod 1000 may shift left the c value from a prior iteration by the length of a word (box 1020). The value of A multiplied by the new B word (labeled, “B[i]”) may be added to the shifted value of c (box 1030). Thereafter, the emod operation may be performed on the result obtained from box 1030 (box 1040). The result of the emod may be used as the initial value c of a subsequent iteration. Following the last iteration, the c value obtained is the result of the calculation. - In one embodiment, the method of
FIG. 1 may be implemented in software according to the following pseudocode. - Where shiftleft(w,c) merely shifts left the c operand by w bits. This is equivalent to a multiplication by 2w in binary.
- The emod operator operates based on a phantom modulus mn=m·n, yielding a precision factor d=2k−mn. If the operand c were split into two parts, a quotient q and a remainder r, so that:
c=q·2k +r (4)
then the emod operation may be defined as:
This emod function may be integrated into the method ofFIG. 1 as shown in the embodiment ofFIG. 2 . -
FIG. 2 illustrates amethod 1100 according to an embodiment of the present invention. According to themethod 1100, a dummy variable c may be initialized to be zero (box 1110). Thereafter, the method iteratively may consider each word of the multiplicand B, starting with the word corresponding to the most significant bit position of B and working to the word corresponding to the least significant bit position. The method may calculate a quotient value q and a remainder value r from the value c obtained from a prior iteration (boxes 1120, 1130). The quotient q may be taken as a span of bits from c extending from the most significant bit position to the kth bit position, shifted left by w bits. The remainder r may be taken as the remaining bits of c, extending from the k−1th bit position to the 0th bit position, shifted left by w bits. Thereafter, the c value may be evaluated as:
c=A·B[i]+r+d·q (6)
(box 1140). The c value obtained at the last iteration may be taken as the result of the emod function. - In one embodiment, the method of
FIG. 2 may be implemented in software according to the following pseudocode. - This implementation requires that the product d·q is available immediately. In practice, since this product may take some time to generate, the method effectively becomes stalled until the product becomes available.
- In an alternate embodiment, the method may complete a current iteration without having the d·q product available. Instead, it may advance to the next iteration of i and integrate the d·q product from a previous iteration.
FIG. 3 illustrates this embodiment. -
FIG. 3 illustrates amethod 1200 according to an embodiment of the present invention. According to themethod 1200, a variable c may be initialized to be zero (box 1210). Thereafter, the method iteratively may consider each word of the multiplicand B, starting with the word corresponding to the most significant bit position of B and working to the word corresponding to the least significant bit position. At each iteration, themethod 1200 may calculate a quotient value q[i] and a remainder value r[i] from the value c obtained from a prior iteration (boxes 1120, 1130). The quotient q[i] may be taken as a span of bits from c extending from the most significant bit position to the kth bit position, shifted left by w bits. The remainder r[i] may be taken as the remaining bits of c, extending from the k−1th bit position to the least significant bit position, shifted left by w bits. The quotient q[i−1], obtained from a prior iteration, also may be shifted left by w bits (box 1240). Thereafter, the c value may be evaluated as:
c=A·B[i]+r[i]+d q[i−1], (7)
where the q[i−1] value is the shifted value obtained in box 1240 (box 1250). - Following the final iteration, the quotient from the final iteration may be added to c (box 1260). The value obtained from this operation may be taken as the result from the emod operation.
- In one embodiment, the method of
FIG. 3 may be implemented in software according to the following pseudocode. - In this embodiment, the d·q product from a prior iteration (relabeled as d·q1) is shifted left to account for positional differences between the two words.
- As noted above, the embodiment of
FIG. 3 need not be stalled while waiting for evaluation of a d·q operation. This embodiment may find application in a high-load application where avoidance of computational latencies may be at a premium. - Multiplication of Large Numbers with Small Numbers
- As described above, the multiplicand B may be parsed into a plurality of smaller words B[w], w=0 to M−1, and the words may be used as a basis on which to perform the multiplication with the multiplier A. A discussion of a circuit implementation for this embodiment follows.
-
FIG. 4 is a block diagram illustrating an interstitial product generator (“IPG”) 100 according to an embodiment of the present invention. TheIPG 100 generates an interstitial product from a multiplicand A. It may include a multiplicand register (called, an “A register” herein) 110, a pair ofshifters 120, 130 (labeled “shift 1” and “shift 2 respectively) and a “3A” register” 140. The A and 3A registers are illustrated in phantom because they may (but need not) be placed within theIPG 100 itself; alternatively, they may be provided in some other circuit but their contents may be provided as an input to theIPG 100. TheIPG 100 also may include a pair of multiplexers (colloquially, “MUXes”) 150, 160 and aninverter 170. - The
shifters first shifter 120 may present an A value shifted one bit position toward the most significant bit position. It is labeled “shift 1.” Thesecond shifter 130 may present the A value having been shifted two bit positions toward the most significant bit position, labeled “shift 2.” In binary data systems, a single or double bit shift causes a two-fold or four-fold multiplication of a source data value respectively. - The
shifters A register 110 and theMUX 150. For example, each bit position i in theA register 110 may be connected to a position i+1 of theMUX 150 to constitute the “shift 1”shifter 120. Similarly, each bit position i in the A register may be connected to a position i+2 of theMUX 150 to satisfy the “shift 2”shifter 130. The least significant bit position of theshift 1 shifter may be grounded. The two least significant bit position of theshift 2 shift inputs to theMUX 150 also may be grounded. This architecture provides the desired shift functions with the least implementation cost in terms of area or control hierarchy. - Alternatively, the
shifters - The
3A register 140, as its name implies, is a register to store a value representing three times the value in the A register. The values stored in this register may be obtain from a straightforward addition of the values from theA register 110 and theshift 1register 120 or, alternatively, from a subtraction of the values in theshift 1register 120 from the value in theshift 2register 140. Circuitry to implement these functions is straightforward and omitted from the illustration ofFIG. 1 to keep the illustration simple. In an embodiment, the 3A register 140 also may be provided in a location external to theIPG 100; it is illustrated in phantom accordingly. - Outputs from the
A register 110, the twoshifters first MUX 150. An output from thefirst MUX 150 may be input to both the second MUX 160 and theinverter 170. An output from theinverter 170 may be provided as a second input to the second MUX 160. Theinverter 170 may generate a two's complement inversion of the multibit output from thefirst MUX 150. The second MUX 160 may have a third input coupled directly to a zero value “∅.” Alternatively, the zero value could be input to thefirst MUX 150. Thus, given an input value A, theIPG 100 may generate any of the following outputs: A, {overscore (A)}, 2A, {overscore (2A)} 3A, {overscore (3A)}, 4A, 4{overscore (A)} and ∅. - The
IPG 100 may include acontroller 180 that governs operation of the twoMUXes 150, 160. As discussed below, given an input “segment,” thecontroller 180 may generate a control signal (labeled ci) that causes theMUXes 150, 160 to output a selected one of the possible outputs on each cycle of a driving clock (not shown). -
FIG. 5 is a block diagram illustrating anIPG 200 according to an alternate embodiment of the present invention. According to an embodiment, theIPG 200 may include a plurality ofinverters 210, 220, 230-1, 230-2, a 3×multiplier 240, a pair of shifters 250-1, 250-2 and amultiplexer 260. In this embodiment, theIPG 200 is illustrated as connected to an external multiplicand register rather than including the multiplicand register as part of it. The multiplicand may be input to theIPG 200 on afirst terminal 270 thereof. One of the inverters 210 may be coupled to thefirst terminal 270, to invert a multiplicand when presented. - The 3× multiplier, as its name implies, may generate a value that is three times a multiplicand when presented at the input terminal. A
second inverter 220 may be coupled to the 3×multiplier 240 to invert the output thereof. - The shifters 250-1, 250-2 provided shifted versions of the multiplicand as in the embodiment of
FIG. 2 . One of them (say, shifter 250-1) shifts the input multiplicand by a single bit position; the other 250-2 shifts the multiplicand by two bit positions. Inverters 230-1, 230-2 from the respective shifters 250-1, 250-2 may generated inverted shifted values of the multiplicand. The shifters 250-1, 250-2 may be provided according to any of the embodiments described above. - Outputs from the
inverters 210, 220, 230-1, 230-1, the 3×multiplier 240 and the shifters 250-1, 250-2 may be input to themultiplexer 260. Themultiplexer 260 also may be controlled to output none of the inputs from theIPG 200. In this condition, themultiplexer 260 causes theIPG 200 to generate a zero output therefrom. - According to an embodiment, when it is desired to perform a multiplication based on a long multiplicand A and a shorter multiplier B, the multiplicand A may be input to the
IPG 200. Values of A, 3A, {overscore (A)} and {overscore (3A)} will be available to themultiplexer 260 after a short initialization period. Similarly, shifted values of A and {overscore (A)} also will be available to themultiplexer 260. Once these values are available, they may be retrieved from the IPG and forwarded to a remainder of a multiplication circuit (not shown inFIG. 5 ) based on values of multiplier segments. - The IPG may include a
controller 290 responsive to these multiplier segments to cause themultiplexer 260 to retrieve one of the previously stored values from within the IPG. As is known, many multiplication circuits include controllers for other purposes. Thecontroller 290 may be integrated into these known controllers or may be provided as a separate element as may be desired.FIG. 5 illustrates thecontroller 290 as being separate from theIPG 200 for convenience only. - In an embodiment, the multiplier B may be parsed into several four bit segments si. Each segment si includes the bits B3i+2-B3i−1 from the multiplier B. From these segments, a control signal CTRL may be generated to determine which value from within the IPG should be output from the multiplexer. In an embodiment, the IPG may generate outputs according to the scheme shown in Table 1 below.
TABLE 1 Input Pattern of Segment si CTRL Interstitial Product 0000 0 0 0001 1 A 0010 1 A 0011 2 A << 1 0100 2 A << 1 0101 3 3A 0110 3 3A 0111 4 A << 2 1000 −4 A >> 2 1001 −3 3A 1010 −3 3A 1011 −2 A << 1 1100 −2 A << 1 1101 −1 {overscore (A)} 1110 −1 {overscore (A)} 1111 0 0
Where {overscore (A)} is the two's complement of an input A. The control value CTRL may be related to the four bits input pattern by:
CTRL=−4s i3+2s i2 +s i1 +s i0 (8)
where sij represents the jth bit position of segment si. For the segment s0, the zeroth bit position, which would be a fictional bit position “B−1,” may be set to 0 to render the response of the controller to segment s0 consistent with Table 1. - It may be observed from
FIG. 6 that a multiplier B will not fill all segments completely unless the length of the multiplier is a multiple of 3. In an embodiment, when the length of the multiplier is not a multiple of 3, it may be sign extended in sufficient length to fill an otherwise unused portion of the last segment. This typically involves copying the sign bit, the most significant bit BMSB, to fill fictional bit positions beyond the most significant bit. - The IPG embodiments described above may be applied to multiplier circuits of a variety of architectures. In each application, use of an IPG permits the multiplier circuit to achieve faster operation essentially by permitting additions to occur once every three bit positions rather than once per bit position as is conventional.
-
FIG. 7 is a diagram of an application of an IPG in acombinatorial multiplier 300 according to an embodiment of the present invention. Thecombinatorial multiplier 300 may include first andsecond registers 310 for storage of a multiplicand A and a multiplier B respectively. It may include anIPG 330, acontroller 340, a plurality of interstitial product registers 350.1-350.L, an adder tree 360 aproduct register 370. - During operation, the
IPG 330 may be initialized to create the values A, {overscore (A)}, 3A and {overscore (3A)} and shifted values of A and {overscore (A)}. Thecontroller 340 may parse the multiplier B into segments and, responsive to the bit pattern in each segment, cause theIPG 330 to load one of the values into a corresponding interstitial product (say, 350.1). In an embodiment, the number of interstitial products 350.1-350.L may be based upon the number of segments supported by the multiplier B. Thus, the number of interstitial products 350.1-350.L may be tied to the length of themultiplier register 320. - Once values are loaded in each of the interstitial product registers 350.1-350.L, the
combinatorial multiplier 300 may cause a final product to be stored in theproduct register 370 by summing across all the interstitial product registers 350.1-350.L.An adder tree 360 accepts the interstitial product values from each product registers and sums them in a manner that is cognizant of the respective bit offsets among the interstitial product registers. Adder trees are well known per se and may be modified for this purpose. - In an embodiment for a multiplicand A of length m and a multiplier B of length n, the
product register 370 may have a length n+m just as in the traditional combinatorial multiplier. Interstitial product registers 350.1-350.L may have a length m+2 whereas in traditional combinatorial multipliers, they would have a length m. - Traditional combinatorial multipliers include one interstitial product register for each bit position of a multiplier B. In the foregoing embodiment, there need be only one interstitial product register (say, 350.1) for every three bit positions of the multiplier B. Thus, because the
combinatorial multiplier 300 of the foregoing embodiments include approximately one-third the number of interstitial registers than conventional counterparts, the adder tree include one-third the number of adders to compute the final summation. Products are expected to be generated faster in the present embodiment because the final addition is carried out across fewer interstitial values and, therefore, is available more quickly. This embodiment, therefore, yields higher throughput with less logic. -
FIG. 8 is a block diagram of an application of an IPG integrated with a shift-add multiplier circuit 400 according to an embodiment of the present invention. Themultiplier circuit 400 may include a pair ofregisters add multiplier circuit 400 also may include anIPG 430, a controller, acarry save adder 450 and aproduct register 460. - During operation, the
multiplier circuit 400 may be initialized. In this embodiment, theproduct register 460 may be cleared to zero and theinterstitial product generator 430 may be initialized with the value of the multiplicand A. Thereafter, during operation, thecontroller 440 may shift each segment out of themultiplier register 420 and, responsive to the new segment, may cause a selected value to be output from theIPG 430 to a first input of thecarry save adder 450. The most significant bits from theproduct register 460 may be shifted 3 places and input to a second input of the carry save adder. The carry saveadder 450 may add the values presented on each of its two inputs together and write the value back to theproduct register 460. This process may repeat in an incremental fashion for as many segments as are supported by the multiplier B. - As in the embodiment of
FIG. 4 , the embodiment ofFIG. 8 provides for improved performance over traditional shift-add multiplier circuits. The traditional circuits perform an addition for each bit position of a multiplier B. By contrast, the embodiment shown inFIG. 8 , provides an addition only once for every three bit positions of the multiplier B. Again, a fewer number of additions permit the shift-add multiplier ofFIG. 8 to generate multiplication products in a shorter amount of time than would be available from traditional circuits. - In another embodiment, a multiplier circuit may omit use of a multiplier register (such as the
multiplier 420 ofFIG. 8 ).FIG. 9 illustrates amultiplier 500 populated by amultiplicand register 510, anIPG 520, acontroller 530, acarry save adder 540 and aproduct register 550. A multiplicand value (A) may be input to theIPG 520 as an initialization step. Additionally, a multiplier value (B) may be loaded into the least significant bit positions of theproduct register 550. - On each clock cycle, the contents of the
product register 550 may be downshifted by three bit positions. When the least significant bits of the product register are shifted out of the product register, they may be input to thecontroller 530 as a new segment. In response to these three bits (and one bit from the shift of a prior clock cycle), thecontroller 530 may cause theIPG 520 to generate an output as shown above in Table 1. The IPG output may be provided to a first input of thecarry save adder 540. The downshifted value from theproduct register 550 may be provided to a second input of thecarry save adder 540. The carry saveadder 540 may add the two input values and store them to the product register in the most significant bit positions. Again, this embodiment provides improved performance over other shift-add multipliers that operate a single bit shift at a time. As compared to the embodiment ofFIG. 4 , this embodiment also provides better register utilization because the register 420 (FIG. 4 ) may be omitted. -
FIG. 10 illustrates amultiplication circuit 600 according to another embodiment of the present invention. This embodiment may be used to evaluate equation 7 above. In this embodiment, themultiplier 600 may include a pair ofIPGs first IPG 610 may evaluate the A·B[i] term of equation of equation 7, thesecond IPG 620 may evaluate the d·q[i−1] term. Thefirst IPG 610 may accept as inputs values of A and 3A fromrespective registers first IPG 610 may be controlled by acontroller 650 which in turn may be controlled by the respective word of B (input not shown). - The
second IPG 620 may accept values of d and 3d fromrespective sources second IPG 620 may be controlled bya q value 680. - The
multiplication circuit 600 may include acarry save adder 690 that accepts, as inputs, outputs from the twoIPGs product register 700. An output of thecarry save adder 690 may be input to theproduct register 700. Theproduct register 700 may be provided as a shift register to implement the shifts described in connection withFIG. 3 . A span of bits from the least significant bit positions may output to thecarry save adder 690 as the r[i] value. - As is known, a carry save adder generates a result in the so-called “redundant form.” Carry save adders are faster than other types of adders because they generate results of addition operations without performing a traditional carry propagation (a time consuming operation). Instead, the addition results are stored using multiple bits per “bit position.” Multiple additions can be performed in redundant form. After a final addition, a single carry propagation may be performed to obtain a result in non-redundant form.
- According to an embodiment, a portion of the
product register 700 corresponding to the quotient q may be input to asecond adder 710 such as a carry lookahead adder. Thesecond adder 710 may generate a non-redundant result which may be fed back to thesecond IPG 610 as the q value. - The foregoing embodiments have been presented in connection with an evaluation of a (A·B) emod n operation. If done in connection with an (A·B) mod n operation, the methods illustrated in
FIGS. 1-3 may be followed by a single mod operation to complete the evaluation. These embodiments may be used advantageously, however, for the evaluation of other operations, such as an AB emod n operation, in which case the mod n operation may be deferred. - Evaluation of AB emod n
- Embodiments of the emod operation are described below in the context of an AB mod n calculation. Resolution of the calculation may proceed as a nested loop process, constituting an outer loop and an inner loop.
- The outer loop may scan the bits of the exponent and to control the multiplications.
- Each pass of the outer loop may include squaring operation:
c=(c·c)emod n, (9)
and, depending on the current bit in the exponent, an additional multiplication:
c=(c·a)emod n, (10)
This embodiment is illustrated inFIG. 11 . -
FIG. 11 illustrates anothermethod 1300 according to an embodiment of the present invention. According to themethod 1200, a dummy variable c may be initialized to be zero (box 1210). Thereafter, the method iteratively considers each bit i of the exponent B. During each iteration, the method may evaluate equation 9 using an inner loop (box 1320). Thereafter, themethod 1300 may determine whether the ith bit of the exponent B (B[i]) is 1. If so, themethod 1300 may evaluate equation 10 using an inner loop (box 1330). When the operation ofbox 1330 concludes or if the ith bit was not a 1, the operation may advance to a next successive iteration. - Upon conclusion of the last iteration, the
method 1300 may invoke a traditional mod operation upon the value c (box 1340). This result obtains the result of AB mod n. - The inner loop of the operation may be performed using any of the methods described hereinabove with respect to
FIGS. 1-3 . During processing of the inner loop, both cases may be implemented using the same hardware. There need be no special handling to accommodate the squaring case. Typically the operands c and mn are of the same size and a is somewhat smaller. - Determining d and m.
- To determine the parameters d and m, the number of significant bits in n, size(n), may be determined so that:
2size(n)−1 ≦n<2size(n). (11)
Also, k may be defined as:
k=size(n)+precision (12)
for some desired precision value. Further, mn may be defined to be m·n, an integer multiple of n, so that:
d=2k −mn<n (13)
The parameter mn, when viewed in binary format, has a number of leading 1s equaling or exceeding the precision value. - To find m and d from n and 2k, note that:
where int(x) finds the largest integer of some value x. To find m, one may use the Newton method:
u i+1=(u i(2k+1 −u i ·n))/2k. (15) - Equation 15 has a property that:
ui→(2k/n) as u →∞. (16)
As it is desirable to find only the integer part of (2k/n), this iteration converges quite fast. To keep the number of bits in ui to a minimum, it is possible also to take the integer part after each iteration and throw away the fractional part:
u i+1=(u i·(1k+1 − i ·n))/2k (17)
This implementation at times can lead to a problem where the iteration stalls before reaching the correct number. Modifying the final iteration slightly however cures the problem.
u Final=((u Final−1+1)·(2k+1 −u Final−1 ·n)−2k)div2k - In another embodiment, the calculation of (2k+1−ui·n) where (ui·n)<2k+1 can be done simply by setting the leading ones of the negative number −(ui·n) to zero from position (k+1) and up. That is equivalent to keeping the bits from position k down to 0.
- In one embodiment, the calculation of m and d may be implemented in software according to the following pseudocode.
- where the function selectbits(max downto min, c) returns the bits in c from and including positions max and down to min.
- The embodiments presented hereinabove provide a computational substitute for a mod operation, labeled “emod,” that incurs much less computational expense at the cost of lost precision. It is useful when performing a mod operation in connection with multiplications or exponential operations. By applying an emod operation to interstitial products, the length operands may be maintained to be within some predetermined length window. When a final product is obtained, a traditional mod operation may be applied to obtain a final result. This scheme obtains a final result with much less processing than would be possible using only the mod operation.
- Several embodiments of the present invention are specifically illustrated and described herein. However, it will be appreciated that modifications and variations of the present invention are covered by the above teachings and within the purview of the appended claims without departing from the spirit and intended scope of the invention.
Claims (5)
1. A method of performing a modulus operation upon an operand that is represented by mathematical function to be performed iteratively, the modulus taken with respect to a value n, comprising:
upon conclusion of each of a plurality of interstitial iterations, determining a modulus of a result thereof using a phantom modulus that is a multiple of n, the phantom modulus approximating 2k for some arbitrary k, and
upon conclusion of a final iteration, determining a modulus of a result thereof using a true modulus n.
2. A method of resolving an (A·B) mod n operation, comprising,
iteratively, for each of several words of B:
shifting a value c by a word length,
adding to the shifted value c, a value A·B[i], where B[i] is the ith word of B, performing an emod operation on a result of the addition, using a phantom modulus mn that is a multiple of n, and
following a last iteration, performing a modulus operation on the result of the addition from the last iteration.
3. A method of resolving an (A·B) mod n, operation comprising:
iteratively, for each of several words of B:
generating a quotient q from a higher order portion of an earlier valuation of c,
generating a remainder r from a lower order portion of the value c,
revaluing c to be A·B[i]+r+d·q, where d is a precision value of a phantom modulus, where B[i] is the ith word of B,
following a last iteration, performing a modulus operation on the result of the revaluing from the last iteration.
4. A method of resolving an (A·B) mod n operation, comprising:
iteratively, for each of several words of B:
generating a quotient q[i] from a higher order portion of an earlier valuation of c, where i represents the current iteration,
generating a remainder r[i] from a lower order portion of the value c,
shifting left a quotient q[i−1] by a word width
revaluing c to be A·B[i]+r[i]+d·q[i−1], where d is a precision value of a phantom modulus, where B[i] is the ith word of B and the revaluing uses the shifted quotient,
following a last iteration, performing a modulus operation on the result of the revaluing from the last iteration.
5. A method of resolving an AB mod n operation, comprising:
iteratively, for each bit position i of B:
performing a c=(c·c) emod n operation, and
if the ith bit position of B is a 1, performing a c=(c·A) emod n operation; and
following a last iteration, performing A mod N operation of c obtained from the last operation,
wherein the emod n operation calculates a modulus result from a phantom modulus mn, where mn is an integer multiple of n.
Priority Applications (8)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/140,885 US7167885B2 (en) | 2002-03-22 | 2002-05-09 | Emod a fast modulus calculation for computer systems |
TW92104807A TWI229802B (en) | 2002-03-22 | 2003-03-06 | Emod a fast modulus calculation for computer systems |
DE60307089T DE60307089D1 (en) | 2002-05-09 | 2003-05-02 | "EMOD" A QUICK MODULE CALCULATION FOR COMPUTER SYSTEMS |
CNA038162156A CN1729444A (en) | 2002-05-09 | 2003-05-02 | 'EMOD' a fast modulus calculation for computer systems |
AU2003241350A AU2003241350A1 (en) | 2002-05-09 | 2003-05-02 | "emod" a fast modulus calculation for computer systems |
EP03731082A EP1504338B1 (en) | 2002-05-09 | 2003-05-02 | "emod" a fast modulus calculation for computer systems |
PCT/US2003/013807 WO2003096182A1 (en) | 2002-05-09 | 2003-05-02 | “emod” a fast modulus calculation for computer systems |
AT03731082T ATE334444T1 (en) | 2002-05-09 | 2003-05-02 | MODEL A FAST MODULE CALCULATION FOR COMPUTER SYSTEMS |
Applications Claiming Priority (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US36624202P | 2002-03-22 | 2002-03-22 | |
US36624502P | 2002-03-22 | 2002-03-22 | |
US10/140,885 US7167885B2 (en) | 2002-03-22 | 2002-05-09 | Emod a fast modulus calculation for computer systems |
Publications (3)
Publication Number | Publication Date |
---|---|
US20030182339A1 US20030182339A1 (en) | 2003-09-25 |
US20050246406A9 true US20050246406A9 (en) | 2005-11-03 |
US7167885B2 US7167885B2 (en) | 2007-01-23 |
Family
ID=29418397
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US10/140,885 Expired - Fee Related US7167885B2 (en) | 2002-03-22 | 2002-05-09 | Emod a fast modulus calculation for computer systems |
Country Status (7)
Country | Link |
---|---|
US (1) | US7167885B2 (en) |
EP (1) | EP1504338B1 (en) |
CN (1) | CN1729444A (en) |
AT (1) | ATE334444T1 (en) |
AU (1) | AU2003241350A1 (en) |
DE (1) | DE60307089D1 (en) |
WO (1) | WO2003096182A1 (en) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7966361B1 (en) * | 2006-02-10 | 2011-06-21 | Nvidia Corporation | Single-cycle modulus operation |
Families Citing this family (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
DE10223853B4 (en) * | 2002-05-28 | 2005-06-23 | Technische Universität Braunschweig Carolo-Wilhelmina | Method and integrated circuit for performing a multiplication modulo M |
US7627114B2 (en) * | 2002-10-02 | 2009-12-01 | International Business Machines Corporation | Efficient modular reduction and modular multiplication |
US20040120516A1 (en) * | 2002-12-23 | 2004-06-24 | International Business Machines Corporation | Modular reduction method which recognizes special conditions |
WO2009084026A2 (en) * | 2007-11-30 | 2009-07-09 | Chandra Mohan Umapathy | System and method for high speed modulo operations |
CN106383809A (en) * | 2016-12-07 | 2017-02-08 | 西安科技大学 | Solving method of system for solving mathematical functions |
Citations (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4208722A (en) * | 1978-01-23 | 1980-06-17 | Data General Corporation | Floating point data processing system |
US4864529A (en) * | 1986-10-09 | 1989-09-05 | North American Philips Corporation | Fast multiplier architecture |
US5008850A (en) * | 1990-05-25 | 1991-04-16 | Sun Microsystems, Inc. | Circuitry for multiplying binary numbers |
US5373560A (en) * | 1991-12-06 | 1994-12-13 | Schlafly; Roger | Partial modular reduction method |
US5402369A (en) * | 1993-07-06 | 1995-03-28 | The 3Do Company | Method and apparatus for digital multiplication based on sums and differences of finite sets of powers of two |
US5644695A (en) * | 1994-01-03 | 1997-07-01 | International Business Machines Corporation | Array combinatorial decoding with multiple error and erasure detection and location using cyclic equivalence testing |
US20020154768A1 (en) * | 1998-04-08 | 2002-10-24 | Lenstra Arjen K. | Generating RSA moduli including a predetermined portion |
US20040010530A1 (en) * | 2002-07-10 | 2004-01-15 | Freking William L. | Systolic high radix modular multiplier |
Family Cites Families (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JPH01251133A (en) | 1988-01-29 | 1989-10-06 | Texas Instr Inc <Ti> | Multiplying circuit and method |
FR2658932A1 (en) * | 1990-02-23 | 1991-08-30 | Koninkl Philips Electronics Nv | METHOD OF ENCODING THE RSA METHOD BY A MICROCONTROLLER AND DEVICE USING THE SAME |
US5646877A (en) | 1995-05-25 | 1997-07-08 | Texas Instruments Incorporated | High radix multiplier architecture |
JPH1166045A (en) | 1997-08-22 | 1999-03-09 | Oki Electric Ind Co Ltd | Multiplier |
WO2001025899A1 (en) | 1999-10-01 | 2001-04-12 | Koninklijke Philips Electronics N.V. | Improved multiplication circuit |
-
2002
- 2002-05-09 US US10/140,885 patent/US7167885B2/en not_active Expired - Fee Related
-
2003
- 2003-05-02 DE DE60307089T patent/DE60307089D1/en not_active Expired - Lifetime
- 2003-05-02 CN CNA038162156A patent/CN1729444A/en active Pending
- 2003-05-02 WO PCT/US2003/013807 patent/WO2003096182A1/en active IP Right Grant
- 2003-05-02 AU AU2003241350A patent/AU2003241350A1/en not_active Abandoned
- 2003-05-02 AT AT03731082T patent/ATE334444T1/en not_active IP Right Cessation
- 2003-05-02 EP EP03731082A patent/EP1504338B1/en not_active Expired - Lifetime
Patent Citations (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4208722A (en) * | 1978-01-23 | 1980-06-17 | Data General Corporation | Floating point data processing system |
US4864529A (en) * | 1986-10-09 | 1989-09-05 | North American Philips Corporation | Fast multiplier architecture |
US5008850A (en) * | 1990-05-25 | 1991-04-16 | Sun Microsystems, Inc. | Circuitry for multiplying binary numbers |
US5373560A (en) * | 1991-12-06 | 1994-12-13 | Schlafly; Roger | Partial modular reduction method |
US5402369A (en) * | 1993-07-06 | 1995-03-28 | The 3Do Company | Method and apparatus for digital multiplication based on sums and differences of finite sets of powers of two |
US5644695A (en) * | 1994-01-03 | 1997-07-01 | International Business Machines Corporation | Array combinatorial decoding with multiple error and erasure detection and location using cyclic equivalence testing |
US20020154768A1 (en) * | 1998-04-08 | 2002-10-24 | Lenstra Arjen K. | Generating RSA moduli including a predetermined portion |
US20040010530A1 (en) * | 2002-07-10 | 2004-01-15 | Freking William L. | Systolic high radix modular multiplier |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7966361B1 (en) * | 2006-02-10 | 2011-06-21 | Nvidia Corporation | Single-cycle modulus operation |
Also Published As
Publication number | Publication date |
---|---|
US20030182339A1 (en) | 2003-09-25 |
WO2003096182A1 (en) | 2003-11-20 |
ATE334444T1 (en) | 2006-08-15 |
US7167885B2 (en) | 2007-01-23 |
EP1504338B1 (en) | 2006-07-26 |
CN1729444A (en) | 2006-02-01 |
AU2003241350A1 (en) | 2003-11-11 |
DE60307089D1 (en) | 2006-09-07 |
EP1504338A1 (en) | 2005-02-09 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
JP4955182B2 (en) | Integer calculation field range extension | |
US6539368B1 (en) | Neural processor, saturation unit, calculation unit and adder circuit | |
Yang et al. | A new RSA cryptosystem hardware design based on Montgomery's algorithm | |
Zimmermann | Efficient VLSI implementation of modulo (2/sup n//spl plusmn/1) addition and multiplication | |
US6360241B1 (en) | Computer method and apparatus for division and square root operations using signed digit | |
EP1293891B2 (en) | Arithmetic processor accomodating different finite field size | |
JP2722413B2 (en) | Implementation method of modular multiplication by Montgomery method | |
US5696712A (en) | Three overlapped stages of radix-2 square root/division with speculative execution | |
JP2002108606A (en) | Sticky bit generating circuit and multiplier | |
US5261001A (en) | Microcircuit for the implementation of RSA algorithm and ordinary and modular arithmetic, in particular exponentiation, with large operands | |
US5023827A (en) | Radix-16 divider using overlapped quotient bit selection and concurrent quotient rounding and correction | |
US5132925A (en) | Radix-16 divider using overlapped quotient bit selection and concurrent quotient rounding and correction | |
US5796645A (en) | Multiply accumulate computation unit | |
KR20110105555A (en) | Montgomery multiplier having efficient hardware structure | |
JP3516503B2 (en) | Electronic multiplication and addition apparatus and method | |
US6728744B2 (en) | Wide word multiplier using booth encoding | |
Koç et al. | Fast algorithm for modular reduction | |
Shieh et al. | A new algorithm for high-speed modular multiplication design | |
US6917956B2 (en) | Apparatus and method for efficient modular exponentiation | |
US7046800B1 (en) | Scalable methods and apparatus for Montgomery multiplication | |
Omondi | Cryptography arithmetic | |
US7240204B1 (en) | Scalable and unified multiplication methods and apparatus | |
US7167885B2 (en) | Emod a fast modulus calculation for computer systems | |
Ercegovac et al. | Very high radix division with selection by rounding and prescaling | |
US7174015B1 (en) | Methods and apparatus for variable radix scalable modular multiplication |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: INTEL CORPORATION, CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:HOJSTED, ERIK;REEL/FRAME:012881/0055 Effective date: 20020421 |
|
REMI | Maintenance fee reminder mailed | ||
LAPS | Lapse for failure to pay maintenance fees | ||
STCH | Information on status: patent discontinuation |
Free format text: PATENT EXPIRED DUE TO NONPAYMENT OF MAINTENANCE FEES UNDER 37 CFR 1.362 |
|
FP | Lapsed due to failure to pay maintenance fee |
Effective date: 20110123 |