Montgomery Modular Multiplication on ARM-NEON Revisited

Abstract

Abstract. Montgomery modular multiplication constitutes the "arithmetic foundation" of modern public-key cryptography with applications ranging from RSA, DSA and Diffie-Hellman over elliptic curve schemes to pairing-based cryptosystems. The increased prevalence of SIMD-type instructions in commodity processors (e.g. Intel SSE, ARM NEON) has initiated a massive body of research on vector-parallel implementations of Montgomery modular multiplication. In this paper, we introduce the Cascade Operand Scanning (COS) method to speed up multi-precision multiplication on SIMD architectures. We developed the COS technique with the goal of reducing Read-After-Write (RAW) dependencies in the propagation of carries, which also reduces the number of pipeline stalls (i.e. bubbles). The COS method operates on 32-bit words in a row-wise fashion (similar to the operand-scanning method) and does not require a "non-canonical" representation of operands with a reduced radix. We show that two COS computations can be "coarsely" integrated into an efficient vectorized variant of Montgomery multiplication, which we call Coarsely Integrated Cascade Operand Scanning (CICOS) method. Due to our sophisticated instruction scheduling, the CICOS method reaches record-setting execution times for Montgomery modular multiplication on ARM-NEON platforms. Detailed benchmarking results obtained on an ARM Cortex-A9 and Cortex-A15 processors show that the proposed CICOS method outperforms Bos et al's implementation from SAC 2013 by up to 57% (A9) and 40% (A15), respectively.

Efficient arithmetic on ARM‐NEON and its application for high‐speed RSA implementation

“…In ICISC 2014, Seo et al . introduced a novel two‐way cascade operand scanning (COS) multiplication . This method processes the partial products in a non‐conventional order to reduce the number of data dependencies in the carry propagations from the least to most significant words.…”

“…However, there are still two interesting topics for Montgomery algorithm on ARM‐NEON processors . First, the previous work mainly focused on multiplication not squaring.…”

“…Second, previous methods do not consider Karatsuba multiplication for long integer. The GNU Multiple Precision Arithmetic Library (GMP) library switches to one Karatsuba level when it comes to 832‐bit inputs but recent SIMD implementations even over 1024 and 2048 bits avoided all use of Karatsuba's method . In this paper, we work on these two interesting topics by suggesting a non‐redundant double operand scanning (DOS) squaring method and constant‐time Karatsuba algorithm.…”

Montgomery Arithmetic from a Software Perspective

“…This approach allows one to split the computation of the interleaved Montgomery multiplication into two parts which can be computed in parallel. Note that in a follow-up work [65] by Seo, Liu, Großschädl, and Choi it is shown how to improve the performance on 2-way SIMD architectures even further. Instead of computing the two multiplications concurrently, as is presented in Section 4.1, they compute every multiplication using 2-way SIMD instructions.…”

“…This results in a software implementation which outperforms the one presented in [17]. It would be interesting to see if these two approaches (from [17] and [65]) can be merged on platforms which support efficient 4-way SIMD instructions.…”