Comparison of three modular reduction functions

Abstract

Three modular reduction algorithms for large integers are compared with respect to their performance in portable aoftware: the classical aIgorithm, Barrett'e algorithm and Montgomery's algorithm. These algorithms are a time critical step in the implementation of the modular exponentiation operation. For each of these aIgorithxm their a g plication in the modular exponentiation operation is considered. Modular exponentiation constitutes the basis of many well known and widely used public key cryptosystems. A fast and portable modular exponentiation will considerably enhance the speed and applicability of these systems.

On Diffie-Hellman Key Agreement with Short Exponents

“…For a modulus p of bit,length m, mod p exponentiation with m-bit exponents using the basic square-and-multiply method [7] requires about m modular squarings and c m (m-bit) modular multiplies, where naively, c = 0.5 (on average); improvcments are possible. Standard techniques [2] for each of (m-bit) multiplication mod p and modular reduction require O(m2) bit operations.…”

Targeting FPGA DSP Slices for a Large Integer Multiplier for Integer Based FHE

“…These operations are also required in many other FHE schemes, such as the lattice based schemes [9], [15]. We have chosen to focus initially on multiplication as most efficient hardware implementations of modular reduction also require the use of a multiplier, for example Barrett reduction and Montgomery reduction both require multiplications [19]. Moreover, one of the main motivations for FHE and SHE schemes is to compute, using additions and multiplications, on encrypted data.…”

Long Modular Multiplication for Cryptographic Applications

“…): Interleavedrow multiplicationa nd reduction, Montgomery, Barrett and Quisquater multiplications. [1], [3], [12], [13].W epresent algorithmic and HW speedups for them, so we have to review their basic versions first.…”

“…In this direction there are no problems with carries (whichp ropagatea wayf rom the processed digits) or with estimating the quotient digit wrong, so no correction steps are necessary. This gives it some 6% speed advantage over Barrett'sr eduction and more than 2 0% s peed advantage over division based reductions [3]. The traditional Montgomery multiplication calculates the product in "row order", but it still can take advantage o f a speedup fors quaring.…”