Efficient Modular Multiplication

This chapter is concerned with one of the fundamental building blocks used in modern publickey cryptography: modular multiplication. Speed-ups applied to the modular multiplication algorithm or implementation directly translate in a faster modular exponentiation for RSA or a faster realization of the group law when using elliptic curve cryptography. This chapter outlines the most commonly used modular multiplication method Montgomery multiplication for generic moduli as well as different techniques when “special” moduli of a particular shape are used. Moreover, we study approaches which might produce errors with a very small probability. Such faster “sloppy reduction” techniques are especially beneficial in cryptanalytic settings. We look at this from both a historical as well as an applied implementation perspective. The best approach to implement modular multiplication on a modern 64-bit architecture with advanced single-instruction, multiple data instruction set extensions is, for example, quite different from the best approach on resource constrained embedded devices. Throughout this chapter we focus on the cryptographic setting unless we specifically discuss an algorithm for cryptanalysis. Contrary to many mathematical software applications, the running time of a cryptographic implementation (and hereby also the modular multiplication) should avoid secret-data-dependent branches and secretly indexed memory access. Such constant time implementations are one of the basic countermeasures against timing attacks: advanced techniques which use information about the running time of the target algorithm to extract the used private key. Such attacks are part of a larger family of attacks known as side-channel attacks. Throughout this chapter we represent a wn-bit non-negative integer X in the so-called radix-2w representation,