Modular Inversion Research Articles

Computing the modular inverses is as simple as computing the GCDs

In 1997, Calvez, Azou, and Vilbé proposed a variation on Euclidean algorithm, which can calculate the greatest common divisors (GCDs) and inverses for polynomials. Inspired by their work, we propose a variation on the Euclidean algorithm, which uses only simple modulo operators, to compute the modular inverses. This variant only modifies the initial values and the termination condition of the Euclidean algorithm. Therefore, computing the modular inverses is as simple as computing the GCDs.

Gaussian Laws for the Main Parameters of the Euclid Algorithms

We provide sharp estimates for the probabilistic behaviour of the main parameters of the Euclid Algorithms, both on polynomials and on integer numbers. We study in particular the distribution of the bit-complexity which involves two main parameters: digit-costs and length of remainders. We first show here that an asymptotic Gaussian law holds for the length of remainders at a fraction of the execution, which exhibits a deep regularity phenomenon. Then, we study in each framework—polynomials (P) and integer numbers (I)—two gcd algorithms, the standard one (S) which only computes the gcd, and the extended one (E) which also computes the Bezout pair, and is widely used for computing modular inverses. The extended algorithm is more regular than the standard one, and this explains that our results are more precise for the Extended algorithm: we exhibit an asymptotic Gaussian law for the bit-complexity of the extended algorithm, in both cases (P) and (I). We also prove that an asymptotic Gaussian law for the bit-complexity of the standard gcd in case (P), but we do not succeed obtaining a similar result in case (I). The integer study is more involved than the polynomial study, as it is usually the case. In the polynomial case, we deal with the central tools of the distributional analysis of algorithms, namely bivariate generating functions. In the integer case, we are led to dynamical methods, which heavily use the dynamical system underlying the number Euclidean algorithm, and its transfer operator. Baladi and Vallee (J. Number Theory 110(2):331–386, 2005) have recently designed a general framework for “distributional dynamical analysis”, where they have exhibited asymptotic Gaussian laws for a large family of parameters. However, this family does not contain neither the bit-complexity cost nor the size of remainders, and we have to extend their methods for obtaining our results. Even if these dynamical methods are not necessary in case (P), we explain how the polynomial dynamical system can be also used for proving our results. This provides a common framework for both analyses, which well explains the similarities and the differences between the two cases (P) and (I), for the algorithms themselves, and also for their analysis. An extended abstract of this paper can be found in Lhote and Vallee (Proceedings of LATIN’06, Lecture Notes in Computer Science, vol. 3887, pp. 689–702, 2006).

A Block Cipher Using Linear Congruences

We have developed a block cipher by using modular arithmetic inverse and linear congruences. The cipher contains a key matrix called the outer key. It also includes another key, which contains a set of constants involved in the linear congruences. This key is called as inner key. The cryptanalysis carried out in this paper indicates that the cipher cannot be broken by any cryptanalytic attack. This cipher is extended to the case of a larger block wherein interlacing and iteration also play a vital role.

Improved Modular Inversion over GF(p)

This paper proposed a new modular inverse algorithm based on the right-shifting binary Euclidean algorithm. For an n-bit numbers, the number of operations for the proposed algorithm is reduced about 61.3% less than the classical binary extended Euclidean algorithm. The proposed algorithm implementation shows substantial reduction in computation time over Galois field GF(p).

On the distribution of angles of the Salié sums

For a primepand integersaandb, we consider Salié sumswhere χ2(x) is a quadratic character and x¯ is the modular inversion ofx, that is,xx¯≡ 1 (modp). One can naturally associate withSp(a, b) a certain angle θp(a, b) ∈ [0, π]. We show that, for any fixed ε > 0, these angles are uniformly distributed in [0, π] whenaandbrun over arbitrary sets , ℬ ⊆ {0, 1, …,p− 1} such that there are at leastp1+εquadratic residues modulopamong the productsab, where (a, b) ∈  × ℬ.

High speed hardware architecture to compute galois fields GF(p) montgomery inversion with scalability features

Modular inversion is a fundamental process in several cryptographic systems. It can be computed in software or hardware, but hardware computation has been proven to be faster and more secure. This research focused on improving an old scalable inversion hardware architecture proposed in 2004 for finite field GF(p). The architecture comprises two parts, a computing unit and a memory unit. The memory unit holds all the data bits of computation whereas the computing unit performs all the arithmetic operations in word (digit) by word bases such that the design is scalable. The main objective of this paper is to show the cost and benefit of modifying the memory unit to include shifting, which was previously one of the tasks of the scalable computing unit. The study included remodeling the entire hardware architecture removing the shifter from the scalable computing part and embedding it in the non-scalable memory unit instead. This modification resulted in a speedup to the complete inversion process with an area increase due to the new memory shifting unit. Several design schemes have been compared giving the user the complete picture to choose from depending on the application need.

Hardware Elliptic Curve Cryptographic Processor Over<tex>$rm GF(p)$</tex>

A novel hardware architecture for elliptic curve cryptography (ECC) over <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$ GF(p)$</tex> is introduced. This can perform the main prime field arithmetic functions needed in these cryptosystems including modular inversion and multiplication. This is based on a new unified modular inversion algorithm that offers considerable improvement over previous ECC techniques that use Fermat's Little Theorem for this operation. The processor described uses a full-word multiplier which requires much fewer clock cycles than previous methods, while still maintaining a competitive critical path delay. The benefits of the approach have been demonstrated by utilizing these techniques to create a field-programmable gate array (FPGA) design. This can perform a 256-bit prime field scalar point multiplication in 3.86 ms, the fastest FPGA time reported to date. The ECC architecture described can also perform four different types of modular inversion, making it suitable for use in many different ECC applications.

Improvement to Montgomery Modular Inverse Algorithm

After a comprehensive study on the Montgomery modular inverse algorithm and its revised versions, two modified high radix algorithms are proposed which utilize higher radix to reduce iterations needed without increasing complexity much, thereby accelerating the process. The radix-4 algorithm can reduce the average number of iterations from 1.4 n to 0.82 n and a software experiment shows the speedup is about 11 percent and iterations are 41.5 percent less on average. The radix-8 algorithm can reduce the average number of iterations to 0.73 n, but it is more complicated, which makes it suitable only for very large numbers (2,048 bits) in the experiment, where the speedup can be 13-18 percent. The proposed algorithms are suitable for software implementations on general-purpose microprocessors

Communication-Computation Trade-off in Executing ECDSA in a Contactless Smartcard

Emerging standards specify a communication rate between a contactless smartcard and a terminal that is of the same order of magnitude as the internal clock rate in the card. This gives a natural ground for the known card-terminal communication-computation trade-off, where non-secure operations should rather be performed by the terminal and not in the card. In this paper we treat an implementation of Elliptic Curve Digital Signature Algorithm (ECDSA), the most cost effective digital signature algorithm, which has a potential of being executed under the heavy constraints imposed by a contactless smartcard environment. This algorithm heavily relies on numerous calculations of modular multiplicative inverses. It is shown in this paper that, based on communicating with the terminal, each modular inverse operation needed to be executed in the card during ECDSA signature generation requires only two modular multiplications in the card. Each modular inverse operation performed during signature verification requires only one modular multiplication in the card. A complete ECDSA implementation over integers or over GF(2n) is then treated in detail

Generalized Powering Functions and Their Application to Digital Signatures

This paper investigates some modular powering functions suitable for cryptography. It is well known that the Rabin encryption function is a 4-to-1 mapping and breaking its one-wayness is secure under the factoring assumption. The previously reported encryption schemes using a powering function are variants of either the 4-to-1 mapping or higher n-to-1 mapping, where n > 4. In this paper, we propose an optimized powering function that is a 3-to-1 mapping using a p2q-type modulus. The one-wayness of the proposed powering function is as hard as the infeasibility of the factoring problem. We present an efficient algorithm for computing the decryption for a p2q-type modulus, which requires neither modular inversion nor division. Moreover, we construct new provably secure digital signatures as an application of the optimized functions. In order to achieve provable security in the random oracle model, we usually randomize a message using random hashing or padding. However, we have to compute the randomization again if the randomized message is a non-cubic residue element---it is inefficient for long messages. We propose an algorithm that can deterministically find the unique cubic residue element for a randomly chosen element.

Improved DSA variant for batch verification

Batch verification is a method to verify multiple signatures at once. There are two issues associated with batch verification. One is the security problem and the other is the computational speed. In 1998, Bellare et al. have proposed an approach called small exponents test, to preserve the security of batch verification of a digital signature algorithm (DSA) variant. In this letter, we propose an efficient scheme to speed up DSA batch verification. Our scheme does not need to compute modular inverse and at the same time, the security is preserved. We have included the performance evaluation to compare computational time between our scheme and the existed DSA batch verification.

Design of Montgomery Multiplication Architecture Based on Programmable Cellular Automata

This study presents a Montgomery multiplication architecture that uses an irreducible all one polynomial (AOP) in GF(2m) based on a programmable cellular automata (PCA). The proposed architecture has the advantage of high regularity and a reduced latency based on combining the characteristics of the irreducible AOP and PCA. The proposed architecture can be used to implement modular exponentiation, division, and inversion architectures.

Hyperbolic beta integrals

Hyperbolic beta integrals are analogues of Euler's beta integral in which the role of Euler's gamma function is taken over by Ruijsenaars’ hyperbolic gamma function. They may be viewed as (q, q ̃ ) -bibasic analogues of the beta integral in which the two bases q and q̃ are interrelated by modular inversion, and they entail q-analogues of the beta integral for | q|=1. The integrals under consideration are the hyperbolic analogues of the Ramanujan integral, the Askey–Wilson integral and the Nassrallah–Rahman integral. We show that the hyperbolic Nassrallah–Rahman integral is a formal limit case of Spiridonov's elliptic Nassrallah–Rahman integral.

Improved Montgomery modular inverse algorithm

A new, single and unified Montgomery modular inverse algorithm, which performs both classical and Montgomery modular inversion, is proposed. This reduces the number of Montgomery multiplication operations required by 33% when compared with previous algorithms reported in the literature. The use of this in practice has been investigated by implementation of the improved unified algorithm and the previous algorithms on FPGA devices. The unified algorithm implementation shows a significant speed-up and a reduction in silicon area usage.

Efficient scalable VLSI architecture for Montgomery inversion in [formula omitted

The multiplicative inversion operation is a fundamental computation in several cryptographic applications. In this work, we propose a scalable VLSI hardware to compute the Montgomery modular inverse in GF( p) . We suggest a new correction phase for a previously proposed almost Montgomery inverse algorithm to calculate the inversion in hardware. We also propose an efficient hardware algorithm to compute the inverse by multi-bit shifting method. The intended VLSI hardware is scalable, which means that a fixed-area module can handle operands of any size. The word-size, which the module operates, can be selected based on the area and performance requirements. The upper limit on the operand precision is dictated only by the available memory to store the operands and internal results. The scalable module is in principle capable of performing infinite-precision Montgomery inverse computation of an integer, modulo, a prime number. This scalable hardware is compared with a previously proposed fixed (fully parallel) design showing very attractive results.

Fast GF (p) modular inversion algorithm suitable for VLSI implementation

A new, efficient algorithm for modular inversion in Galois field GF( p) is presented. Very large scale integration (VLSI) implementation of the algorithm is described and the high performance and low silicon penalty is demonstrated.

The Montgomery modular inverse-revisited

We modify an algorithm given by Kaliski to compute the Montgomery inverse of an integer modulo a prime number. We also give a new definition of the Montgomery inverse, and introduce efficient algorithms for computing the classical modular inverse, the Kaliski-Montgomery inverse, and the new Montgomery inverse. The proposed algorithms are suitable for software implementations on general-purpose microprocessors.

The CREW PRAM Complexity of Modular Inversion

One of the long-standing open questions in the theory of parallel computation is the parallel complexity of the integer gcd and related problems, such as modular inversion. We present a lower bound $\Omega (\log n)$ for the parallel time on a concurrent-read exclusive-write parallel random access machine (CREW PRAM) computing the inverse modulo certain n-bit integers, including all such primes. For infinitely many moduli, our lower bound matches asymptotically the known upper bound. We obtain a similar lower bound for computing a specified bit in a large power of an integer. Our main tools are certain estimates for exponential sums in finite fields.

GOST 34.10—A brief overview of Russia's DSA

GOST 34.10 is Russia's DSA. Like its US counterpart, GOST is an ElGamal-like signature scheme used in Schnorr mode. It is similar to NIST DSA in many aspects. In this paper we will overview GOST 34.10 and discuss the three main differences between the two algorithms, (i) GOST's principal design criterion does not seem to be computational efficiency: the algorithm is 1.6 times slower than the DSA and produces 512-bit signatures. This is mainly due to the usage of the modulus q which is at least 254 bits long. During verification, modular inverses are computed by exponentiation (while the Extended Euclidian algorithm is roughly 100 times faster for this parameter size) and the generation of the public parameters is much more complicated than in the DSA. This choice of the parameters makes GOST 34.10 very secure. (ii) GOST signers do not have to generate modular inverses as the basic signature equation is s = xr + mk (mod q) instead of s = (m + xr) k (mod q). (iii) GOST's hash function (the Russian equivalent of the SHA) is the standard GOST 34.11 which uses the block cipher GOST 28147 (partially classified) as a building block. The hash function will be briefly described. Copyright

The Montgomery inverse and its applications

The Montgomery inverse of b module a is b/sup -1/2/sup n/ mod a, where n is the number of bits in a. The right-shifting binary algorithm for modular inversion is shown naturally to compute the new inverse in fewer operations than the ordinary modular inverse. The new inverse facilitates recent work by Koc on modular exponentiation and has other applications in cryptography. >