Abstract:
A Montgomery multiplier for providing security of information used in smart cards from hacking by a differential power analysis attack by minimizing power consumption difference by the input data. More particularly, the Montgomery multiplier applies an asynchronous dual rail lines method wherein two lines DATAFALSE and DATATRUE are used to represent one binary data such that in order to represent binary data ‘0’, a logical high signal is applied to the DATAFALSE line, and a logical low signal is applied to the DATATRUE line. Conversely, to represent binary data ‘1’, a logical low signal is applied to the DATAFALSE line, and a logical high signal is applied to the DATATRUE line. That is, when the data is represented by the asynchronous dual rail lines method, whatever the binary data value is, the same number of logical high states and logical low states are generated. As a result, whatever binary data is to be operated, the power consumption difference of the circuit is minimized.

Description:
BACKGROUND OF THE INVENTION 
   1. Field of the Invention 
   The present invention relates to a Montgomery multiplier, and more particularly, a Montgomery multiplier for an RSA security module secured from a differential power analysis attack. 
   2. Description of the Background Art 
   With the rapid growth of the internet and the electronic commerce, smart cards have been widely used as personal authentication solutions for the electronic commerce such as internet banking, electronic cash, medical cards and traffic cards. Because they can safely store personal information, personal keys and personal certificates, necessity and demand for the smart cards are increasing drastically. Especially, different from general magnetic cards, the smart cards containing microprocessors and memory functions show excellent physical security and safely store personal information. In addition, the smart cards can be used as multifunctional cards including memory, operation and security functions. 
   Generally public key encryption is applied to the smart cards and the RSA algorithm suggested by R. L. Rivest, A. Shamir and L. Adleman in 1978 has been known as the representative public key encryption. 
   The RSA encryption algorithm is performed by modular operations based on integers over 1024 bits. Security of the RSA encryption algorithm results from difficulty of factorization in prime factors of large integer coefficients. The RSA encryption algorithm is briefly explained as follows. Two different decimals ‘p’ and ‘q’ are designated as personal keys. The product of ‘p’ and ‘q’ n(=pq) and an arbitrary integer ‘e’ that is relatively prime from φ(n) are designated as public keys. Here, φ(n) represents a number of elements relatively prime from ‘n’. In addition, ‘d’ satisfying e·d=1 (mod φ(n)) is calculated and used as a personal key. That is, ‘p’, ‘q’ and ‘d’ are personal keys and ‘n’ and ‘e’ are public keys. 
   In encryption, a plain text M is calculated as an encrypt text C=M e  mod n by using the public key ‘e’, and calculated as a decrypt text M=C d  mod n. As described above, the RSA security module performs encryption and decryption by taking modular exponentiation to the pubic or personal key. The modular exponentiation is consecutive modular multiplications and the modular multiplication is consecutive additions. Normally used is a Montgomery algorithm that does not have to consider carry delay in the operation. For example, a Montgomery multiplier actually performs ABR −1  mod N instead to calculate AB mod N, wherein R is an integer relatively prime from N and larger than N. 
   However, side channel information that is not considered in encryption algorithm design for the smart cards exists. The side channel information is classified into time differential information showing time operation differences in an operation of a microprocessor, signal information leaked from a power line, mis-operation information caused by defect inputs, and information by electromagnetic leakage, and etc. 
   Smart card attack techniques by side channels are generally called side channel attacks, and divided into a time differential attack by time differential information, an defect input attack by defect mis-operation information, an electromagnetic leakage attack by the electromagnetic leakage information, and a power analysis attack by power line leakage information. 
   Here, the power analysis attack means a password decryption technique by which binary codes of various information is read by measuring instantaneous voltage (power) variations of an IC chip when an encryption algorithm and a secret key for encryption built in the card start to operate, and important information is analyzed according to a statistical method, and forged/modulated as well. The power analysis attack is classified into a simple power analysis attack, a differential power analysis attack, an inference power analysis attack and a high-degree differential power analysis attack. Especially, the differential power analysis attack can estimate the secret key merely by using a few devices for measuring voltage variations. Accordingly, the differential power analysis attack is deemed to be more efficient than a brute-force attack using an exclusive encryption device or a super computer. 
     FIGS. 1A and 1B  are circuit diagrams illustrating a structure and operation of a synchronous XOR circuit generally applied to the Montgomery multiplier. 
   
     
       
             
             
             
           
         
             
               TABLE 1 
             
             
                 
             
             
               A IN     —     TRUE   
               B IN     —     TRUE   
               OUT TRUE   
             
             
                 
             
           
           
             
               0 
               0 
               0 
             
             
               0 
               1 
               1 
             
             
               1 
               0 
               1 
             
             
               1 
               1 
               0 
             
             
                 
             
           
        
       
     
   
   Referring to  FIG. 1A , an XOR gate  10  receives two input signals A IN     —     TRUE  and B IN     —     TRUE  as shown in Table 1. When the two input values are different, the XOR gate  10  outputs a logical high value, and when the two input values are identical, the XOR gate  10  outputs a logical low value. 
   In  FIG. 1B , the gate-level synchronous XOR circuit of  FIG. 1A  is designed in a transistor level. 
   As illustrated in  FIG. 1B , the synchronous XOR circuit includes the first P type transistor P 101  and the first N type transistor N 101  driven by the first input signal A 1  and connected in series between a power supply node and a ground node, the second P type transistor P 102  and the second N type transistor N 102  driven by the voltage applied to the output node of the first P type transistor P 101  and connected in series between the power supply node and the ground node, the third P type transistor P 103  and the third N type transistor N 103  driven by the second input signal A 2  and connected in series between the power supply node and the ground node, the fourth P type transistor P 104  driven by the voltage applied to the output node of the third P type transistor P 103  and receiving the voltage applied to the output node of the second P type transistor P 102 , the fourth N type transistor N 104  driven by the second input signal A 2  and receiving the voltage applied to the output node of the second P type transistor P 102 , the fifth P type transistor P 105  driven by the second input signal A 2  and receiving the voltage applied to the output node of the first P type transistor P 101 , the fifth N type transistor P 105  driven by the voltage applied to the output node of the third P type transistor P 103  and receiving the voltage applied to the output node of the first P type transistor P 101 , and the sixth P type transistor P 106  and the sixth N type transistor N 106  driven by the voltage applied to the output node of the fourth P and N type transistors P 104  and N 104  and the output node of the fifth P and N type transistors P 105  and N 105 , and connected in series between the power supply node and the ground node. The output node of the sixth P type transistor P 106  outputs the final output value. 
   Still referring to  FIG. 1B , when the output value OUT TRUE  is low, five of the ten transistors are turned on, but when the output value OUT TRUE  is high, three of them are turned on. That is, in the synchronous XOR circuit, the number of the switched transistors is changed according to the input values, and thus power consumption is changed. Such power difference makes the module weak to the differential power analysis attack. 
   Required is an operation logic for solving the problems of the synchronous XOR circuit applied to the Montgomery multiplier, and minimizing correlations between internally-operated binary data and power consumption patterns. 
     FIG. 2  shows a data representation method by a synchronous single line method and an asynchronous double line method. 
   By the synchronous single line method, the data is represented as logical high or low states according to binary data ‘0’ or ‘1’. For example, as shown in  FIG. 2 , data ‘0100110’ represents, three logical high states and four logical high states according to input of a clock signal. 
   On the other hand, by the asynchronous double line method, two lines DATA FALSE  and DATA TRUE  are used to represent one binary data. In order to represent binary data ‘0’, a logical high signal is applied to the DATA FALSE  line, and a logical low signal is applied to the DATA TRUE  line. Conversely, to represent binary data ‘1’, a logical low signal is applied to the DATA FALSE  line, and a logical high signal is applied to the DATA TRUE  line. 
   In the case that the data is represented by the asynchronous double line method, whatever the binary data value is, the same number of logical high states and logical low states are generated. Accordingly, whatever binary data is to be operated, power consumption difference of the circuit is minimized. 
   When the RSA security module is formed by using the aforementioned characteristics of the asynchronous double line method, the differential power analysis attack can be defended. 
     FIGS. 3A to 3C  are circuit diagrams illustrating a structure and operation of an asynchronous XOR circuit. 
   As shown in  FIG. 3A , all items that can be generated by two input binary data A IN     —     TRUE , A IN     —     FALSE , B IN     —     TRUE  and B IN     —     FALSE  are generated by C-element devices  20 ,  22 ,  24  and  26 , and the outputs from the C-element devices  20 ,  22 ,  24  and  26  are combined by OR gates  30  and  32 . 
     FIG. 3B  is an exemplary diagram illustrating transistor-level design of the C-element devices  20 ,  22 ,  24  and  26  of  FIG. 3A . The C-element device  20  includes the first to the fifth P type transistors P 201 , P 202 , P 203 , P 204  and P 205 , and the first to the fifth N type transistors N 201 , N 202 , N 203 , N 204  and N 205 .  FIG. 3C  is an exemplary diagram illustrating transistor-level design of the OR gates  30  and  32  of  FIG. 3A . The OR gate  30  is driven by the output signals C 1  and C 2  from the two C-element devices  20  and  22 , and includes the first to the third P type transistors P 301 , P 302  and P 303  and the first to the third N type transistors N 301 , N 302  and N 303 . 
   In the asynchronous XOR circuit, the number of the switched transistors is not changed according to the input values. However, since excessively many C-element devices are used, large space for the circuit is needed. 
   SUMMARY OF THE INVENTION 
   The present invention is achieved to solve the above problems. Accordingly, it is an object of the present invention to provide a Montgomery multiplier which is secured from a differential power analysis attack and to reduce the size in design of an RSA security module. 
   In order to achieve the above-described object of the invention, there is provided a Montgomery multiplier for an RSA security module, including: the first filtering means for receiving the first input signal and the second input signal represented by an asynchronous double line method, and selectively outputting the second input signal according to a logical value of the first input signal; the first carry save adder for outputting a sum and a carry of double line method by adding up a carry signal and a sum signal generated in a previous calculation procedure and the output signal from the first filtering means; the second filtering means for receiving a logical value of a least significant sum of the first carry save adder as the third input signal and a modular operation factor as the fourth signal, and filtering the fourth input signal according to the third input signal; the second carry save adder for generating a sum and a carry of double line method, by adding up the carry and the sum outputted from the first carry save adder and the output from the second filtering means; a carry storing means and a sum storing means for storing the carry and the sum from the second carry save adder; a carry propagation adder for calculating the final result by adding up the data stored in the carry storing means and the sum storing means; and an operation completion sensing means for deciding operation completion according to the output signal from the second carry save adder. 

   
     BRIEF DESCRIPTION OF THE DRAWINGS 
     The present invention will become better understood with reference to the accompanying drawings which are given only by way of illustration and thus are not limitative of the present invention, wherein: 
       FIGS. 1A and 1B  are circuit diagrams illustrating a structure and operation of a synchronous XOR circuit; 
       FIG. 2  is an exemplary diagram illustrating a data representation method by a synchronous single line method and an asynchronous double line method; 
       FIGS. 3A to 3C  are circuit diagrams illustrating a structure and operation of an asynchronous XOR circuit; 
       FIG. 4  is a circuit diagram illustrating a structure of a Montgomery multiplier in accordance with the present invention; 
       FIGS. 5A to 5C  are circuit diagrams illustrating a structure and operation of a filtering means in accordance with the present invention; 
       FIGS. 6A to 6C  are circuit diagrams illustrating a structure and operation of an XOR circuit in accordance with the present invention; and 
       FIG. 7  is a circuit diagram illustrating a structure and operation of an operation completion sensing means in accordance with the present invention. 
   

   DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
   A Montgomery multiplier for an RSA security module in accordance with a preferred embodiment of the present invention will now be described in detail with reference to the accompanying drawings. 
     FIG. 4  is a circuit diagram illustrating the structure of the Montgomery multiplier in accordance with the present invention. The Montgomery multiplier actually performs ABR −1  mod N instead to calculate AB mod N. wherein R is an integer relatively prime from N and larger than N. 
   The Montgomery multiplier  100  includes the first filtering means  110  for receiving the first input signal A and the second input signal B, and selectively outputting the second input signal B according to a logical value of the first input signal A, the first carry save adder  130  for outputting a sum and a carry of double line method by adding up a carry signal generated in a previous calculation procedure, the output signal from the first filtering means  110  and a sum signal generated in a previous calculation procedure, the second filtering means  120  for receiving a logical value of a least significant sum of the first carry save adder  130  as the first input signal and a modular operation factor N as the second input signal, and filtering the second input signal that is the modular operation factor N according to the first input signal, the second carry save adder  132  for generating a sum and a carry of double line method, by adding up the carry and the sum from the first carry save adder  130  and the output from the second filtering means  120 , a carry storing means  140  and a sum storing means  150  for storing the carry and the sum from the second carry save adder  132 , a carry propagation adder  170  for calculating the final result by adding up the data stored in the carry storing means  140  and the sum storing means  150 , an operation completion sensing means  160  for deciding operation completion, and a controller  180  for controlling the whole operation. 
   When the logical value of the first input signal A is ‘1’ (‘10’ in double line representation), the first filtering means  110  outputs the second input signal B as the resultant value, when the logical value of the first input signal A is ‘0’ (‘01’ in double line representation), the first filtering means  110  outputs logical 0 (‘01’ in double line representation), and when the logical value of the first input signal A does not exist (NO DATA), the first filtering means  110  outputs logical NO DATA regardless of the second input signal B. The second filtering means  120  receives the least significant data of the first carry save adder  130  as the first input signal and the modular operation factor N as the second signal, and operates in the same manner as the first filtering means  110 . 
     FIGS. 5A to 5C  are circuit diagrams illustrating the structure and operation of the filtering means in accordance with the present invention. 
   As illustrated in  FIG. 5A , each of the filtering means  110  and  120  includes the first logical element  40  for outputting a high signal only when two binary data A IN     —     TRUE  and B IN     —     TRUE  inputted to a DATA TRUE  line are logical high, and the second logical element  50  for outputting a low signal only when two binary data A IN     —     FALSE  and B IN     —     FALSE  inputted to a DATA FALSE  line are logical low. Here, the first logical element  40  can be comprised of an AND gate and the second logical element  50  can be comprised of an OR gate. 
   In  FIG. 5B , the first logical element  40  of  FIG. 5A  is designed in a transistor level. The first logical element  40  includes the first and the second P type transistors P 401  and P 402  connected in parallel to a power supply node and driven by the first input signal A 1  and the second input signal B 1 , respectively, the first and the second N type transistors N 401  and N 402  connected in series between the output node of the first and the second P type transistors P 401  and P 402  and a ground node, and driven by the first input signal A 1  and the second input signal B 1 , respectively, and the third P type transistor P 403  and the third N type transistor N 403  driven by the voltage applied to the output node of the first and the second P type transistors P 401  and P 402 , and connected in series between the power supply node and the ground node. The voltage applied to the output node of the third P type transistor P 403  becomes the output signal from the whole circuit. 
   In the transistor-level circuit of the first logical element  40  of  FIG. 5B , when the two input signals A 1  and B 1  are ‘0’ and ‘1’ respectively, the first P type transistor P 401 , the second N type transistor N 402  and the third N type transistor N 403  are turned on, and the other three transistors P 402 , N 401  and P 403  are turned off. In addition, when the two input signals A 1  and B 1  are ‘1’ and ‘1’, the first N type transistor N 401 , the second N type transistor N 402  and the third P type transistor P 403  are turned on, and the other three transistors P 401 , P 402  and N 403  are turned off. That is, the number of the switched transistors is not influenced by the input signals. 
   In  FIG. 5C , the second logical element  50  of  FIG. 5A  is designed in a transistor level. The second logical element  50  includes the fourth P type transistor P 501  connected to a power supply node and driven by the third input signal A 2  and the fourth input signal B 2 , the fifth P type transistor P 502  connected in series to the fourth P type transistor P 501 , the fourth and the fifth N type transistors N 501  and N 502  connected in parallel between the fifth P type transistor P 502  and a ground node and driven by the third input signal A 2  and the fourth input signal B 2 , respectively, and the sixth P type transistor P 503  and the sixth N type transistor N 503  driven by the voltage applied to the output node of the fifth P type transistor P 502  and connected in series between the power supply node and the ground node. The voltage applied to the output node of the sixth P type transistor P 503  becomes the output signal of the whole circuit. 
   In the transistor-level circuit of the second logical element  50 , when the two input signals A 2  and B 2  are ‘0’ and ‘1’ respectively, the fourth P type transistor P 501 , the fifth N type transistor N 502  and the sixth P type transistor P 503  are turned on, and the other transistors P 502 , N 501  and N 503  are turned off. In addition, when the two input signals A 2  and B 2  are ‘1’ and ‘1’, the fourth N type transistor N 501 , the fifth N type transistor N 502  and the sixth P type transistor P 503  are turned on, and the other transistors P 501 , P 502  and N 503  are turned off. That is, the number of the switched transistors is not influenced by the input signals. 
   The operation of the filtering means  110  and  120  of  FIG. 5A  will now be explained. 
   In accordance with the asynchronous double line method, logical data ‘0’ is represented as ‘01’, and logical data ‘1’ is represented as ‘10’. Table 2 shows the output values of the filtering means  110  and  120  in regard to the two input binary data (actually, four data). 
   
     
       
             
             
           
             
             
             
             
           
             
             
             
             
             
           
         
             
                 
               TABLE 2 
             
           
           
             
                 
                 
             
             
                 
               A 
             
           
        
         
             
                 
               00 (logical 
               01 
               10 
             
             
                 
               NO DATA) 
               (logical 0) 
               (logical 1) 
             
             
                 
                 
             
           
        
         
             
               B 
               00 (logical NO 
               00 
               00 
               00 
             
             
                 
               DATA) 
             
             
                 
               01 (logical data 0) 
               00 
               01 
               01 
             
             
                 
               10 (logical data 1) 
               00 
               01 
               10 
             
             
                 
             
           
        
       
     
   
   Referring to  FIG. 5A , when two logical data ‘01’ are inputted, namely, when A IN     —     TRUE  is ‘0’, A IN     —     FALSE  is ‘1’, B IN     —     TRUE  is ‘1’ and B IN     —     FALSE  is ‘0’, the output signal OUT TRUE  from the first logical element  40  is ‘0’ and the output signal OUT FALSE  from the second logical element  50  is ‘1’. That is, the logical data ‘0’ is outputted. In addition, when two logical data ‘11’ are inputted, namely, when A IN     —     TRUE  is ‘1’, A IN     —     FALSE  is ‘0’, B IN     —     TRUE  is ‘1’ and B IN     —     FALSE  is ‘0’, the output signal OUT TRUE  from the first logical element  40  is ‘1’ and the output signal OUT FALSE  from the second logical element  50  is ‘0’. That is, the logical data ‘1’ is outputted. 
   As described above, when the first input signal A is logical ‘1’, the filtering means  110  and  120  output the second input signal B as it is, and when the first input signal A is logical ‘0’, the filtering means  110  and  120  output logical ‘0’, and when the data is not inputted to the first input signal A (NO DATA), the filtering means  110  and  120  output logical NO DATA, thereby filtering and outputting the second input signal B. 
   The first and the second carry save adders  130  and  132  and the carry propagation adder  170  will now be described. 
   The first and the second carry save adders  130  and  132  and the carry propagation adder  170  can be comprised of full adders for adding up the two input binary data A and B and the carry signal Cin generated in the previous adding up procedure. The full adders are represented by the following formula 1: 
   Formula 1
 
(SUM)=( A  XOR  B ) XOR  Cin  
 
CARRY=( A  AND  B ) OR ( A  AND  Cin ) OR ( B  AND  Cin )
 
   The AND and OR operations required in formula 1 can be performed by the circuits of  FIGS. 5B and 5C .  FIG. 6  shows gate-level and transistor-level design for the XOR operation. 
     FIGS. 6A to 6C  are circuit diagrams illustrating the structure and operation of the XOR circuit in accordance with the present invention. 
   As depicted in  FIG. 6A , the XOR circuit includes the first operation unit  60  for receiving two binary signals (actually, four signals), and outputting ‘0’ when the two binary signals are identical, and the second operation unit  70  for outputting ‘1’ when the two binary signals are different. 
   The first operation unit  60  includes the third logical element  610  for receiving the TRUE signal A IN     —     TRUE  of the first input signals A and the FALSE signal B IN     —     FALSE  of the second input signals B, and outputting ‘0’ when the two input signals are logical ‘0’, the fourth logical element  620  for receiving the FALSE signal A IN     —     FALSE  of the first input signals A and the TRUE signal B IN     —     TRUE  of the second input signals B, and outputting ‘0’ when the two input signals are logical ‘0’, and the fifth logical element  630  for receiving the output signals from the third and the fourth logical elements  610  and  620 , and outputting ‘1’ when the input signals are ‘1’. Here, the output from the fifth logical element  630  becomes the FALSE output from the asynchronous double line method XOR circuit. 
   The second operation unit  70  includes the sixth logical element  710  for receiving the FALSE signal A IN     —     FALSE  of the first input signals A and the TRUE signal B IN     —     TRUE  of the second input signals B, and outputting ‘1’ when the two input signals are logical ‘1’, the seventh logical element  720  for receiving the TRUE signal A IN     —     TRUE  of the first input signals A and the FALSE signal B IN     —     FALSE  of the second input signals B, and outputting ‘1’ when the two input signals are logical ‘1’, and the eighth logical element  730  for receiving the output signals from the sixth and the seventh logical elements  710  and  720 , and outputting ‘0’ when the input signals are ‘0’. Here, the output from the third logical element  780  becomes the TRUE output from the asynchronous double line method XOR circuit. 
   Here, the third logical element  610 , the fourth logical element  620  and the eighth logical element  730  can be comprised of OR gates, and the fifth logical element  630 , the sixth logical element  710  and the seventh logical element  720  can be comprised of AND gates.  FIGS. 5B and 5C  show the transistor-level design thereof. 
   Table 3 shows a truth table of the XOR circuit of  FIG. 6A . 
   
     
       
             
             
             
             
             
             
           
         
             
               TABLE 3 
             
             
                 
             
             
               A IN     —     TRUE   
               B IN     —     FALSE   
               A IN     —     FALSE   
               B IN     —     TRUE   
               OUT FALSE   
               OUT TRUE   
             
             
                 
             
           
           
             
               0 
               1 
               1 
               0 
               1 
               0 
             
             
               0 
               0 
               1 
               1 
               0 
               1 
             
             
               1 
               1 
               0 
               0 
               0 
               1 
             
             
               1 
               0 
               0 
               1 
               1 
               0 
             
             
                 
             
           
        
       
     
   
     FIG. 6B  is an exemplary diagram illustrating transistor-level design of the first operation unit  60  of  FIG. 6A . 
   As shown in  FIG. 6B , the first operation unit  60  includes the seventh P type transistor P 601  connected to a power supply node and driven by the first input signal A 1 , the eighth P type transistor P 602  connected in series to the seventh P type transistor P 601  and driven by the second input signal B 1 , the seventh N type transistor N 601  connected in series to the eighth P type transistor P 602  and driven by the second input signal B 1 , the eighth N type transistor N 602  connected between the seventh N type transistor N 601  and a ground node and driven by the fourth input signal B 2 , the ninth P type transistor P 603  connected to the power supply node and driven by the third input signal A 2 , the tenth P type transistor P 604  connected in series to the ninth P type transistor P 603  and driven by the fourth input signal B 2 , the ninth N type transistor N 603  connected in series between the tenth P type transistor P 604  and the seventh N type transistor N 601  and driven by the first input signal A 1 , the tenth N type transistor N 604  connected between the ninth N type transistor N 603  and the ground node and driven by the third input signal A 2 , and the 11 th  P and N type transistors P 605  and N 605  driven by the voltage applied to the eighth and the tenth P type transistors P 602  and P 604  and connected in series between the power supply node and the ground node. The voltage applied to the output node of the 11 th  P type transistor P 605  becomes the final output signal. 
     FIG. 6C  is an exemplary diagram illustrating transistor-level design of the second operation unit  70  of  FIG. 6A . 
   As illustrated in  FIG. 6C , the second operation unit  70  includes the 12 th  P type transistor P 701  conriected to the power supply node and driven by the first input signal A 1 , the 13 th  P type transistor P 702  connected in series to the 12 th  P type transistor P 701  and driven by the second input signal B 1 , the 12 th  N type transistor N 701  connected in series to the 13 th  P type transistor P 702  and driven by the third input signal A 2 , the 13 th  N type transistor N 702  connected between the 12 th  N type transistor N 701  and the ground node and driven by the first input signal A 1 , the 14 th  P type transistor P 703  connected between the power supply node and the output node of the 12 th  P type transistor P 701  and driven by the third input signal A 2 , the 15 th  P type transistor P 704  connected in series to the 14 th  P type transistor P 703  and driven by the fourth input signal B 2 , the 14 th  N type transistor N 703  connected in series to the 15 th  P type transistor P 704  and driven by the fourth input signal B 2 , the 15 th  N type transistor N 704  connected in series between the 14 th  N type transistor N 703  and the ground node and driven by the second input signal B 1 , and the 16 th  P and N type transistors P 705  and N 705  driven by the voltage applied to the 13 th  and the 15 th  P type transistors P 702  and P 704  and connected in series between the power supply node and the ground node. The voltage applied to the output node of the 16 th  P type transistor P 705  becomes the final output signal. 
   In the first and the second operation units  60  and  70  of  FIGS. 6B and 6C , the number of the switched transistors is always identical regardless of the input signals. 
   For example, when ‘0110’ are inputted as the first to the fourth input signals of  FIG. 6B , the seventh P type transistor P 601 , the tenth P type transistor P 604 , the 11 th  P type transistor P 605 , the seventh N type transistor N 601  and the tenth N type transistor N 604  are turned on, and the other transistors are turned off. In addition, when ‘1001’ are inputted as the first to the fourth input signals, the seventh P type transistor P 601 , the tenth P type transistor P 604 , the 11 th  P type transistor P 605 , the seventh N type transistor N 601  and the tenth N type transistor N 604  are turned off, and the other transistors are turned on. 
   On the other hand, when ‘0110’ are inputted as the first to the fourth input signals of  FIG. 6C , the 12 th  P type transistor P 701 , the 15 th  P type transistor P 704 , the 16 th  P type transistor P 705 , the 12 th  N type transistor N 701  and the 15 th  N type transistor N 704  are turned on, and the other transistors are turned off. In addition, when ‘1001’ are inputted as the first to the fourth input signals, the 12 th  P type transistor P 701 , the 15 th  P type transistor P 704 , the 16 th  P type transistor P 705 , the 12 th  N type transistor N 701  and the 15 th  N type transistor N 704  are turned off, and the other transistors are turned on. 
     FIG. 7  is a circuit diagram illustrating the structure and operation of the operation completion sensing means in accordance with the present invention. 
   The operation completion sensing means  160  includes a plurality of the ninth logical elements  80 - 1  to  80 -N for receiving the carry and sum from the second carry save adder  132  by repetitive multiplications, and confirming whether they are correct or not, and the tenth logical element  90  for checking validity of the whole data by integrating the resultant values of the ninth logical elements  80 - 1  to  80 -N. Here, the ninth logical elements  80 - 1  to  80 -N can be comprised of OR gates for outputting ‘0’ only when the two input signals are ‘0’, and the tenth logical element  90  can be comprised of an AND gate for outputting ‘1’ only when all input signals are ‘1’. Such logical elements can be embodied as shown in  FIGS. 5B and 5C . 
   As discussed earlier, in accordance with the present invention, the Montgomery multiplier for the RSA security module can prevent hacking by the differential power analysis attack, by minimizing power consumption difference by the input data. 
   Moreover, the Montgomery multiplier can compose an area-efficient circuit, by representing the data using the asynchronous double line method and minimizing the number of the used transistors. 
   As the present invention may be embodied in several forms without departing from the spirit or essential characteristics thereof, it should also be understood that the above-described embodiment is not limited by any of the details of the foregoing description, unless otherwise specified, but rather should be construed broadly within its spirit and scope as defined in the appended claims, and therefore all changes and modifications that fall within the metes and bounds of the claims, or equivalences of such metes and bounds are therefore intended to be embraced by the appended claims.