Carry-save Form Research Articles

Fast Montgomery modular multiplier for Rivest–Shamir–Adleman cryptosystem

A high-speed Montgomery modular multiplier is proposed in this study. This multiplier requires binary input and also generates a modular product in binary form. To speed up the process of multiplication, intermediate operands of the multiplier are kept in carry-save form. This multiplier employs a two-level carry-save adder architecture to keep intermediate operands in carry-save form. This multiplier also employs a look-ahead carry unit (LCU) for conversion of the final output from carry-save form to binary form. LCU is also utilised for pre-computation of intermediate operands. Format conversion and pre-computation require additional clock cycles. In general, each cycle of the Montgomery multipliers involves addition and shift operation followed by computation of the following quotient. The proposed multiplier adds and shifts as well as computes the following two quotients simultaneously to minimise the critical path delay. In addition, the proposed multiplier combines two iterations, which require additional intermediate operands. In this way, the execution time and the number of clock cycles required for multiplication are minimised significantly and extra clock cycles required for format conversion and operand pre-computation can be overlooked. Experimental results show that the proposed approach can achieve significant speed and throughput improvement as compared to previous multipliers.

Fast and High-throughput Montgomery Modular Multiplier for RSA Encryption and Decryption

This paper proposes a fast and high-throughput Montgomery modular multiplier that outputs a modular product in binary form. Intermediate operands are kept in carry-save form and added through a two-level, carry-save adder architecture. A carry look-ahead adder is also employed in this multiplier for operand pre-computation and converting the final output from carrysave form to binary form, which accounts for additional clock cycles. The proposed multiplier computes the next two quotients during the iSUPth/SUP iteration to minimize critical path delay, and computes intermediate output for the (i + 2)SUPth/SUP iteration while skipping the (і + 1)SUPth/SUP iteration. In this way, the overall time required for multiplication is minimized significantly, and additional clock cycles required for operand pre-computation and format conversion can be ignored. Experimental results show that the proposed Montgomery modular multiplier can achieve significant speed and throughput improvement, compared to previous designs.

An Energy-Efficient Multiplier With Fully Overlapped Partial Products Reduction and Final Addition

An energy-efficient fast array multiplier is proposed and designed. The multiplier operates in a left-to-right mode enabling a full overlap between reduction of partial products in carry-save form and the final addition producing the product. The design is based on the left-to-right carry-free (LRCF) multiplier. It differs from the LRCF multiplier in a much smaller on-the-fly conversion circuit of $O(n)$ size and the use of radix-4 full adders in the conversion. The new converter produces the most-significant half of the product during the reduction process. It eliminates the most-significant part of the final adder. The least-significant half of the product is obtained with a carry-ripple adder during the reduction. Thus conversion of the carry-save form of accumulated partial products to the conventional product does not add any delay to the total time of the multiplier. Several right-to-left, left-to-right multipliers and tree multipliers are designed for 16, 24, 32, and 56 bits, and radices 2 and 4, synthesized in 90 nm technology and compared, demonstrating the advantages and disadvantages of the proposed design with respect to area, delay, power, and energy. We considered both truncated and full-precision multipliers. The proposed multiplier has lower delay, area, power, and energy than other considered types of array multipliers. Its advantages grow with the increase in precision. As expected, it is slower than a tree multiplier but it has smaller area, power, and energy.

A Partial Carry-Save On-the-Fly Correction Multispeculative Multiplier

Functional Units that are designed to receive inputs and produce outputs using a non-redundant format typically exhibit an inferior performance. In order to overcome this limitation, the carry-save and partial carry-save formats have been proposed. Both approaches are very suitable when implementing addition trees. Nevertheless, if there are multiplications in the datapath, the inputs to the multiplier must be reduced to a non-redundant form, to avoid applying the distributive property. In this paper we present a multiplier able to receive two numbers in partial carry-save format, and produce a result in partial carry-save format as well. This is done by modifying the Booth encoder and leveraging the generate and propagate group signals that are available because of the partial carry-save format. Hence, this can allow to fully implement datapaths without additional penalty cycles due to reductions to non-redundant forms. Experiments show that our proposed multiplier has 15 percent shorter delay with respect to a conventional Booth radix-4 multiplier. Moreover, when combining it with partial carry-save adders it is possible to reduce 36 percent execution time on average for several benchmarks, achieving a 32.7 percent reduction in the Energy Delay Product at the same time.

Low-Cost High-Performance VLSI Architecture for Montgomery Modular Multiplication

This paper proposes a simple and efficient Montgomery multiplication algorithm such that the low-cost and high-performance Montgomery modular multiplier can be implemented accordingly. The proposed multiplier receives and outputs the data with binary representation and uses only one-level carry-save adder (CSA) to avoid the carry propagation at each addition operation. This CSA is also used to perform operand precomputation and format conversion from the carry-save format to the binary representation, leading to a low hardware cost and short critical path delay at the expense of extra clock cycles for completing one modular multiplication. To overcome the weakness, a configurable CSA (CCSA), which could be one full-adder or two serial half-adders, is proposed to reduce the extra clock cycles for operand precomputation and format conversion by half. In addition, a mechanism that can detect and skip the unnecessary carry-save addition operations in the one-level CCSA architecture while maintaining the short critical path delay is developed. As a result, the extra clock cycles for operand precomputation and format conversion can be hidden and high throughput can be obtained. Experimental results show that the proposed Montgomery modular multiplier can achieve higher performance and significant area–time product improvement when compared with previous designs.

A 13 bits 4.096 GHz 45 nm CMOS digital decimation filter chain with Carry-Save format numbers

In this paper we analyze the architecture of a 13bits 4.096GHz multi-stage decimation filter for multi-standard radio receivers. It also explores the benefits of Carry-Save format numbers in this decimation filter. After trading off between area and power consumption, we propose to use shift-and-adder for high data rate decimation stages and hardware multiply-accumulator for low data rate stages. The proposed decimation filter chain exploits the advantage of all architectures and exhibit the best area-power trade-off. It is implemented using 45nm CMOS technology. The proposed design reduces power by 13.7% without area overhead, compared with a conventional filter chain using only binary number.

A study of decimal left shifters for binary numbers

The importance of decimal floating-point (DFP) arithmetic has been growing in the last years, and specifications for it are included in the revised IEEE 754 Standard for Floating-Point Arithmetic (IEEE 754-2008). IEEE 754-2008 specifies a binary encoding for decimal significands, in which the significands of DFP numbers are represented as unsigned binary integers. For this representation, which is commonly referred to as the binary integer decimal (BID) encoding, fast decimal left shifting of a binary number is useful for operand alignment, normalization, overflow avoidance, and quantize operations. A decimal left shift of an unsigned binary integer, I, by S digit positions corresponds to multiplying I by 10S. This paper presents the theory and design of decimal left shifters for binary numbers. The designs perform decimal left shifting using optimized constant multiplications by selected powers of ten. We propose and analyze different combinational and sequential decimal left shifter architectures for binary numbers. The designs are compared to one another in terms of area and delay using both theoretical estimates and synthesis results for 16-digit (54-bit) binary inputs and 4-bit shift amounts. The results indicate that an optimized radix-2 decimal shifter implementing partial shifters in carry-save format has 80% less area and 68% less delay than a lookup table followed by a binary multiplier to compute I×10S, when both designs are optimized for delay. When both designs are optimized for area, the radix-2 decimal shifter has 89% less area and 31% less delay.

Systematic Design of RSA Processors Based on High-Radix Montgomery Multipliers

This paper presents a systematic design approach to provide the optimized Rivest-Shamir-Adleman (RSA) processors based on high-radix Montgomery multipliers satisfying various user requirements, such as circuit area, operating time, and resistance against side-channel attacks. In order to involve the tradeoff between the performance and the resistance, we apply four types of exponentiation algorithms: two variants of the binary method with/without Chinese Remainder Theorem (CRT). We also introduces three multiplier-based datapath-architectures using different intermediate data forms: 1) single form, 2) semi carry-save form, and 3) carry-save form, and combined them with a wide variety of arithmetic components. Their radices are parameterized from 2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">8</sup> to 2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">128</sup> . A total of 242 datapaths for 1024-bit RSA processors were obtained for each radix. The potential of the proposed approach is demonstrated through an experimental synthesis of all possible processors with a 90-nm CMOS standard cell library. As a result, the smallest design of 861 gates with 118.47 ms/RSA to the fastest design of 0.67 ms/RSA at 153\thinspace 862 gates were obtained. In addition, the use of the CRT technique reduced the RSA operation time of the fastest design to 0.24 ms. Even if we employed the exponentiation algorithm resistant to typical side-channel attacks, the fastest design can perform the RSA operation in less than 1.0 ms.

A New Modular Exponentiation Architecture for Efficient Design of RSA Cryptosystem

Modular exponentiation with a large modulus, which is usually accomplished by repeated modular multiplications, has been widely used in public key cryptosystems for secured data communications. To speed up the computation, the Montgomery modular multiplication algorithm is used to relax the process of quotient determination, and the carry-save addition (CSA) is employed to reduce the critical path delay. In this paper, based on the inherent data dependency between the modular multiplication and square operations in the H-algorithm of modular exponentiation, we present a new modular exponentiation architecture with a unified modular multiplication/square module and show how to reduce the number of input operands for the CSA tree by mathematical manipulation. The developed architecture has the following advantages. 1) There is no need to convert the carry-save form of an operand into its binary representation at the end of each modular multiplication. In this way, except the final step to get the result of modular exponentiation, the time-consuming carry propagation can then be eliminated. 2) The number of input operands for the CSA tree is reduced in a very efficient way. 3) The hardware saving is achieved with very limited impact on the original critical path delay when designed with two distinct modular multiplication and square components. Experimental results show that our modular exponentiation design obtains the least hardware complexity compared with the existing work and outperforms them in terms of area-time (AT) complexity as well.

A 6.2-GFlops Floating-Point Multiply-Accumulator With Conditional Normalization

A pipelined single-precision floating-point multiply-accumulator (FPMAC) featuring a single-cycle accumulate loop using base 32 and internal carry-save arithmetic with delayed addition is described. A combination of algorithmic, logic, and circuit techniques enables multiply-accumulate operations at speeds exceeding 3 GHz with single-cycle throughput. The optimizations allow removal of the costly normalization step from the critical accumulate loop. This logic is conditionally powered down using dynamic sleep transistors on long accumulate operations, saving active and leakage power. In addition, an improved leading-zero anticipator (LZA) and overflow prediction logic applicable to carry-save format is presented. In a 90-nm seven-metal dual-V <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</sub> CMOS process, the 2 mm <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> custom design contains 230K transistors. The fully functional first silicon achieves 6.2 GFlops of performance while dissipating 1.2 W at 3.1 GHz, 1.3-V supply

VLSI array algorithms and architectures for RSA modular multiplication

We present two novel iterative algorithms and their array structures for integer modular multiplication. The algorithms are designed for Rivest-Shamir-Adelman (RSA) cryptography and are based on the familiar iterative Horner's rule, but use precalculated complements of the modulus. The problem of deciding which multiples of the modulus to subtract in intermediate iteration stages has been simplified using simple look-up of precalculated complement numbers, thus allowing a finer-grain pipeline. Both algorithms use a carry save adder scheme with module reduction performed on each intermediate partial product which results in an output in carry-save format. Regularity and local connections make both algorithms suitable for high-performance array implementation in FPGA's or deep submicron VLSI. The processing nodes consist of just one or two full adders and a simple multiplexor. The stored complement numbers need to be precalculated only when the modulus is changed, thus not affecting the performance of the main computation. In both cases, there exists a bit-level systolic schedule, which means the array can be fully pipelined for high performance and can also easily be mapped to linear arrays for various space/time tradeoffs.

RADIX MODULAR MULTIPLICATION ALGORITHM

In this paper, the concept of a new Radix Modular Multiplication Algorithm (MMA) is proposed. The novelty of the new Radix-2n MMA is that the intermediate partial sums (IPSs) are not restricted to be less than the modulus M, but only to be represented by N bits, where N is the number of bits needed to represent the modulus M. Hence, the IPSs become redundant to the modulus M. Two new Radix-2n MMAs (for n=2 and 4) based on the proposed concept are considered in detail as well. It is shown that a parallel multiplier based on the new Radix-4 MMA achieves twice the speed of a parallel multiplier based on a recent Radix-2 MMA. This result becomes more significant when it is noted that doubling the speed was achieved without any increase in the hardware requirement. In addition, it is shown that the parallel multiplier based on the new Radix-16 MMA achieves four times the speed of that of the Radix-2 MMA with the same hardware requirement. When compared to the existing Radix-4 MMAs that are based on Carry Save format and Binary Signed Digit (BSD) representation, it is shown that the delay per step of the proposed Radix-4 multiplier is decreased by more than 40% when the intermediate steps are implemented using Carry Save Adders (CSAs).

Very-high radix division with prescaling and selection by rounding

A division algorithm in which the quotient-digit selection is performed by rounding the shifted residual in carry-save form is presented. To allow the use of this simple function, the divisor (and dividend) is prescaled to a range close to one. The implementation presented results in a fast iteration because of the use of carry-save forms and suitable recodings. The execution time is calculated and several convenient values of the radix are selected. Comparison with other dividers for radices 2/sup 9/ to 2/sup 18/ is performed using the same assumptions. >

Higher radix square rooting

A general discussion on nonrestoring square root algorithms is presented, showing bounds and constraints delimiting the space of feasible algorithms, for all the choices of radix, digit set and representation of the partial remainder. Two classes of algorithms are then derived from the general discussion, and it is shown how it is possible to determine two parameters with a relevant impact on the implementation: the number of radicand bits to be inspected in order to obtain a starting value, and the number of partial remainder bits to be examined for digit selection. The algorithms for the specific case of radix 4 digit set (-2, -1, 0, +1, +2), and partial remainder represented in carry-save form are derived in order to show that the algorithms introduced can lead to better results than those obtained with algorithms previously presented.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>