Modular Inversion Algorithm Research Articles

Area–Time-Efficient High-Radix Modular Inversion Algorithm and Hardware Implementation for ECC over Prime Fields

Elliptic curve cryptography (ECC) is widely used for secure communications, because it can provide the same level of security as RSA with a much smaller key size. In constrained environments, it is important to consider efficiency, in terms of execution time and hardware costs. Modular inversion is a key time-consuming calculation used in ECC. Its hardware implementation requires extensive hardware resources, such as lookup tables and registers. We investigate the state-of-the-art modular inversion algorithms, and evaluate the performance and cost of the algorithms and their hardware implementations. We then propose a high-radix modular inversion algorithm aimed at reducing the execution time and hardware costs. We present a detailed radix-8 hardware implementation based on 256-bit primes in Verilog HDL and compare its cost performance to other implementations. Our implementation on the Altera Cyclone V FPGA chip used 1227 ALMs (adaptive logic modules) and 1037 registers. The modular inversion calculation took 3.67 ms. The AT (area–time) factor was 8.30, outperforming the other implementations. We also present an implementation of ECC using the proposed radix-8 modular inversion algorithm. The implementation results also showed that our modular inversion algorithm was more efficient in area–time than the other algorithms.

Why do inverse models disagree? A case study with two European CO2 inversions

Abstract. We present an analysis of atmospheric transport impact on estimating CO2 fluxes using two atmospheric inversion systems (CarboScope-Regional (CSR) and Lund University Modular Inversion Algorithm (LUMIA)) over Europe in 2018. The main focus of this study is to quantify the dominant drivers of spread amid CO2 estimates derived from atmospheric tracer inversions. The Lagrangian transport models STILT (Stochastic Time-Inverted Lagrangian Transport) and FLEXPART (FLEXible PARTicle) were used to assess the impact of mesoscale transport. The impact of lateral boundary conditions for CO2 was assessed by using two different estimates from the global inversion systems CarboScope (TM3) and TM5-4DVAR. CO2 estimates calculated with an ensemble of eight inversions differing in the regional and global transport models, as well as the inversion systems, show a relatively large spread for the annual fluxes, ranging between −0.72 and 0.20 PgC yr−1, which is larger than the a priori uncertainty of 0.47 PgC yr−1. The discrepancies in annual budget are primarily caused by differences in the mesoscale transport model (0.51 PgC yr−1), in comparison with 0.23 and 0.10 PgC yr−1 that resulted from the far-field contributions and the inversion systems, respectively. Additionally, varying the mesoscale transport caused large discrepancies in spatial and temporal patterns, while changing the lateral boundary conditions led to more homogeneous spatial and temporal impact. We further investigated the origin of the discrepancies between transport models. The meteorological forcing parameters (forecasts versus reanalysis obtained from ECMWF data products) used to drive the transport models are responsible for a small part of the differences in CO2 estimates, but the largest impact seems to come from the transport model schemes. Although a good convergence in the differences between the inversion systems was achieved by applying a strict protocol of using identical prior fluxes and atmospheric datasets, there was a non-negligible impact arising from applying a different inversion system. Specifically, the choice of prior error structure accounted for a large part of system-to-system differences.

Fast Large-Integer Extended GCD Algorithm and Hardware Design for Verifiable Delay Functions and Modular Inversion

The extended GCD (XGCD) calculation, which computes Bézout coefficients ba, bb such that ba ∗ a0 + bb ∗ b0 = GCD(a0, b0), is a critical operation in many cryptographic applications. In particular, large-integer XGCD is computationally dominant for two applications of increasing interest: verifiable delay functions that square binary quadratic forms within a class group and constant-time modular inversion for elliptic curve cryptography. Most prior work has focused on fast software implementations. The few works investigating hardware acceleration build on variants of Euclid’s division-based algorithm, following the approach used in optimized software. We show that adopting variants of Stein’s subtraction-based algorithm instead leads to significantly faster hardware. We quantify this advantage by performing a large-integer XGCD accelerator design space exploration comparing Euclid- and Stein-based algorithms for various application requirements. This exploration leads us to an XGCD hardware accelerator that is flexible and efficient, supports fast average and constant-time evaluation, and is easily extensible for polynomial GCD. Our 16nm ASIC design calculates 1024-bit XGCD in 294ns (8x faster than the state-of-the-art ASIC) and constant-time 255-bit XGCD for inverses in the field of integers modulo the prime 2255−19 in 85ns (31× faster than state-of-the-art software). We believe our design is the first high-performance ASIC for the XGCD computation that is also capable of constant-time evaluation. Our work is publicly available at https://github.com/kavyasreedhar/sreedhar-xgcd-hardware-ches2022.

Regional CO<sub>2</sub> inversions with LUMIA, the Lund University Modular Inversion Algorithm, v1.0

Abstract. Atmospheric inversions are used to derive constraints on the net sources and sinks of CO2 and other stable atmospheric tracers from their observed concentrations. The resolution and accuracy that the fluxes can be estimated with depends, among other factors, on the quality and density of the observational coverage, on the precision and accuracy of the transport model used by the inversion to relate fluxes to observations, and on the adaptation of the statistical approach to the problem studied. In recent years, there has been an increasing demand from stakeholders for inversions at higher spatial resolution (country scale), in particular in the framework of the Paris agreement. This step up in resolution is in theory enabled by the growing availability of observations from surface in situ networks (such as ICOS in Europe) and from remote sensing products (OCO-2, GOSAT-2). The increase in the resolution of inversions is also a necessary step to provide efficient feedback to the bottom-up modeling community (vegetation models, fossil fuel emission inventories, etc.). However, it calls for new developments in the inverse models: diversification of the inversion approaches, shift from global to regional inversions, and improvement in the computational efficiency. In this context, we developed LUMIA, the Lund University Modular Inversion Algorithm. LUMIA is a Python library for inverse modeling built around the central idea of modularity: it aims to be a platform that enables users to construct and experiment with new inverse modeling setups while remaining easy to use and maintain. It is in particular designed to be transport-model-agnostic, which should facilitate isolating the transport model errors from those introduced by the inversion setup itself. We have constructed a first regional inversion setup using the LUMIA framework to conduct regional CO2 inversions in Europe using in situ data from surface and tall-tower observation sites. The inversions rely on a new offline coupling between the regional high-resolution FLEXPART Lagrangian particle dispersion model and the global coarse-resolution TM5 transport model. This test setup is intended both as a demonstration and as a reference for comparison with future LUMIA developments. The aims of this paper are to present the LUMIA framework (motivations for building it, development principles and future prospects) and to describe and test this first implementation of regional CO2 inversions in LUMIA.

A Hardware-Efficient Elliptic Curve Cryptographic Architecture over GF (p)

This paper proposes a hardware-efficient elliptic curve cryptography (ECC) architecture over GF(p), which uses adders to achieve scalar multiplication (SM) through hardware-reuse method. In terms of algorithm, the improvement of the interleaved modular multiplication (IMM) algorithm and the binary modular inverse (BMI) algorithm needs two adders. In addition to the adder, the data register is another optimize target. The design compiler is synthesized on 0.13 µm CMOS ASIC platform. The time range of performing scalar multiplication over 160, 192, 224, and 256 field orders under 150 MHz frequency is 1.99–3.17 ms. Moreover, the gate area required for different field orders in this design is in the range of 35.65k–59.14k, with 50%–91% hardware resource less than other processors.

Proof and Improvement of Shantz’s Modular Division and Lórencz’s Modular Inverse Algorithms

Modular division or inverse is fundamental in finite field arithmetic, and it widely exists in cryptosystems like elliptic curve cryptography. Shantz’s algorithm can be easily used for modular division in addition to the plus and minus methods. Nevertheless, a proof of the algorithm is in lack in the literature so far. This work presents a proof of Shantz’s algorithm by matrix transforms. Also, Lorencz’s modular inverse algorithm is innovative in applying left-shift operations, for which an analysis and an improvement are also given in this paper.

Memory Tampering Attack on Binary GCD Based Inversion Algorithms

In the field of cryptography engineering, implementation-based attacks are a major concern due to their proven feasibility. Fault injection is one attack vector, nowadays a major research line. In this paper, we present how a memory tampering-based fault attack can be used to severely limit the output space of binary GCD based modular inversion algorithm implementations. We frame the proposed attack in the context of ECDSA showing how this approach allows recovering the private key from only one signature, independent of the key size. We analyze two memory tampering proposals, illustrating how this technique can be adapted to different implementations. Besides its application to ECDSA, it can be extended to other cryptographic schemes and countermeasures where binary GCD based modular inversion algorithms are employed. In addition, we describe how memory tampering-based fault attacks can be used to mount a previously proposed fault attack on scenarios that were initially discarded, showing the importance of including memory tampering attacks in the frameworks for analyzing fault attacks and their countermeasures.

A Low Hardware Consumption Elliptic Curve Cryptographic Architecture over GF(p) in Embedded Application

In this paper, a low hardware consumption design of elliptic curve cryptography (ECC) over GF(p) in embedded applications is proposed. The adder-based architecture is explored to reduce the hardware consumption of performing scalar multiplication (SM). The Interleaved Modular Multiplication Algorithm and Binary Modular Inversion Algorithm are improved and implemented with two full-word adder units. The full-word register units for data storage are also optimized. The design is based on two full-word adder units and twelve full-word register units of pipeline structure and was implemented on Xilinx Virtex-4 platform. Design Compiler is used to synthesized the proposed architecture with 0.13 μm CMOS standard cell library. For 160, 192, 224, 256 field order, the proposed architecture consumes 5595, 7080, 8423, 9370 slices, respectively, and saves 17.58∼54.93% slice resources on FPGA platform when compared with other design architectures. The synthesized result uses 35.43 k, 43.37 k, 50.38 k, 57.05 k gate area and saves 52.56∼91.34% in terms of gate count in comparison. The design takes 2.56∼4.07 ms to perform SM operation over different field order under 150 MHz frequency. The proposed architecture is safe from simple power analysis (SPA). Thus, it is a good choice for embedded applications.

The k -ary Montgomery modular inverse over nonbinary computers

This paper presents a k-ary Montgomery modular inverse algorithm over nonbinary computers by using Sedjelmaci's right shift k-ary greatest common divisor scheme. Over traditional binary computers, Kaliski's scheme can output Montgomery modular inverse Q − 12n mod P, where P is coprime to Q and n is the bit length of P. Over k-ary computers, our algorithm can discover the k-ary Montgomery inverse Q − 1km mod P, where P, Q, and k are pairwise relatively prime positive integers and m = log kP. In the worst case, the computational cost of our algorithm is O(m2)k-ary digit operations. Copyright © 2013 John Wiley & Sons, Ltd.

Research and Hardware Design of Scalable Dual-Field Montgomery Modular Inversion Algorithm

The modular inversion is an essential and the most time consuming arithmetic operation in Elliptic Curve Cryptography (ECC). This paper presents an improved scalable dual-field Montgomery modular inversion algorithm which is based on Kaliski algorithm. It can support the prime number modular inversion algorithm and binary modular inversion algorithm. According to the algorithm, the hardware architecture is designed. The result of experimentation shows that the hardware design is superior to other hardware designs in operation time, circuit area and flexibility.

Dual-field Modular Multiplication Algorithm and Modular Inversion Algorithm with VLSI Implementation

有限域上的模乘和模逆运算是椭圆曲线密码体系的两个核心运算。该文在Blakley算法的基础上提出一种radix-4快速双有限域模乘算法，该算法采用Booth编码技术将原算法的迭代次数减少一半，并利用符号估计技术简化约减操作；在扩展Euclidean求逆算法的基础上提出一种能够同时支持双有限域运算的高效模逆算法，该算法不仅避免了大整数比较操作，而且提高了算法在每次迭代过程中的移位效率。然后针对这两种算法特点设计出一种能够同时完成双有限域上模乘和模逆操作的统一硬件结构。实现结果表明：256位的模乘和模逆统一硬件电路与同类型设计相比较，在电路面积没有增加的情况下，模乘运算速度提高68%，模逆运算的速度也提高了17.4%。

Design and implementation of dual-field modular inversion algorithm

Modular inverse arithmetic plays an important role in elliptic curve cryptography. Based on the analysis of Montgomery modular inversion algorithm, this paper presents a new dual-field modular inversion algorithm, and a novel scalable and unified architecture for Montgomery inverse hardware in finite fields GF(p) and GF(2n) is proposed. Furthermore, this architecture based on the new modular inversion algorithm has been verified by modeling it in Verilog-HDL, and accomplished it under 0.18 μm CMOS technology. The result indicates that our work has better performance and flexibility than other works.

Improved Modular Inversion over GF(p)

This paper proposed a new modular inverse algorithm based on the right-shifting binary Euclidean algorithm. For an n-bit numbers, the number of operations for the proposed algorithm is reduced about 61.3% less than the classical binary extended Euclidean algorithm. The proposed algorithm implementation shows substantial reduction in computation time over Galois field GF(p).

Improvement to Montgomery Modular Inverse Algorithm

After a comprehensive study on the Montgomery modular inverse algorithm and its revised versions, two modified high radix algorithms are proposed which utilize higher radix to reduce iterations needed without increasing complexity much, thereby accelerating the process. The radix-4 algorithm can reduce the average number of iterations from 1.4 n to 0.82 n and a software experiment shows the speedup is about 11 percent and iterations are 41.5 percent less on average. The radix-8 algorithm can reduce the average number of iterations to 0.73 n, but it is more complicated, which makes it suitable only for very large numbers (2,048 bits) in the experiment, where the speedup can be 13-18 percent. The proposed algorithms are suitable for software implementations on general-purpose microprocessors

Hardware Elliptic Curve Cryptographic Processor Over<tex>$rm GF(p)$</tex>

A novel hardware architecture for elliptic curve cryptography (ECC) over <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$ GF(p)$</tex> is introduced. This can perform the main prime field arithmetic functions needed in these cryptosystems including modular inversion and multiplication. This is based on a new unified modular inversion algorithm that offers considerable improvement over previous ECC techniques that use Fermat's Little Theorem for this operation. The processor described uses a full-word multiplier which requires much fewer clock cycles than previous methods, while still maintaining a competitive critical path delay. The benefits of the approach have been demonstrated by utilizing these techniques to create a field-programmable gate array (FPGA) design. This can perform a 256-bit prime field scalar point multiplication in 3.86 ms, the fastest FPGA time reported to date. The ECC architecture described can also perform four different types of modular inversion, making it suitable for use in many different ECC applications.

Improved Montgomery modular inverse algorithm

A new, single and unified Montgomery modular inverse algorithm, which performs both classical and Montgomery modular inversion, is proposed. This reduces the number of Montgomery multiplication operations required by 33% when compared with previous algorithms reported in the literature. The use of this in practice has been investigated by implementation of the improved unified algorithm and the previous algorithms on FPGA devices. The unified algorithm implementation shows a significant speed-up and a reduction in silicon area usage.

Fast GF ( p ) modular inversion algorithm suitable for VLSI implementation

A new, efficient algorithm for modular inversion in Galois field GF( p) is presented. Very large scale integration (VLSI) implementation of the algorithm is described and the high performance and low silicon penalty is demonstrated.

The Montgomery inverse and its applications

The Montgomery inverse of b module a is b/sup -1/2/sup n/ mod a, where n is the number of bits in a. The right-shifting binary algorithm for modular inversion is shown naturally to compute the new inverse in fewer operations than the ordinary modular inverse. The new inverse facilitates recent work by Koc on modular exponentiation and has other applications in cryptography. >