Design of a Linear Systolic Array for Computing Modular Multiplication and Squaring in GF ( 2 m )

K e y w o r d s P u b l i c key cryptosystem, Montgomery algorithm, Common-multiplicand multiplication, Modular exponentiation, Systolic array. 1. I N T R O D U C T I O N Galois fields have gained numerous practical applications in modern communication fields, such as error-correcting code, switching theory, cryptography, and digital signal processing. An example of cryptographic applications is the Diffie-Hellman key exchange algorithm [1]. This system is based on modular exponentiation over Galois field GF(2m). The modular exponentiation can also be used to perform public-key data exchange and digital signatures as shown by E1Gamal [2]. The exponentiation operation can be implemented using a series of squaring and multiplication operations in GF(2 'n) using the binary method. Recently, several types of multipliers for GF(2m), which is of particular interest for many applications, have been proposed. The multiplication circuits proposed in [3,4] have complex, irregular communication and control structures, and thus are not suitable for VLSI implementation. There are three different popular basis representations for elements of GF(2m), and the multipliers of these types easily realized using VLSI techniques have been proposed. These are 0898-1221/01/$ see front mat ter (~) 2001 Elsevier Science Ltd. All rights reserved. Typeset by A AdS-TE x PII: S0898-1221 (01)00147-X 232 W. -H. LEE et al. (1) the standard (polynomial) basis multiplier [5-7] which uses the standard basis representation for all elements of the field, (2) the dual basis multiplier [8] which uses the dual basis representation for the multiplicand and the standard basis representation for the multiplier, and (3) the Massey-Omura normal basis multiplier [9], which uses the normal basis representation for both the multiplicand and multiplier. The latter two types of finite field multipliers need basis conversion, while the former type does not. In this paper, we will restrict our interest to the standard basis. In [5], Yeh et al. designed a systolic array using the standard basis method. It is well suited to VLSI implementation, but it requires two control signals. The multipliers for GF(2 m) described in [6] and [7] are also suitable for implementation using VLSI techniques, but they involve broadcasts in data flow. It is often desirable to avoid broadcasting when we design a high-speed system. In [10], Wang and Lin proposed a systolic array based on [6]. It has unidirectional data flow. In [11,12], Yen et al. proposed the common-multiplicand multiplication concept. In this paper, we propose a time-optimal linear systolic array for computing the modular multiplication and squaring simultaneously in GF(2m). This array is efficiently used for the modular exponentiation in GF(2m). We find parallelism in the binary square and multiply the modular exponentiation algorithm [13] and analyze the Montgomery algorithm [14] for simultaneously computing modular multiplication and squaring which efficiently utilizes the common-multiplicand multiplication concept. A dependence graph (DG) from the recurrence Montgomery algorithm using the common-multiplicand is derived. According to a space-time transformation, we design systolic arrays for performing the modular squaring and multiplication from DG, and propose a time-optimal linear systolic array. In order to implement the designed systolic array into hardware, we simulate this array using ALTERA MAX+PLUS II. We compare the systolic GF(2 m) multipliers in [10] and [15] with the proposed systolic array when they are applied in computing the modular exponentiation. The proposed architecture has regularity, modularity, concurrency, and unidirectional data flow, and thus is well suited to VLSI implementation. This paper is organized as follows. Section 2 gives overview of arithmetic operations in GF(2 m) such as the Montgomery modular multiplication and modular exponentiation. The concurrent execution of the Montgomery modular multiplication is discussed in Section 3. A linear systolic array for performing both modular multiplication and squaring is designed, and its performance is analyzed in Section 4. Finally, a conclusion is given in Section 5. 2. ARITHMETIC OPERATION IN GF(2 m) 2.1. Polynomial Representation An element of Galois field GF(2 m) can be represented in several different ways [16]. The polynomial representation is useful and suitable in hardware and software implementation. The algorithm for the Montgomery multiplication described in this paper is based on the polynomial representation. According to this representation, an element of GF(2 m) is a polynomial of length m, i.e., of degree less then or equal to m 1, written as m 1 a(x ) = E aix~ = a m _ i x m-1 + a m 2 x m-2 + . + a l x + ao, i=0 where the coefficients as E GF(2). These coefficients are also referred to as the bits of an element a of GF(2m), and the element a is represented as a = ( a m l a i n 2 " ' " alao). The addition of two elements a and b in GF(2 m) is performed by adding the polynomial a(x ) and b(x), where the coefficients are added in the field GF(2). This is equivalent to bit-wise XOR operation on both a and b. In order to multiply two elements a and b in GF(2m), we need an Design of a Linear Systolic Array 233 irreducible polynomial of degree m. Let n(x) be an irreducible polynomial of degree m over the field GF(2). The product c = ab in GF(2 m) is obtained by computing c(x) = a(x)b(x) mod n(x), where c(x) is a polynomial of length m, representing the element c E GF(2m). Thus, the multiplication operation in GF(2 m) is accomplished by multiplying the corresponding polynomials modulo the irreducible polynomial n(x). 2.2. M o n t g o m e r y Mul t ip l ica t ion Algor i thm Instead of computing ab in GF(2m), the Montgomery algorithm computes abr -1 in GF(2m), where r is a special fixed element of GF(2m). Almost the same idea was proposed by Montgomery for the modular multiplication on integers. Montgomery's technique is applicable to field GF(2 m) as well. The selection of r(x) = x "n turns out to be very useful. Thus, r is an element of the field, represented by the polynomial r(x)modn(x); i.e., if n = (nmnm-1. .nlno), then r = (nm-lnm-2"'" nln0). The Montgomery multiplication method requires that r(x) and n(x) are relatively prime; i.e., gcd(r(x), n(x)) = 1. For this assumption to hold, it suffices that n(x) not be divisible by x. Since n(x) is an irreducible polynomial over the field GF(2), this will always be the case. Since r(x) and n(x) are relatively prime, there exist two polynomials rl (x) and nt(x) with the property such that r(x)r-l(x) + n(x)nl(x) = 1, where rl (x) is the inverse of r(x) modulo n(x). The polynomials rl(x) and n'(x) can be computed using the extended Euclidean algorithm. The Montgomery multiplication of a and b in GF(2 m) is defined as the product c(x) = a(x)b(x)r-l(x)modn(x), which can be computed using Algorithm 1 [17]. [Algori thm 1: M o n t g o m e r y Mul t ip l ica t ion Algor i thm for GF(2m)] Input: a(x), b(x), n(x) Outpu t : c(x) = a(x)b(x)x -m mod n(x) MMM(a(x), b(x)) Step 1. c(x) := 0 Step 2. f o r i = 0 t o m l d o Step 3. c(z) := c(z) + aib(z) Step 4. c(x) := c(x) + con(x) Step 5. c(x) := c(x)/z. 2.3. M o d u l a r Exponen t i a t ion Opera t ion The exponentiation operation can be implemented using a series of squaring and multiplication operations in GF(2 m) using the binary square and multiply algorithm [9]. This algorithm is usually employed to compute m(x)e(mod n(x)), where e can be expressed as e = ~-]in__o 1 ei2 i, and ei E {0, 1}. This algorithm has the left-to-right method and right-to-left method. The right-toleft method can be used to compute modular squaring and modular multiplication concurrently. The right-to-left binary square and multiply algorithm is represented as Algorithm 2. [Algori thm 2: Right to-Lef t Algor i thm for M o d u l a r Exponent ia t ion]