A Scalable Montgomery Modular Multiplication Architecture with Low Area-Time Product Based on Redundant Binary Representation

Abstract

The Montgomery modular multiplication is an integral operation unit in the public key cryptographic algorithm system. Previous work achieved good performance at low input widths by combining Redundant Binary Representation (RBR) with Montgomery modular multiplication, but it is difficult to strike a good balance between area and time as input bit widths increase. To solve this problem, based on the redundant Montgomery modular multiplication, in this paper, we propose a flexible and pipeline hardware implementation of the Montgomery modular multiplication. Our proposed structure guarantees a single-cycle delay between two-stage pipeline units and reduces the length of the critical path by redistributing the data paths between the pipelines and preprocessing the input in the loop. By analyzing the structure and comparing the related work in this paper, our structure ensures a lower area-time product while achieving a controllable and small area consumption. The comprehensive results under different Taiwan Semiconductor Manufacturing Company (TSMC) processes demonstrate the advantages of our structure in terms of flexibility and area-time product.

1. Introduction

Many public key cryptosystems such as Rivest–Shamir–Adleman (RSA), elliptic curve cryptography (ECC), and sm9 require a lot of modular multiplication. Conventional modular multiplication is an expensive operation, as it requires division; this would take a lot of time and space to implement in hardware. What’s more, for RSA, some operands can even reach 8192 bits, which means there is no suitable solution for traditional modulo multiplication methods. To solve this problem, Montgomery Modular Multiplication (MMM) [1] has been raised, which is an efficient method for calculating large integer modular multiplication by replacing the modular operation with a simple shift operation for hardware systems.

Several efforts have been made to optimize MMM’s hardware implementation. Some papers mainly focus on using different multiplication algorithms such as the Karatsuba multiplier [2] or the Toom–Cook multiplier [3], which will lead to a high-performance word-based MMM design. Fast Fourier Transform (FFT) [4], Residue Number System (RNS) [5], and Non-least Positive Form [2] are also introduced for accelerating. Meanwhile, others tend to trade off between performance and area as when giving a large input width, it will cause an extremely high cost in hardware. Digital-serial implementations are proposed using high radix MMM, such as a radix-4 architecture using lookup tables [6] or booth encoding [7]. Radix-8 architecture uses booth encoding [8] and typically improves schemes based on carry-save adder (CSA) for the radix-2 system [9,10]. Some optimization has also been made on the CSA architecture [11,12,13]. However, many implementations for a low area cost have problems with their long carry chains, which will highly impact the performance of MMM. Although several high-performance adders such as the Kogge–Stone adder [14], carry-skip adder [15], carry-select adder [16], and Reverse Carry Propagate adder [17] are trying to solve this problem, they either have a higher demand for area or cannot meet all radix requirements. Some optimization [18,19] are made in achieving one-cycle latency pipeline word-based MMM by rearranging the basic pipeline algorithm in [20], but they do not change the basic algorithm’s iteration and pay much effort on scheduling. In that case, Ref. [21] has proposed a Redundant Binary Representation MMM (RBR-MMM) algorithm to solve the carry-chain problem by bringing the operations of MMM into the redundant system, which successfully eliminates the long carry chain and improves the performance of MMM.

Although the RBR-MMM method reaches a balance of performance and cost when the input width is 256 bits or 1024 bits, there will be an enormous area cost when the input width becomes large as a reason for RBR-MMM’s parallel design, which costs a large number of multipliers. RBR-MMM’s critical path delay is mainly dependent on the k parameter, typically when k is small; this design can reach a high frequency, but for advanced technology to reach a low latency, we always choose to have a larger optimized multiplier, so the RBR-MMM’s ‘ATP’ (Area-Time Product) ($kGates\ast \mu s$) will be unacceptable. Moreover, its high memory bandwidth requirement problem along with high bit width input is critical.

To solve the RBR-MMM’s problem, in this paper, we first propose a hardware suitable pipeline RBR-MMM (PRBR-MMM) to lessen the high area cost when the input width is large. Then, we optimized the RBR-MMM to reach a one-cycle delay between two pipeline stages. Finally, we take the critical path in each stage in two paths and precalculate the first path by using our pipeline buffer, and this leads to an almost 2/3 critical path compared with basic RBR-MMM, which will make up for a large part of the delay caused by the pipeline. As a result, our pipeline previous calculated RBR-MMM design (PPCRBR-MMM) has the following features:

• Low and customizable area cost: our area cost is mainly affected by the pipeline-stage-num. When using a memory outside our module, area cost will be lower by storing the temporary result outside.
• Small critical path: our critical path is smaller by cutting calculating into precalculate quotient logic and multiplication-shift logic.
• Low memory bandwidth requirement: compared with RBR-MMM, which needs whole operators simultaneously, our design only needs two words every cycle and only writes one word out. The word size is determined by the multiplier used in our design.
• Low and customizable latency: we adapt the algorithm to the pipeline to prevent the 2-cycle delay between each stage. Latency will be determined by the stage num and input width.

2. Algorithm Fundamentals

A redundant binary representation is a numeral system that uses more bits than needed to represent a single binary digit. In that case, an RBR allows addition without using a typical carry, which will prevent the long carry-chain in MMM system [16]. What is more, different from another redundant system-RNS [5], RBR is easy to covert from normal representation, making MMM’s operand’s translation simple. A typical $2^{2k}$ RBR number X with its component $x_i$ can be expressed as (1).

$$X=\sum _{i=0}^{n-1}{x}_i·2^{2ki},x_i\in \{0,1,\dots ,2^{2k+1}-1\};$$

(1)

When changing a simple operand into the above-mentioned system, we only need to divide data into $2k$ bits and let the Most Significant Bit (MSB) be zero. The RBR-MMM takes the above-mentioned expression into the MMM system and prevents the transformation between redundant numbers and nonredundant numbers during the iteration. As many public-key systems call MMM several times, only one additional cycle for transformation is needed to get the final result. The RBR-MMM algorithm is described in Algorithm 1. By representing the operands in the calculation process with redundant bases, RBR-MMM makes the carry in the algorithm iteration process directly stored in the intermediate result without additional conversion. At the same time, because o itself is also a redundant binary representation, no extra carry is generated in the process of calculating o for each iteration. The carry propagation problem in modular multiplication is solved by converting the carry into a redundant number. The proof of Algorithm 1 has been provided by [21]; we only discuss its critical path and area consumption in this paper.

Algorithm 1 Basic Radix-$2^k$ RBR-MMM ($k\ge 2$).

INPUT:$X,Y,M,M^{\prime };0\le X,Y\le 2M;$

M is prime; X,Y,M are in RBR:

$X={\sum }_{i=0}^{n-1}{x}_i·2^{2ki},x_i\in \{0,1,\dots ,2^{2k+1}-1\}$;

$Y={\sum }_{i=0}^{n-1}{y}_i·2^{2ki},y_i\in \{0,1,\dots ,2^{2k+1}-1\}$;

$M={\sum }_{i=0}^{n-1}{m}_i·2^{2ki},m_i\in \{0,1,\dots ,2^{2k}-1\}$;

$M^{\prime }[k-1:0]=-M^{-1}mod{2}^k$;

OUTPUT: $O=XY{2}^{-2kn}modM;0\le O\le 2M;$

1: $O=0,O^{\prime }=0;$

$O={\sum }_{i=0}^{n-1}{o}_i·2^{2ki},o_i\in \{0,1,\dots ,2^{2k+1}-1\}$;

$O^{\prime }={\sum }_{i=0}^{n-1}{o}_i^{\prime }·2^{2ki},o_i^{\prime }\in \{0,1,\dots ,2^{3k+2}-1\}$;

2: $y{s}_1=y_0[2k-1:k],y{s}_0=y_0[k-1:0],y{c}_0=y\_s0\left[2k\right];$

$o_{-1}^{\prime }=0,o_n^{\prime }=0;$

3: for $j=0$ to $2n-1$ do

4:    $o=o_{0}mod{2}^k;$

5:    $x=x_{0}mod{2}^k;$

//computing quotient logic

6:    $q_j=(\left((o+y{s}_j·x)mod{2}^k\right)·M^{\prime })mod{2}^k;$

//parallel computing o’

7:    for $i=0$ to $n-1$ do

8:     $o_i^{\prime }=(o_i+y{s}_j·x_i+q_j·m_i);$

9:    end for

//parallel computing shift right logic to cal new_o

10:    for $i=0$ to $n-1$ do

11:      $o_i=o_{i-1}^{\prime }[3k+1:3k]+o_i^{\prime }[3k-1:k]+o_{i+1}^{\prime }[k-1:0]\ll k;$

12:    end for

//convert y to binary representation

13:    if $j\%2==1$ do

14:     $\{y{c}_{\frac{j+1}{2}},y{s}_{j+2},y{s}_{j+1}\}=y_{\frac{j+1}{2}}+y{c}_{\frac{j-1}{2}};$

15:   end if

16: end for

17: return O

In Algorithm 1, $M^{\prime }$ is precalculated for the reason that MMM will be called several times using the same M, so there is no need for us to calculate $M^{\prime }$ in our algorithm; n should be an integer that is determined by M. Usually, we take n as $n=\left[\frac{m+2}{2k}\right]+1$, where m bits is the bit width of M. Thus, we can get that the cycles for hardware to do a single RBR-MMM with the precalculated $M^{\prime }$ can be expressed as (2), which is determined by the k value.

$$\begin{array}{c}\hfill loop=2·\left[\frac{m+2}{2k}\right]+2;\end{array}$$

(2)

Meanwhile, we can get RBR-MMM’s critical path by reviewing the main operands in Algorithm 1, take computing quotient logic as an example. From Figure 1, we can see that the max delay is created by two k bits multipliers and a half adder; thus, its path is rough $(3k+2\left[\frac{k}{3}\right])·T_{FA}$, where $T_{FA}$ is the delay of a full adder, we can quickly get a full critical path in (3). Finally, let us look at the RBR-MMM’s area consumption: for computing quotient logic, there will be about two k bits multipliers and one k bits adder used as computing quotient is needed one time for j-loop. However, for parallel computing $s^{\prime }$ and shift right part, nk bits ×$2k$ bits multipliers, k bits ×$2k+1$ bits multipliers, $3k+1$ bits full adder, and $2k$ bits adder are demanded.

$$\begin{array}{cc}\hfill T_{total}& =((3k+2\left[\frac{k}{3}\right])+\left(2k\right)+(3k+2+\left[\frac{2k+1}{3}\right]))·T_{FA}\hfill \\ \hfill & \approx (10k+3)·T_{FA};\hfill \end{array}$$

(3)

It can be seen from the above analysis that the critical path length of RBR-MMM is only related to the k value. This means that in the case of low input bit width, the parallelized RBR-MMM algorithm can achieve better frequency and lower area through lower k. In the case of high input bit width, the algorithm can also meet higher frequency requirements through a lower k value. When input bits are high, which generally occurs for RSA in high-speed encrypt system, area cost of RBR-MMM will not be decreased due to its parallel implementation. If high speed is needed, there may not be several $2k$ bits multipliers for this unit to use. Another problem is that there will be more additional cycles for RBR-MMM to read its input and write its output back to memory, so an area scalable structure to prevent high cost and keep a good ATP is recommended, which leads us to mix the typical pipeline design with RBR-MMM. Our PPCRBR-MMM system will be discussed in the next section.

3. Pipeline Precalculate Redundant Binary Representation Montgomery Modular Multiplication

According to the analysis mentioned in the previous section, a typical pipeline MMM [20] is needed to get a better performance in ATP. However, when we go through the parallel computing in RBR-MMM, we can find that its hard for us to implement a fully pipeline RBR-MMM as a reason of the high dependency between the $j=n$ and $j=n+1$ loop, which is explained as: for a new $o_i$, both $o_{i+1}$ and $o_i$ is needed, which will cost two cycles for a typical pipeline design. So, we rearrange the algorithm to adapt to a pipeline design with one cycle delay between two stages. Then for computing quotient logic, we split it with parallel computing, as q will not be changed for the same j loop, and consuming one more cycle will lead to a shorter critical path. This splitting has another advantage: when a buffer is needed to temporary storage the last stage’s result, we can call pre-q logic to do computing quotient logic without an additional cycle; this will be discussed later. Our PPCRBR-MMM can be described as Algorithm 2.

Algorithm 2 Basic Radix-$2^k$ PPCRBR-MMM ($k\ge 2$).

INPUT:$X,Y,M,M^{\prime };0\le X,Y\le 2M;$

M is prime; X,Y,M are in RBR:

$X={\sum }_{i=0}^{n-1}{x}_i·2^{2ki},x_i\in \{0,1,\dots ,2^{2k+1}-1\}$;

$Y={\sum }_{i=0}^{n-1}{y}_i·2^{2ki},y_i\in \{0,1,\dots ,2^{2k+1}-1\}$;

$M={\sum }_{i=0}^{n-1}{m}_i·2^{2ki},m_i\in \{0,1,\dots ,2^{2k}-1\}$;

$M^{\prime }[k-1:0]=-M^{-1}mod{2}^k$;

OUTPUT: $O=XY{2}^{-2kn}modM;0\le O\le 2M;$

1: $O^j=0,V^j=0,U^j=0;$

$O^j={\sum }_{i=0}^{n-1}{o}_i^j·2^{2ki},o_i^j\in \{0,1,\dots ,2^{2k+1}-1\}$;

$U^j={\sum }_{i=0}^{n-1}{u}_i^j·2^{2ki},u_i^j\in \{0,1,\dots ,2^{3k+2}-1\}$;

$V^j={\sum }_{i=0}^{n-1}{v}_i^j·2^{2ki},v_i^j\in \{0,1,\dots ,2^{2k+1}-1\}$;

2: $y{s}_1=y_0[2k-1:k],y{s}_0=y_0[k-1:0],y{c}_0=y\_s0\left[2k\right];$

$u_{-1}^j=0,u_n^j=0,u_i^{-1}=0,u_i^{-2}=0,v_i^{-1}=0;$

// totally 2n iteration, each j means one pipeline stage

3: for $j=0$ to $2n-1$ do

4:  $o=(v_0^{j-1}+u_1^{j-2}[k-1:0])mod{2}^k;$

5:  $x=x_{0}mod{2}^k;$

//computing quotient logic

6:  $pre\_q_j=(\left((y{s}_j·x)mod{2}^k\right)·M^{\prime })mod{2}^k;$

//inner-loop: for each pipeline, n cycles are needed

7:  for $i=0$ to $n-1$ do

8:     $u_i^j=(v_i^{j-1}+u_{i+1}^{j-2}[k-1:0]+y{s}_j·x_i+pre\_q_j·m_i+o·M^{\prime }mod{2}^k);$

9:     $u_{i-1}^j[3k+1:3k]=MSB(u_i^{j-1}[k-1:0]+u_{i-1}^j[3k-1:k]);$

10:    $v_i^j=u_{i-1}^j[3k+1:3k]+u_i^j[3k-1:k];$

11:  end for

//convert y to binary representation

12:  if $j\%2==1$ do

13:   $\{y{c}_{\frac{j+1}{2}},y{s}_{j+2},y{s}_{j+1}\}=y_{\frac{j+1}{2}}+y{c}_{\frac{j-1}{2}};$

14:  end if

15: end for

16: //two more cycles are needed for output

17: for $i=0$ to $n-1$ do

18:  $o_i^{2n-1}=v_i^{2n-1}+u_{i+1}^{2n-2}[k-1:0]+u_{i+1}^{2n-1}[k-1:0]\ll k$

19: end for

20: return O

Typical pipeline design often goes with a problem in carrying. In RBR-MMM, it occurs between two adjacent j-loop. Let the j-th pipeline-stage out and temp out be $o_i^j$ and $o_i^{\prime j}$,we can get (4).

$$\begin{array}{cc}\hfill o_i^{\prime j}& =o_i^{j-1}+y{s}_j·x_i+q_j·m_i;\hfill \\ \hfill o_i^j& =o_{i-1}^{\prime j}[3k+1:3k]+o_i^{\prime j}[3k-1:k]+o_{i+1}^{\prime j}[k-1:0]\ll k;\hfill \end{array}$$

(4)

In this equation, every $o_i^{\prime j}$ needs $o_i^{j-1}$’s result, which needs both $o_i^{\prime j-1}$ and $o_{i+1}^{\prime j-1}$ to solve out, so there will be a two cycles delay between the pipeline stage, thus we consider rearranging our algorithm by changing the $o_{i+1}^{\prime j-1}$ to the next cycle. We first ignore the $o_{i+1}^{\prime j-1}$ $\ll k$ to calculate $o_i^{j-1}$, let our output be new(output), we can get (5)

$$\begin{array}{cc}\hfill & new\left(o_i^j\right)=o_i^j-o_{i+1}^{\prime j}[k-1:0]\ll k;\hfill \\ \hfill & new\left(o_i^{\prime j}\right)=o_i^{\prime j}-o_{i+1}^{j-1}[k-1:0]\ll k;\hfill \end{array}$$

(5)

Ingeniously, our q calculating will be the same due to this lack of addition will only affect the high $k+1$ bits of $o_i^{j-1}$, then we only need to consider the $o_i^j$’s lack of $o_{i+1}^{\prime j-1}$. From (4) and (5), the temp result can be calculated as (6) and (7).

$$\begin{array}{cc}\hfill new\left(o_i^{\prime j+1}\right)& =o_i^j+y{s}_{j+1}·x_i+q_{j+1}·m_i-o_{i+1}^{\prime j}[k-1:0]\ll k;\hfill \\ \hfill & =new\left(o_i^j\right)+y{s}_{j+1}·x_i+q_{j+1}·m_i;\hfill \end{array}$$

(6)

$$\begin{array}{cc}\hfill new\left(o_i^{j+1}\right)& =\{new\left(o_{i-1}^{\prime j+1}\right)+o_i^{\prime j}[k-1:0]\ll k\}[3k+1:3k]+new\left(o_i^{\prime j+1}[3k-1:k]\right)\hfill \\ \hfill & +o_{i+1}^{\prime j}[k-1:0]+o_{i+1}^{\prime j+1}[k-1:0]\ll k-o_{i+1}^{\prime j+1}[k-1:0]\ll k;\hfill \\ \hfill & =\{new\left(o_{i-1}^{\prime j+1}\right)+new\left(o_i^{\prime j}\right)[k-1:0]\ll k\}[3k+1:3k]+new\left(o_i^{\prime j+1}[3k-1:k]\right)\hfill \\ \hfill & +new\left(o_{i+1}^{\prime j}\right)[k-1:0];\hfill \end{array}$$

(7)

In order to avoid dependencies on the upper-level unit, we transfer the addition of $new\left(o_{i+1}^{\prime j}\right)[k-1:0]$ to the calculation of the next-level unit. Let $u_i^j=new\left(o_i^{\prime j}\right)$ and $v_i^j=new\left(o_i^j\right)-new\left(o_{i+1}^{\prime j-1}\right)[k-1:0]$. Finally, we can get that the output of the next stage should be computed as (8)

$$\begin{array}{cc}\hfill & u_i^{j+1}=v_i^j+y{s}_{j+1}·x_i+q_{j+1}·m_i+u_{i+1}^{j-1}[k-1:0];\hfill \\ \hfill & u_{i-1}^{j+1}[3k+1:3k]=MSB(u_i^j[k-1:0]+u_{i-1}^{j+1}[3k-1:k]);\hfill \\ \hfill & v_i^{j+1}=u_{i-1}^{j+1}[3k+1:3k]+u_i^{j+1}[3k-1:k];\hfill \end{array}$$

(8)

From (8), only one cycle’s previous stage’s result is needed to get a new output with an additional add operation of the output of the first two stages; thus, we can build up a single cycle delay pipeline RBR-MMM design. Meanwhile, to prevent a long critical path when k is large, we precalculate the quotient or part of the quotient in the first cycle of each stage, which only costs one more cycle for a pipeline design. Then, we get our Algorithm 2: PPCRBR-MMM.

According to Algorithm 2, an RBR-MMM-based pipeline architecture is proposed in this brief, which will get a better ATP than RBR-MMM. Our algorithm’s hardware implementation consists of several processing elements (PEs), pre-calculate quotient units, data registers, and fewer control logics. To clarify our structure, a dependency graph is delivered as Figure 2, and each Q job calculates pre_q value in Algorithm 2, the inner loop is done by I job. By rearranging the RBR-MMM algorithm’s data chain, our PE can work out its result just with the output of the last cycle, total three inputs from left PE and left of left PE and PE self are needed. For each PE’s first cycle, the quotient will be calculated, costing only one more cycle delay than before.

Figure 3 shows a block diagram of our pipeline RBR-MMM. The kernel part consists of pk-param PEs. Each PE contains (8)’s logic and some registers to hold input value and temp result. For common and low-area usage, p will often be lower than n, which means some PE-unit will do more than one loop calculation. Thus, the PE p will compute out before PE 1 has finished n-cycle computation, and the output must be queued in a buffer before PE1 becomes available again. The buffer depth is determined by $n-p$ and its width is defined as $2k+1$ (the $v_i^j$’s width) + k (the $u_i^j[k-1:0]$’s width) + k (the $u_{i+1}^{j-1}[k-1:0]$’s width) + $2k$ (the $m_i$’s width) + $2k+1$ (the $x_i$’s width), this buffer will be an inevitable but acceptable cost compared with basic RBR-MMM design, and this register cost can be transferred to memory outside if needed. Furthermore, quotient value can also be pre-calculated in our buffer. In that case, $o·M^{\prime }mod{2}^k$ part is not needed in (8) (as that optimization will have no effect on our frequency and to keep our equation easy, we still do this part in our design), and no more cycle is needed. Other parts of our block are some control logic, select logic of buffer, final output, and $ys$ storage.

4. Analysis of PPCRBR-MMM

In this section, a critical path, area, and cycle analysis of PPCRBR-MMM is proposed for comparison with basic RBR-MMM implementation.

4.1. Timing Analysis

Typically, we take p smaller than n to prevent a high-cost design, and then from Figure 4, each PE unit takes $n+1$ cycles to compute its first loop result. Total $2n$ loops are needed to solve out final O from Algorithm 2, thus we can get that $[2n/p]$ inner-loops are needed for PE0-PE(2n%p), and for the final loop, $2n\%p+n+2-1$ cycles are required. Finally, we get Equation (9).

$$\begin{array}{c}\hfill loop=[2n/p]·n+2+2n\%p+n;\end{array}$$

(9)

In comparison with (2),we can get a cycle_ratio in (10). Previously, we have mentioned that the whole operand cannot be read or written only in one cycle, which will also inevitably impact basic RBR-MMM. Thus the loop_ratio will be smaller than (10) in hardware design.

$$\begin{array}{cc}\hfill loop\_ratio& =\left(\right[2n/p]·n+2+2n\%p+n)/2n\hfill \\ \hfill & =\frac{[2n/p]+1}{2}+\frac{2n\%p+2}{2n};\hfill \end{array}$$

(10)

4.2. Critical Path Analysis

To better understand our path delay and area cost, a detailed circuit schematic is illustrated in Figure 5, the partial computing output $O_i^{\prime }$ circuit consists of $k\times 2k$, $k\times (2k+1)$, $k\times k$ multipliers which are independent, thus they can fuse to addition using CSA (i.e., 4:2 compressor), to simplify our delay calculate, we let this part of critical path be a $k\times 2k+1$ bits multiplier’s half adders’ path with 7:2 compressors and $3k+1$ Carry Propagate Adder (CPA), $o·M^{\prime }$ and calculate o part can be broken into 4:2 compressor. The MSB of $u_{i-1}^j$ will be calculated simultaneously and will have no impact on our critical path. At last, we take a $2k$ bits carry propagation adder to solve the $v_i^j$ out. Thus we can get our critical path will be (11)

$$\begin{array}{cc}\hfill T_{total}& =\left(2k\right)+(3k+1+2+\frac{2k+1}{3})·T_{FA}\hfill \\ \hfill & \approx (6k+3)·T_{FA};\hfill \end{array}$$

(11)

Obviously, pre-calculate quotient logic lets our critical path decreases; this ratio can be expressed as (12)

$$\begin{array}{cc}\hfill path\_ratio& =(6k+3)·T_{FA}/(10k+3)·T_{FA}\hfill \\ \hfill & \approx \frac{3}{5};\hfill \end{array}$$

(12)

4.3. Area Analysis

For area analysis, we mainly focus on the area cost for single PE compared with the parallel computation module in the RBR-MMM system. From Figure 5, we can summarize a rough area cost for single PE: one $2k$ bits carry propagation adder for $v_i^j$, one $3k+2$ carry propagation adder, $5k^2+k$ ‘AND’ Gates and some compressors for $u_i^j$ and one calculate carry bit logic for the MSB. The last one can be implemented by k ‘AND’ Gates and a k bits adder. We can see that our additional logic will not consume much more area for single PE.

Obviously, considering area cost, our PE’s number will not be large; in that case, high area cost will be eliminated for a large input case. For intuitive explanation, if we take $p=n/2$, we can get a roughly ATP ratio shown in (13); Clearly, our PPCRBR-MMM design will lead to a better ATP as area_ratio will be nearly 1/2 in that case.

$$\begin{array}{c}\hfill //forp=\frac{n}{2}\\ \hfill ATP\_ratio& =loop\_ratio·path\_ratio·area\_ratio\hfill \\ \hfill & \approx \frac{5}{2}·\frac{3}{5}·area\_ratio\hfill \\ \hfill & \approx \frac{3}{2}·area\_ratio;\hfill \end{array}$$

(13)

5. Experimental Results and Comparisons

5.1. Experiments of PPCRBR-MMM and RBR-MMM Algorithms

In order to better demonstrate the advantages of PPCRBR-MMM over the RBR-MMM algorithm, we use Verilog to implement the two algorithms and use the TSMC process library to synthesize to obtain area and delay information under different parameters. According to the analysis of critical path and area in the previous article, when the input bit width is high, the proportion of control logic in the total area due to pipelining will be reduced, which can better reflect the superiority of PPCRBR-MMM algorithm in ATP and customizability, at the same time, to make the comparison of experimental results general, we selected two designs with different parameters under the input of 1024 bits, 2048 bits, and 8192 bits for implementation. For better performance, we apply the parameter condition of $k=16$ to the two algorithms with 1024 bits width and the parameter condition of $k=32$ to the case of 2048 bits input. For the 8192 bits input, although a higher k value can bring higher performance and algorithm improvement, choosing a higher k will bring too high an area requirement, so we still choose the parameter condition of $k=32$. To reflect the advantages of customization, we analyzed the PPCRBR-MMM algorithm when the number of PEs under the input of 8192 bits is 16, 24, 32, 48, 64.

5.2. Results and Comparisons

Table 1. Comparison of RBR-MMM and PPCRBR-MMM.

Alg	Param	Tech	Freq (MHz)	Area (KGates)	Cycles	Time (ns)	ATP
1024-bit MMM
RBR-MMM	k = 4	65 nm	685	121.8	258	377	45.92
		90 nm	435	108.7	258	593	64.47
	k = 16	65 nm	385	304.4	66	166	50.53
PPCRBR-MMM	p = 16 k = 16	65 nm	617	185.4	164	266	49.28
	p = 24 k = 16	65 nm	617	222.4	114	185	41.09
		90 nm	392	198.5	114	291	57.69
2048-bit MMM
RBR-MMM	k = 4	65 nm	654	224.8	514	786	176.69
	k = 32	65 nm	302	900.0	66	218	196.63
PPCRBR-MMM	p = 16 k = 32	65 nm	485	506.3	164	338	171.19
	p = 24 k = 32	65 nm	485	707.1	114	235	166.22
		90 nm	308	631.1	114	370	233.37
8192-bit MMM
RBR-MMM	k = 4	65 nm	603	878.1	2050	3400	2985.25
		130 nm	200	945.5	2050	10250	9691.38
	k = 32	65 nm	288	3353.9	258	896	3006.70
PPCRBR-MMM	p = 16 k = 32	65 nm	452	699.2	2178	4816	3367.41
	p = 24 k = 32	65 nm	446	889.9	1428	3203	2850.12
	p = 32 k = 32	65 nm	446	1087.0	1156	2593	2818.12
	p = 48 k = 32	65 nm	428	1493.8	788	1842	2751.53
		130 nm	142	1608	788	5554	8932.61
	p = 64 k = 32	65 nm	425	1875.2	644	1516	2841.92

shows the area and time consuming comparison of RBR-MMM and PPCRBR-MMM under different input parameters. When the input is 1024 bits or 2048 bits, it can be seen that to obtain better performance, the RBR-MMM algorithm must have higher area consumption. And the pipeline algorithm can achieve better delay and area through lower pipeline stages, thereby increasing ATP by about 20%. When the input is 8192 bits, our algorithm still has a 10% advantage in ATP. Compared with the lower input bit width, the area consumption of the buffer for storing the intermediate results becomes larger, so the magnitude of improvement becomes smaller. The loss of this area can be reduced by the memory module external to the algorithm module, as mentioned above. Figure 6 exhibits the comparison of the area and time consumption of RBR-MMM and PPCRBR-MMM with different parameters under 8192 bits input. When the PE number is low, our algorithm will provide a lower area and higher latency. When the PE number becomes high, since the area of the PE is still the main part of the algorithm, the total area loss increases almost linearly. At the same time, because the critical path caused by high fan-out becomes longer, the frequency of the algorithm will decrease significantly when the number of PEs is large, so the delay cannot be reduced linearly. The final ATP results are shown in Figure 6b. When the PE number is increased to 48, the ATP improvement of the algorithm reaches the best.

Similarly, to further reflect the advantages of our algorithm on ATP, we compared the design under different parameters with some modules. The results are delivered in

Table 2. Comparison of different MMM implementation.

Ref	Tech	Freq (MHz)	Area (KGates)	Cycles	Time (ns)	ATP
1024-bit MMM
[22]	90 nm	369	47.2	1153	3124	147.45
[23]	90 nm	472	11.4	2207	4680	53.35
[10]	90 nm	885	84.0	1026	1159	97.36
[24]	90 nm	909	97.0	595	655	63.54
[25]	90 nm	595	103.0	1485	2496	257.07
Ours	90 nm	392	198.5	114	291	57.69
2048-bit MMM
[11]	90 nm	227	336.0	1724	7646	2569.06
Ours	90 nm	308	631.1	114	370	233.37
8192-bit MMM
[5]	130 nm	263	1240.0	2118	8056	9989.44
Ours	130 nm	142	1608	788	5554	8932.61

. Ref. [22] introduces the half-carry-save form to reduce the bit width of the operand in the CPA, thereby reducing the delay of the critical path. However, it still has the problem of a long carry chain compared with the redundant number system, so it cannot achieve a good performance in a lower area. Ref. [23] uses the full-carry-save method to parallelize the results of modular multiplication, but there are many splitting processes for the intermediate results, resulting in a less outstanding performance in multiple loops. Refs. [10,24] achieve a higher frequency by applying a customized CSA design, but their design require more cycles to complete more iterations, and finally cannot achieve higher performance and ATP value. Ref. [25] reorganizes the operands on the basis of [19] to achieve low memory bandwidth and high frequency while keeping the number of iterations unchanged, but its delay chain under high input bit width contains two-stage multiplication and addition modules, so the balance between frequency and total number of cycles cannot be achieved. Although [11] also uses the full-carry-save method, it uses CPA to complete the data conversion in the iterative process, thus reducing the overall running frequency. Ref. [5] uses the RNS-based modular multiplication system to achieve better frequency and ATP, but it avoids the pipeline design like [21]. In this paper, RBR is introduced to lessen the critical path in calculating units. While by modifying the algorithm, a full pipeline is achieved during iteration. Then we decompose the critical path of calculating q logic using the convenience of the pipeline, thus increasing the overall frequency. Finally, lower latency and better ATP results were achieved.

6. Conclusions

This paper presents a pipeline pre-calculated redundant binary representation Montgomery Modular Multiplication for a low ATP and customizable solution in big integer modular multiplication. The main purpose is to perform pipeline processing for the RBR-MMM algorithm and reduce the delay between different stages to 1 cycle by reconstructing the algorithm process. And with the advantage of streamlining, the critical path is decomposed, so as to effectively increase the operating frequency of the system. Both this algorithm’s correctness and advantage in ATP were provided by analysis between PPCRBR-MMM and RBR-MMM. Based on those algorithms, various hardware designs of different parameters, including input bit width, radix, and PE num, have been implemented to clarify our algorithm’s flexibility and superiority. The experimental data show that our PPCRBR-MMM algorithm has 10% to 20% improvement in ATP compared to RBR-MMM depending on the input bit width.