Lines Matching +refs:math +refs:power +refs:of +refs:cache
69 This text has been placed in the public domain. This text corresponds to the v0.39 release of the
83 This text is formatted to the international B5 paper size of 176mm wide by 250mm tall using the \LaTeX{}
93 others can see that too and then we would have a society to be proud of. My LibTom projects are what I am doing to give
94 back to society in the form of tools and knowledge that can help others in their endeavours.
96 I started writing this book because it was the most logical task to further my goal of open academia. The LibTomMath source
98 explain the algorithms properly. Hence this book. The book literally starts with the foundation of the library and works
99 itself outwards to the more complicated algorithms. The use of both pseudo--code and verbatim source code provides a duality
100 of ``theory'' and ``practice'' that the computer science students of the world shall appreciate. I never deviate too far
103 This book and indeed much of the LibTom projects would not exist in their current form if it was not for a plethora
104 of kind people donating their time, resources and kind words to help support my work. Writing a text of significant
106 comprises of literally thousands of users and over 100,000 lines of source code, TeX and other material. People like Mads and Greg
108 continue the project. Definitely my parents were there for me by providing room and board during the many months of work in 2003.
110 To my many friends whom I have met through the years I thank you for the good times and the words of encouragement. I hope I
119 contribute to educate others facing the problem of having to handle big number mathematical calculations.
121 This book is Tom's child and he has been caring and fostering the project ever since the beginning with a clear mind of
125 I hold a masters degree in cryptography from the University of Southern Denmark and have always been interested in the
126 practical aspects of cryptography.
129 great deal of work in which multiple precision mathematics was needed. Understanding the possibilities for speeding up
145 It's all because I broke my leg. That just happened to be at about the same time that Tom asked for someone to review the section of the book about
149 At the time of writing this, I've still not met Tom or Mads in meatspace. I've been following Tom's progress since his first splash on the
150 sci.crypt Usenet news group. I watched him go from a clueless newbie, to the cryptographic equivalent of a reformed smoker, to a real
151 contributor to the field, over a period of about two years. I've been impressed with his obvious intelligence, and astounded by his productivity.
154 When I reviewed that single section of the book, in its very earliest form, I was very pleasantly surprised. So I decided to collaborate more fully,
155 and at least review all of it, and perhaps write some bits too. There's still a long way to go with it, and I have watched a number of close
156 friends go through the mill of publication, so I think that the way to go is longer than Tom thinks it is. Nevertheless, it's a good effort,
169 When we think of long-hand arithmetic such as addition or multiplication we rarely consider the fact that we instinctively
170 raise or lower the precision of the numbers we are dealing with. For example, in decimal we almost immediate can
171 reason that $7$ times $6$ is $42$. However, $42$ has two digits of precision as opposed to one digit we started with.
172 Further multiplications of say $3$ result in a larger precision result $126$. In these few examples we have multiple
173 precisions for the numbers we are working with. Despite the various levels of precision a single subset\footnote{With the occasional optimization.}
174 of algorithms can be designed to accomodate them.
176 By way of comparison a fixed or single precision operation would lose precision on various operations. For example, in
179 Essentially at the heart of computer based multiple precision arithmetic are the same long-hand algorithms taught in
183 The most prevalent need for multiple precision arithmetic, often referred to as ``bignum'' math, is within the implementation
184 of public-key cryptography algorithms. Algorithms such as RSA \cite{RSAREF} and Diffie-Hellman \cite{DHREF} require
185 integers of significant magnitude to resist known cryptanalytic attacks. For example, at the time of this writing a
207 insufficient to accomodate the magnitude required for the problem at hand. An RSA modulus of magnitude $10^{19}$ could be
210 extending the range of representable integers while using single precision data types.
216 deployment of efficient algorithms.
218 However, cryptography is not the only field of study that can benefit from fast multiple precision integer routines.
219 Another auxiliary use of multiple precision integers is high precision floating point data types.
220 The basic IEEE \cite{IEEE} standard floating point type is made up of an integer mantissa $q$, an exponent $e$ and a sign bit $s$.
222 floating point is meant to be implemented in hardware the precision of the mantissa is often fairly small
224 a mantissa of much larger precision than hardware alone can efficiently support. This approach could be useful where
227 Yet another use for large integers is within arithmetic on polynomials of large characteristic (i.e. $GF(p)[x]$ for large $p$).
230 \subsection{Benefits of Multiple Precision Arithmetic}
232 The benefit of multiple precision representations over single or fixed precision representations is that
233 no precision is lost while representing the result of an operation which requires excess precision. For example,
234 the product of two $n$-bit integers requires at least $2n$ bits of precision to be represented faithfully. A multiple
235 precision algorithm would augment the precision of the destination to accomodate the result while a single precision system
236 would truncate excess bits to maintain a fixed level of precision.
239 curve cryptography (\textit{ECC}) is often implemented on smartcards by fixing the precision of the integers to the maximum
243 normally very flexible. It cannot, at runtime, accomodate inputs of higher magnitude than the designer anticipated.
245 Multiple precision algorithms have the most overhead of any style of arithmetic. For the the most part the
247 platforms. However, multiple precision algorithms do offer the most flexibility in terms of the magnitude of the
249 without the designer's explicit forethought. This leads to lower cost of ownership for the code as it only has to
252 \section{Purpose of This Text}
253 The purpose of this text is to instruct the reader regarding how to implement efficient multiple precision algorithms.
254 That is to not only explain a limited subset of the core theory behind the algorithms but also the various ``house keeping''
255 elements that are neglected by authors of other texts on the subject. Several well reknowned texts \cite{TAOCPV2,HAC}
256 give considerably detailed explanations of the theoretical aspects of algorithms and often very little information
260 example, the Handbook of Applied Cryptography (\textit{HAC}), algorithm 14.7 on page 594, gives a relatively simple
262 the fact that the two integer inputs may be of differing magnitudes. As a result the implementation is not as simple
268 any form of useful performance in non-trivial applications.
270 To solve this problem the focus of this text is on the practical aspects of implementing a multiple precision integer
271 package. As a case study the ``LibTomMath''\footnote{Available at \url{http://math.libtomcrypt.com}} package is used
274 discusses a very large portion of the inner workings of the library.
280 This text shall also serve as a walkthrough of the creation of multiple precision algorithms from scratch. Showing
285 A multiple precision integer of $n$-digits shall be denoted as $x = (x_{n-1}, \ldots, x_1, x_0)_{ \beta }$ and represent
286 the integer $x \equiv \sum_{i=0}^{n-1} x_i\beta^i$. The elements of the array $x$ are said to be the radix $\beta$ digits
287 of the integer. For example, $x = (1,2,3)_{10}$ would represent the integer
291 The term ``mp\_int'' shall refer to a composite structure which contains the digits of the integer it represents, as well
293 \ref{sec:MPINT}. For the purposes of this text a ``multiple precision integer'' and an ``mp\_int'' are assumed to be
295 are present as well. An expression of the type \textit{variablename.item} implies that it should evaluate to the
296 member named ``item'' of the variable. For example, a string of characters may have a member ``length'' which would
297 evaluate to the number of characters in the string. If the string $a$ equals ``hello'' then it follows that
308 The variable $\beta$ represents the radix of a single digit of a multiple precision integer and
309 must be of the form $q^p$ for $q, p \in \Z^+$. A single precision variable must be able to represent integers in
311 $0 \le x < q \beta^2$. The extra radix-$q$ factor allows additions and subtractions to proceed without truncation of the
317 several algorithms (notably the Comba routines) temporary results will be stored in arrays of double precision mp\_words.
318 For the purposes of this text $x_j$ will refer to the $j$'th digit of a single precision array and $\hat x_j$ will refer to
319 the $j$'th digit of a double precision array. Whenever an expression is to be assigned to a double precision
321 Expressions that are assigned to a single precision variable are truncated to fit within the precision of a single
328 In this particular case, $\hat c = 1127$ and $c = 127$. The most significant digit of the product would not fit
332 Within the algorithm descriptions all variables are assumed to be scalars of either single or double precision
333 as indicated. The only exception to this rule is when variables have been indicated to be of type mp\_int. This
344 The norm of a multiple precision integer, for example $\vert \vert x \vert \vert$, will be used to represent the number of digits in the representation
345 of the integer. For example, $\vert \vert 123 \vert \vert = 3$ and $\vert \vert 79452 \vert \vert = 5$.
349 To measure the efficiency of the specified algorithms, a modified big-Oh notation is used. In this system all
358 in the context of the this text this is not the case as the magnitude of the inputs will typically be rather small. As a
361 All of the algorithms presented in this text have a polynomial time work level. That is, of the form
362 $O(n^k)$ for $n, k \in \Z^{+}$. This will help make useful comparisons in terms of the speed of the algorithms and how
369 chapters. The reader is encouraged to finish the exercises as they appear to get a better understanding of the
372 That being said, the problems are designed to affirm knowledge of a particular subject matter. Students in particular
375 Similar to the exercises of \cite[pp. ix]{TAOCPV2} these exercises are given a scoring system based on the difficulty of
376 the problem. However, unlike \cite{TAOCPV2} the problems do not get nearly as hard. The scoring of these
384 \hline $\left [ 1 \right ]$ & An easy problem that should only take the reader a manner of \\
387 \hline $\left [ 2 \right ]$ & An easy problem that involves a marginal amount of computer \\
391 & of work. Usually involves trivial research and development of \\
392 & new theory from the perspective of a student. \\
394 & of work and research, the solution to which will demonstrate \\
395 & a higher mastery of the subject matter. \\
398 & complete mastery of the given subject. \\
413 involve devising a new algorithm or implementing a variation of another algorithm previously presented. Readers who can
416 Problems at the fourth level are meant to be similar to those of the level three questions except they will require
418 the exact details of the answer until a subsequent chapter.
422 mastery of the subject matter at hand.
424 Often problems will be tied together. The purpose of this is to start a chain of thought that will be discussed in future chapters. The reader
425 is encouraged to answer the follow-up problems and try to draw the relevance of problems.
434 The library has been successfully tested under numerous operating systems including Unix\footnote{All of these
439 \subsection{Goals of LibTomMath}
448 (\textit{API}) has been kept as simple as possible. Often generic place holder routines will make use of specialized
451 based on the magnitude of the inputs and the configuration of the library.
453 Making LibTomMath as efficient as possible is not the only goal of the LibTomMath project. Ideally the library should
463 \section{Choice of LibTomMath}
464 LibTomMath was chosen as the case study of this text not only because the author of both projects is one and the same but
471 segments of code littered throughout the source. This clean and uncluttered approach to the library means that a
472 developer can more readily discern the true intent of a given section of source code without trying to keep track of
475 The code base of LibTomMath is well organized. Each function is in its own separate source code file
476 which allows the reader to find a given function very quickly. On average there are $76$ lines of code per source
486 with LibTomMath without change. The function names correlate directly to the action they perform. Almost all of the
490 The LIP library is an example of a library with an API that is awkward to work with. LIP uses function names that are often ``compressed'' to
495 effect a math error (i.e. invalid input, heap error, etc) can cause a program to stop functioning which is definitely
499 While LibTomMath is certainly not the fastest library (GMP often beats LibTomMath by a factor of two) it does
500 feature a set of optimal algorithms for tasks such as modular reduction, exponentiation, multiplication and squaring. GMP
502 of the additional modular reduction optimizations that LibTomMath features\footnote{At the time of this writing GMP
505 LibTomMath is almost always an order of magnitude faster than the MPI library at computationally expensive tasks such as modular
506 exponentiation. In the grand scheme of ``bignum'' libraries LibTomMath is faster than the average library and usually
510 LibTomMath will build ``out of the box'' on any platform equipped with a modern version of the GNU C Compiler
512 variables. LIP and MPI will build ``out of the box'' as well but have numerous known bugs. Most notably the author of
515 GMP requires a configuration script to run and will not build out of the box. GMP and LibTomMath are still in active
516 development and are very stable across a variety of platforms.
520 the case study of this text. Various source files from the LibTomMath project will be included within the text. However,
521 the reader is encouraged to download their own copy of the library to actually be able to work with the library.
525 The trick to writing any useful library of source code is to build a solid foundation and work outwards from it. First,
530 After a foundation is formed the remainder of the library can be designed and implemented in a hierarchical fashion.
533 By building outwards from a base foundation instead of using a parallel design methodology the resulting project is
534 highly modular. Being highly modular is a desirable property of any project as it often means the resulting product
540 I implement all of the functions I require. For example, in the case of LibTomMath I implemented functions such as
544 mp\_exptmod() function itself and lowered the total cost of ownership (\textit{so to speak}) and of development
550 \caption{Design Flow of the First Few Original LibTomMath Functions.}
555 Only after the majority of the functions were in place did I pursue a less hierarchical approach to auditing and optimizing
559 This chapter discusses the core algorithms of the library which are the dependents for every other algorithm.
563 be used to represent values larger than their precision will allow. The purpose of multiple precision algorithms is
569 (\textit{to the left}) are said to be in a different power of ten column. That is, the number $123$ can be described as having a $1$ in the hundreds
576 that is the sign of this particular integer is positive as opposed to negative. Second, the integer has three digits in
580 The human analogy of this third property is ensuring there is enough space on the paper to write the integer. For example,
581 if one starts writing a large number too far to the right on a piece of paper they will have to erase it and move left.
582 Similarly, computer algorithms must maintain strict control over memory usage to ensure that the digits of an integer
588 The mp\_int structure is the ISO C based manifestation of what represents a multiple precision integer. The ISO C standard does not provide for
615 \item The \textbf{used} parameter denotes how many digits of the array \textbf{dp} contain the digits used to represent
620 of a result would exceed the \textbf{alloc} count all of the algorithms will automatically increase the size of the
621 array to accommodate the precision of the result.
623 \item The pointer \textbf{dp} points to a dynamically allocated array of digits that represent the given multiple
635 Several rules are placed on the state of an mp\_int structure and are assumed to be followed for reasons of efficiency.
639 \item The value of \textbf{alloc} may not be less than one. That is \textbf{dp} always points to a previously allocated
640 array of digits.
641 \item The value of \textbf{used} may not exceed \textbf{alloc} and must be greater than or equal to zero.
642 \item The value of \textbf{used} implies the digit at index $(used - 1)$ of the \textbf{dp} array is non-zero. That is,
647 \item The value of \textbf{sign} must be \textbf{MP\_ZPOS} if \textbf{used} is zero;
648 this represents the mp\_int value of zero.
652 A convention of argument passing must be adopted early on in the development of any library. Making the function
665 functions and make sense of them. For example, the first function would read ``multiply a and b and store in c''.
668 of assignment expressions. That is, the destination (output) is on the left and arguments (inputs) are on the right. In
669 truth, it is entirely a matter of preference. In the case of LibTomMath the convention from the MPI library has been
674 feature to implement since it allows the calling functions to cut down on the number of variables it must maintain.
684 In the case of LibTomMath the only errors that are checked for are related to inappropriate inputs (division by zero for
687 \textbf{int} data type with one of the following values (fig \ref{fig:errcodes}).
695 \hline \textbf{MP\_VAL} & One of the input value(s) was invalid \\
696 \hline \textbf{MP\_MEM} & The function ran out of heap memory \\
704 When an error is detected within a function it should free any memory it allocated, often during the initialization of
706 function was called. Error checking with this style of API is fairly simple.
716 The GMP \cite{GMP} library uses C style \textit{signals} to flag errors which is of questionable use. Not all errors are fatal
717 and it was not deemed ideal by the author of LibTomMath to force developers to have signal handlers for such cases.
721 clearing of the mp\_int structures. These two algorithms will be used by the majority of the higher level algorithms.
723 Given the basic mp\_int structure an initialization routine must first allocate memory to hold the digits of
724 the integer. Often it is optimal to allocate a sufficiently large pre-set number of digits even though
727 and how many re-allocations are tolerable. Obviously allocating an excessive amount of digits initially will waste
730 If the memory for the digits has been successfully allocated then the rest of the members of the structure must
731 be initialized. Since the initial state of an mp\_int is to represent the zero integer, the allocated digits must be set
735 An mp\_int is said to be initialized if it is set to a valid, preferably default, state such that all of the members of the
761 The purpose of this function is to initialize an mp\_int structure so that the rest of the library can properly
762 manipulte it. It is assumed that the input may not have had any of its members previously initialized which is certainly
765 Before any of the members such as \textbf{sign}, \textbf{used} or \textbf{alloc} are initialized the memory for
766 the digits is allocated. If this fails the function returns before setting any of the other members. The \textbf{MP\_PREC}
768 used to dictate the minimum precision of newly initialized mp\_int integers. Ideally, it is at least equal to the smallest
771 Allocating a block of digits at first instead of a single digit has the benefit of lowering the number of usually slow
773 memory and the number of heap operations will be trivial.
776 \textbf{alloc} members initialized. This ensures that the mp\_int will always represent the default state of zero regardless
777 of the original condition of the input.
782 a subsequent expression (or body of expressions) are to be evaluated upto $c - b$ times so long as $b \le c$. In each
784 the loop would not iterate. By contrast if the ``downto'' keyword were used in place of ``to'' the loop would iterate
794 One immediate observation of this initializtion function is that it does not return a pointer to a mp\_int structure. It
796 call to mp\_init() is used only to initialize the members of the structure to a known default state.
805 accomplished by using calloc() instead of malloc(). However, to correctly initialize a integer type to a given value in a
809 After the memory has been successfully initialized the remainder of the members are initialized
828 3. Free the memory allocated for the digits of $a$. \\
849 with the exception of algorithms mp\_init, mp\_init\_copy, mp\_init\_size and mp\_clear.
862 The digits of the mp\_int are cleared by the for loop (line 27) which assigns a zero to every digit. Similar to mp\_init()
863 the digits are assigned zero instead of using block memory operations (such as memset()) since this is more portable.
875 able to augment the precision of an mp\_int and
878 These algorithms complete the set of low level algorithms required to work with mp\_int structures in the higher level
882 When storing a value in an mp\_int structure, a sufficient number of digits must be available to accomodate the entire
883 result of an operation without loss of precision. Quite often the size of the array given by the \textbf{alloc} member
884 is large enough to simply increase the \textbf{used} digit count. However, when the size of the array is too small it
897 4. Re-allocate the array of digits $a$ to size $v$ \\
913 The requested digit count is padded up to next multiple of \textbf{MP\_PREC} plus an additional \textbf{MP\_PREC} (steps two and three).
916 It is assumed that the reallocation (step four) leaves the lower $a.alloc$ digits of the mp\_int intact. This is much
928 if the \textbf{alloc} member of the mp\_int is smaller than the requested digit count. If the count is not larger than \textbf{alloc}
932 padded upwards to 2nd multiple of \textbf{MP\_PREC} larger than \textbf{alloc} (line 25). The XREALLOC function is used
934 function leaves the base of the allocation intact which means the first \textbf{alloc} digits of the mp\_int are the same as before
938 an error with a valid pointer. Earlier releases of the library stored the result of XREALLOC into the mp\_int $a$. That would
942 Occasionally the number of digits required will be known in advance of an initialization, based on, for example, the size
943 of input mp\_ints to a given algorithm. The purpose of algorithm mp\_init\_size is similar to mp\_init except that it
944 will allocate \textit{at least} a specified number of digits.
951 \textbf{Input}. An mp\_int $a$ and the requested number of digits $b$. \\
971 This algorithm will initialize an mp\_int structure $a$ like algorithm mp\_init with the exception that the number of
973 multiple of \textbf{MP\_PREC} plus an additional \textbf{MP\_PREC} digits. This padding is used to prevent trivial
974 allocations from becoming a bottleneck in the rest of the algorithms.
977 particular algorithm is useful if it is known ahead of time the approximate size of the input. If the approximation is
987 The number of digits $b$ requested is padded (line 24) by first augmenting it to the next multiple of
995 returns succesfully then it is correct to assume that the mp\_int structure is in a valid state for the remainder of the
999 Occasionally a function will require a series of mp\_int data types to be made available simultaneously.
1000 The purpose of algorithm mp\_init\_multi is to initialize a variable length array of mp\_int structures in a single
1007 \textbf{Input}. Variable length array $V_k$ of mp\_int variables of length $k$. \\
1008 \textbf{Output}. The array is initialized such that each mp\_int of $V_k$ is ready to use. \\
1024 The algorithm will initialize the array of mp\_int variables one at a time. If a runtime error has been detected
1025 (\textit{step 1.2}) all of the previously initialized variables are cleared. The goal is an ``all or nothing''
1035 This function intializes a variable length list of mp\_int structure pointers. However, instead of having the mp\_int
1036 structures in an actual C array they are simply passed as arguments to the function. This function makes use of the
1037 ``...'' argument syntax of the C programming language. The list is terminated with a final \textbf{NULL} argument
1041 $n$ of succesfully initialized mp\_int structures is maintained (line 48) such that if a failure does occur,
1046 When a function anticipates a result will be $n$ digits it is simpler to assume this is true within the body of
1047 the function instead of checking during the computation. For example, a multiplication of a $i$ digit number by a
1048 $j$ digit produces a result of at most $i + j$ digits. It is entirely possible that the result is $i + j - 1$
1051 That would be a considerable waste of time since heap operations are relatively slow.
1057 For example, suppose the product of two integers was $x_n = (0x_{n-1}x_{n-2}...x_0)_{\beta}$. The leading zero digit
1058 will not contribute to the precision of the result. In fact, through subsequent operations more leading zero digits would
1059 accumulate to the point the size of the integer would be prohibitive. As a result even though the precision is very
1072 \textbf{Output}. Any excess leading zero digits of $a$ are removed \\
1087 when all of the digits are zero to ensure that the mp\_int is valid at all times.
1096 Note on line 28 how to test for the \textbf{used} count is made on the left of the \&\& operator. In the C programming
1104 $\left [ 1 \right ]$ & Discuss the relevance of the \textbf{used} member of the mp\_int structure. \\
1106 $\left [ 1 \right ]$ & Discuss the consequences of not using padding when performing allocations. \\
1111 $\left [ 1 \right ]$ & Discuss the relevance of the algorithm mp\_clamp. What does it prevent? \\
1113 $\left [ 1 \right ]$ & Give an example of when the algorithm mp\_init\_copy might be useful. \\
1125 In the previous chapter a series of low level algorithms were established that dealt with initializing and maintaining
1126 mp\_int structures. This chapter will discuss another set of seemingly non-algebraic algorithms which will form the low
1127 level basis of the entire library. While these algorithm are relatively trivial it is important to understand how they
1130 The algorithms in this chapter deal primarily with more ``programmer'' related tasks such as creating copies of
1131 mp\_int structures, assigning small values to mp\_int structures and comparisons of the values mp\_int structures
1137 a copy for the purposes of this text. The copy of the mp\_int will be a separate entity that represents the same
1145 \textbf{Output}. Store a copy of $a$ in $b$. \\
1162 This algorithm copies the mp\_int $a$ such that upon succesful termination of the algorithm the mp\_int $b$ will
1163 represent the same integer as the mp\_int $a$. The mp\_int $b$ shall be a complete and distinct copy of the
1164 mp\_int $a$ meaing that the mp\_int $a$ can be modified and it shall not affect the value of the mp\_int $b$.
1166 If $b$ does not have enough room for the digits of $a$ it must first have its precision augmented via the mp\_grow
1167 algorithm. The digits of $a$ are copied over the digits of $b$ and any excess digits of $b$ are set to zero (step two
1168 and three). The \textbf{used} and \textbf{sign} members of $a$ are finally copied over the respective members of
1171 \textbf{Remark.} This algorithm also introduces a new idiosyncrasy that will be used throughout the rest of the
1172 text. The error return codes of other algorithms are not explicitly checked in the pseudo-code presented. For example, in
1173 step one of the mp\_copy algorithm the return of mp\_grow is not explicitly checked to ensure it succeeded. Text space is
1175 the error code itself. However, the C code presented will demonstrate all of the error handling logic required to
1189 The mp\_int $b$ must have enough digits to accomodate the used digits of the mp\_int $a$. If $b.alloc$ is less than
1190 $a.used$ the algorithm mp\_grow is used to augment the precision of $b$ (lines 30 to 33). In order to
1192 of the mp\_ints $a$ and $b$ respectively. These aliases (lines 43 and 46) allow the compiler to access the digits without first dereferencing the
1196 digits of $b$ are set to zero (lines 54 to 56). Both ``for'' loops make use of the pointer aliases and in
1200 \textbf{Remarks.} The use of pointer aliases is an implementation methodology first introduced in this function that will
1202 number of pointer dereferencing operations required to access data. For example, a for loop may resemble
1221 array of digits within an mp\_int structure directly. It may seem that a pointer alias is strictly not required
1228 stands a better chance of being faster.
1231 loop of the function mp\_copy() re-written to not use pointer aliases.
1241 complicated as there are four variables within the statement instead of just two.
1244 Another commonly used technique in the source routines is that certain sections of code are nested. This is used in
1251 the various temporary variables required do not propagate into other sections of code.
1255 Another common operation is to make a local temporary copy of an mp\_int argument. To initialize an mp\_int
1265 \textbf{Output}. $a$ is initialized to be a copy of $b$. \\
1269 3. Return the status of the copy operation. \\
1287 This will initialize \textbf{a} and make it a verbatim copy of the contents of \textbf{b}. Note that
1300 \textbf{Output}. Zero the contents of $a$ \\
1322 After the function is completed, all of the digits are zeroed, the \textbf{used} count is zeroed and the
1327 With the mp\_int representation of an integer, calculating the absolute value is trivial. The mp\_abs algorithm will compute
1328 the absolute value of an mp\_int.
1348 This algorithm computes the absolute of an mp\_int input. First it copies $a$ over $b$. This is an example of an
1364 With the mp\_int representation of an integer, calculating the negation is also trivial. The mp\_neg algorithm will compute
1365 the negative of an mp\_int input.
1389 This algorithm computes the negation of an input. First it copies $a$ over $b$. If $a$ has no used digits then
1402 have to make sure that only non--zero values get a \textbf{sign} of \textbf{MP\_NEG}. If the mp\_int is zero
1445 We can quickly reduce modulo $\beta$ since it is of the form $2^k$ and a quick binary AND operation with
1448 One important limitation of this function is that it will only set one digit. The size of a digit is not fixed, meaning source that uses
1452 To overcome the limitations of the mp\_set algorithm the mp\_set\_int algorithm is ideal. It accepts a ``long''
1476 The algorithm performs eight iterations of a simple loop where in each iteration four bits from the source are added to the
1479 incremented to reflect the addition. The \textbf{used} digit counter is incremented since if any of the leading digits were zero the mp\_int would have
1491 This function sets four bits of the number at a time to handle all practical \textbf{DIGIT\_BIT} sizes. The weird
1492 addition on line 39 ensures that the newly added in bits are added to the number of digits. While it may not
1493 seem obvious as to why the digit counter does not grow exceedingly large it is because of the shift on line 28
1495 the number of used digits low.
1502 positions. If any leading digit of one integer is greater than a digit in the same position of another integer then obviously it must be greater.
1504 The first comparision routine that will be developed is the unsigned magnitude compare which will perform a comparison based on the digits of two
1505 mp\_int variables alone. It will ignore the sign of the two inputs. Such a function is useful when an absolute comparison is required or if the
1508 To facilitate working with the results of the comparison functions three constants are required.
1528 \textbf{Output}. Unsigned comparison results ($a$ to the left of $b$). \\
1543 By saying ``$a$ to the left of $b$'' it is meant that the comparison is with respect to $a$, that is if $a$ is greater than $b$ it will return
1544 \textbf{MP\_GT} and similar with respect to when $a = b$ and $a < b$. The first two steps compare the number of digits used in both $a$ and $b$.
1545 Obviously if the digit counts differ there would be an imaginary zero digit in the smaller number where the leading digit of the larger number is.
1546 If both have the same number of digits than the actual digits themselves must be compared starting at the leading digit.
1548 By step three both inputs must have the same number of digits so its safe to start from either $a.used - 1$ or $b.used - 1$ and count down to
1549 the zero'th digit. If after all of the digits have been compared, no difference is found, the algorithm returns \textbf{MP\_EQ}.
1558 The two if statements (lines 25 and 29) compare the number of digits in the two inputs. These two are
1559 performed before all of the digits are compared since it is a very cheap test to perform and can potentially save
1561 smaller than $a.used$, meaning that undefined values will be read from $b$ past the end of the array of digits.
1574 \textbf{Output}. Signed Comparison Results ($a$ to the left of $b$) \\
1579 \hspace{+3mm}3.1 Return the unsigned comparison of $b$ and $a$ (\textit{mp\_cmp\_mag}) \\
1581 \hspace{+3mm}4.1 Return the unsigned comparison of $a$ and $b$ \\
1589 The first two steps compare the signs of the two inputs. If the signs do not agree then it can return right away with the appropriate
1590 comparison code. When the signs are equal the digits of the inputs must be compared to determine the correct result. In step
1591 three the unsigned comparision flips the order of the arguments since they are both negative. For instance, if $-a > -b$ then
1608 $\left [ 2 \right ]$ & Modify algorithm mp\_set\_int to accept as input a variable length array of bits. \\
1611 & of two random digits (of equal magnitude) before a difference is found. \\
1613 $\left [ 1 \right ]$ & Suggest a simple method to speed up the implementation of mp\_cmp\_mag based \\
1621 established. The next logical set of algorithms to develop are addition, subtraction and digit shifting algorithms. These
1622 algorithms make use of the lower level algorithms and are the cruicial building block for the multiplication algorithms. It is very important
1626 All of the algorithms within this chapter make use of the logical bit shift operations denoted by $<<$ and $>>$ for left and right
1627 logical shifts respectively. A logical shift is analogous to sliding the decimal point of radix-10 representations. For example, the real
1629 Algebraically a binary logical shift is equivalent to a division or multiplication by a power of two.
1639 As a result subtraction can be performed with a trivial series of logical operations and an addition.
1641 However, in multiple precision arithmetic negative numbers are not represented in the same way. Instead a sign flag is used to keep track of the
1642 sign of the integer. As a result signed addition and subtraction are actually implemented as conditional usage of lower level addition or
1645 The lower level algorithms will add or subtract integers without regard to the sign flag. That is they will add or subtract the magnitude of
1649 An unsigned addition of multiple precision integers is performed with the same long-hand algorithm used to add decimal numbers. That is to add the
1697 This algorithm is loosely based on algorithm 14.7 of HAC \cite[pp. 594]{HAC} but has been extended to allow the inputs to have different magnitudes.
1698 Coincidentally the description of algorithm A in Knuth \cite[pp. 266]{TAOCPV2} shares the same deficiency as the algorithm from \cite{HAC}. Even the
1699 MIX pseudo machine code presented by Knuth \cite[pp. 266-267]{TAOCPV2} is incapable of handling inputs which are of different magnitudes.
1701 The first thing that has to be accomplished is to sort out which of the two inputs is the largest. The addition logic
1702 will simply add all of the smallest input to the largest input and store that first part of the result in the
1703 destination. Then it will apply a simpler addition loop to excess digits of the larger input.
1705 The first two steps will handle sorting the inputs such that $min$ and $max$ hold the digit counts of the two
1707 same number of digits. After the inputs are sorted the destination $c$ is grown as required to accomodate the sum
1708 of the two inputs. The original \textbf{used} count of $c$ is copied and set to the new used count.
1712 one digit of the summand. First
1713 two digits from $a$ and $b$ are added together along with the carry $\mu$. The carry of this step is extracted and stored
1714 in $\mu$ and finally the digit of the result $c_n$ is truncated within the range $0 \le c_n < \beta$.
1716 Now all of the digit positions that both inputs have in common have been exhausted. If $min \ne max$ then $x$ is an alias
1717 for one of the inputs that has more digits. A simplified addition loop is then used to essentially copy the remaining digits
1732 grow the destination (38 to 42) ensure that it can accomodate the result of the addition.
1734 Similar to the implementation of mp\_copy this function uses the braced code and local aliases coding style. The three aliases that are on
1736 compiler does not have to dereference $a$, $b$ or $c$ (respectively) to access the digits of the respective mp\_int.
1738 The initial carry $u$ will be cleared (line 65), note that $u$ is of type mp\_digit which ensures type
1740 both inputs until the smallest input runs out of digits. Similarly the conditional addition loop
1741 (line 81 to 90) adds the remaining digits from the larger of the two inputs. The addition is finished
1743 After line 94, $tmpc$ will point to the $c.used$'th digit of the mp\_int $c$. This is useful
1754 the range $0 \le x < 2\beta$ for the algorithms to work correctly. However, it is allowable that a mp\_digit represent a larger range of values. For
1755 this algorithm we will assume that the variable $\gamma$ represents the number of bits available in a
1787 10. Clamp excess digits of $c$. (\textit{mp\_clamp}). \\
1797 This algorithm performs the unsigned subtraction of two mp\_int variables under the restriction that the result must be positive. That is when
1800 of the algorithm s\_mp\_add both other references lack discussion concerning various practical details such as when the inputs differ in magnitude.
1802 The initial sorting of the inputs is trivial in this algorithm since $a$ is guaranteed to have at least the same magnitude of $b$. Steps 1 and 2
1804 most $max$ digits in length as opposed to $max + 1$. Similar to the addition algorithm the \textbf{used} count of $c$ is copied locally and
1807 The subtraction loop that begins on step seven is essentially the same as the addition loop of algorithm s\_mp\_add except single precision
1808 subtraction is used instead. Note the use of the $\gamma$ variable to extract the carry (\textit{also known as the borrow}) within the subtraction
1813 third bit of $0101_2$ is subtracted from the result it will cause another carry. In this case though the carry will be forced to propagate all the
1817 significant bit. Thus, the high order bits of the mp\_digit that are not part of the actual digit will either be all zero, or all one. All that
1819 carry. This method of carry extraction may seem awkward but the reason for it becomes apparent when the implementation is discussed.
1822 10 will ensure that any leading digits of $c$ above the $max$'th position are zeroed.
1837 The first subtraction loop (lines 47 through 61) subtract digits from both inputs until the smaller of
1839 method of extracting the carry (line 57). The traditional method for extracting the carry would be to shift
1840 by $lg(\beta)$ positions and logically AND the least significant bit. The AND operation is required because all of
1851 established. This high level addition algorithm will be what other algorithms and developers will use to perform addition of mp\_int data
1854 Recall from section 5.2 that an mp\_int represents an integer with an unsigned mantissa (\textit{the array of digits}) and a \textbf{sign}
1855 flag. A high level addition is actually performed as a series of eight separate cases which can be optimized down to three unique cases.
1882 This algorithm performs the signed addition of two mp\_int variables. There is no reference algorithm to draw upon from
1890 \hline \textbf{Sign of $a$} & \textbf{Sign of $b$} & \textbf{$\vert a \vert > \vert b \vert $} & \textbf{Unsigned Operation} & \textbf{Result Sign Flag} \\
1913 Figure~\ref{fig:AddChart} lists all of the eight possible input combinations and is sorted to show that only three
1914 specific cases need to be handled. The return code of the unsigned operations at step 1.2, 2.1.2 and 2.2.2 are
1915 forwarded to step three to check for errors. This simplifies the description of the algorithm considerably and best
1918 Also note how the \textbf{sign} is set before the unsigned addition or subtraction is performed. Recall from the descriptions of algorithms
1922 For example, consider performing $-a + a$ with algorithm mp\_add. By the description of the algorithm the sign is set to \textbf{MP\_NEG} which would
1923 produce a result of $-0$. However, since the sign is set first then the unsigned addition is performed the subsequent usage of algorithm mp\_clamp
1933 The source code follows the algorithm fairly closely. The most notable new source code addition is the usage of the $res$ integer variable which
1934 is used to pass result of the unsigned operations forward. Unlike in the algorithm, the variable $res$ is merely returned as is without
1969 This algorithm performs the signed subtraction of two inputs. Similar to algorithm mp\_add there is no reference in either \cite{TAOCPV2} or
1977 \hline \textbf{Sign of $a$} & \textbf{Sign of $b$} & \textbf{$\vert a \vert \ge \vert b \vert $} & \textbf{Unsigned Operation} & \textbf{Result Sign Flag} \\
1986 \hline $+$ & $+$ & No & $c = b - a$ & $\mbox{opposite of }a.sign$ \\
1987 \hline $-$ & $-$ & No & $c = b - a$ & $\mbox{opposite of }a.sign$ \\
1996 Similar to the case of algorithm mp\_add the \textbf{sign} is set first before the unsigned addition or subtraction. That is to prevent the
2006 Much like the implementation of algorithm mp\_add the variable $res$ is used to catch the return code of the unsigned addition or subtraction operations
2007 and forward it to the end of the function. On line 39 the ``not equal to'' \textbf{MP\_LT} expression is used to emulate a
2011 It is quite common to think of a multiple precision integer as a polynomial in $x$, that is $y = f(\beta)$ where $f(x) = \sum_{i=0}^{n-1} a_i x^i$.
2012 This notation arises within discussion of Montgomery and Diminished Radix Reduction as well as Karatsuba multiplication and squaring.
2014 In order to facilitate operations on polynomials in $x$ as above a series of simple ``digit'' algorithms have to be established. That is to shift
2015 the digits left or right as well to shift individual bits of the digits left and right. It is important to note that not all ``shift'' operations
2020 In a binary system where the radix is a power of two multiplication by two not only arises often in other algorithms it is a fairly efficient
2055 This algorithm will quickly multiply a mp\_int by two provided $\beta$ is a power of two. Neither \cite{TAOCPV2} nor \cite{HAC} describe such
2059 Step 1 and 2 grow the input as required to accomodate the maximum number of \textbf{used} digits in the result. The initial \textbf{used} count
2062 Step 6 is an optimization implementation of the addition loop for this specific case. That is since the two values being added together
2063 are the same there is no need to perform two reads from the digits of $a$. Step 6.1 performs a single precision shift on the current digit $a_n$ to
2064 obtain what will be the carry for the next iteration. Step 6.2 calculates the $n$'th digit of the result as single precision shift of $a_n$ plus
2065 the previous carry. Recall from section 4.1 that $a_n << 1$ is equivalent to $a_n \cdot 2$. An iteration of the addition loop is finished with
2068 Step 7 takes care of any final carry by setting the $a.used$'th digit of the result to the carry and augmenting the \textbf{used} count of $b$.
2069 Step 8 clears any leading digits of $b$ in case it originally had a larger magnitude than $a$.
2078 This implementation is essentially an optimized implementation of s\_mp\_add for the case of doubling an input. The only noteworthy difference
2079 is the use of the logical shift operator on line 52 to perform a single precision doubling.
2105 9. Clamp excess digits of $b$. (\textit{mp\_clamp}) \\
2116 core as the basis of the algorithm. Unlike mp\_mul\_2 the shift operations work from the leading digit to the trailing digit. The algorithm
2117 could be written to work from the trailing digit to the leading digit however, it would have to stop one short of $a.used - 1$ digits to prevent
2118 reading past the end of the array of digits.
2120 Essentially the loop at step 6 is similar to that of mp\_mul\_2 except the logical shifts go in the opposite direction and the carry is at the
2136 Converting from an array of digits to polynomial basis is very simple. Consider the integer $y \equiv (a_2, a_1, a_0)_{\beta}$ and recall that
2143 degree. In this case $f(x) \cdot x = a_n x^{n+1} + a_{n-1} x^n + ... + a_0 x$. From a scalar basis point of view multiplying by $x$ is equivalent to
2175 This algorithm multiplies an mp\_int by the $b$'th power of $x$. This is equivalent to multiplying by $\beta^b$. The algorithm differs
2180 $b \le 0$ since the rest of algorithm is only valid when $b > 0$.
2183 the digits of $a$ of length $b$. The head of the sliding window is at $i$ (\textit{the leading digit}) and the tail at $j$ (\textit{the trailing digit}).
2207 window of exactly $b$ digits over the input.
2211 Division by powers of $x$ is easily achieved by shifting the digits right and removing any that will end up to the right of the zero'th digit.
2243 This algorithm divides the input in place by the $b$'th power of $x$. It is analogous to dividing by a $\beta^b$ but much quicker since
2249 After the trivial cases of inputs have been handled the sliding window is setup. Much like the case of algorithm mp\_lshd a sliding window that
2262 The only noteworthy element of this routine is the lack of a return type since it cannot fail. Like mp\_lshd() we
2264 the upper digits of the input to make sure the result is correct.
2266 \section{Powers of Two}
2269 example, to quickly multiply by $2^k$ for any $k$ without using a full multiplier algorithm would prove useful. Instead of performing single
2270 shifts $k$ times to achieve a multiplication by $2^{\pm k}$ a mixture of whole digit shifting and partial digit shifting is employed.
2272 \subsection{Multiplication by Power of Two}
2308 This algorithm multiplies $a$ by $2^b$ and stores the result in $c$. The algorithm uses algorithm mp\_lshd and a derivative of algorithm mp\_mul\_2 to
2315 After the digits have been shifted appropriately at most $lg(\beta) - 1$ shifts are left to perform. Step 5 calculates the number of remaining shifts
2317 Essentially the loop is a generic version of algorithm mp\_mul\_2 designed to handle any shift count in the range $1 \le x < lg(\beta)$. The $mask$
2321 complete. It is possible to optimize this algorithm down to a $O(n)$ algorithm at a cost of making the algorithm slightly harder to follow.
2334 If the shift count $b$ is larger than $lg(\beta)$ then a call to mp\_lshd() is used to handle all of the multiples
2335 of $lg(\beta)$. Leaving only a remaining shift of $lg(\beta) - 1$ or fewer bits left. Inside the actual shift
2336 loop (lines 46 to 76) we make use of pre--computed values $shift$ and $mask$. These are used to
2337 extract the carry bit(s) to pass into the next iteration of the loop. The $r$ and $rr$ variables form a
2340 \subsection{Division by Power of Two}
2366 7. Clamp excess digits of $c$. (\textit{mp\_clamp}) \\
2377 mp\_mul\_2d by first using whole digit shifts then single precision shifts. This algorithm will also produce the remainder of the division
2387 The implementation of algorithm mp\_div\_2d is slightly different than the algorithm specifies. The remainder $d$ may be optionally
2389 result of the remainder operation until the end. This allows $d$ and $a$ to represent the same mp\_int without modifying $a$ before
2392 The remainder of the source code is essentially the same as the source code for mp\_mul\_2d. The only significant difference is
2393 the direction of the shifts.
2395 \subsection{Remainder of Division by Power of Two}
2397 The last algorithm in the series of polynomial basis power of two algorithms is calculating the remainder of division by $2^b$. This
2413 \hspace{3mm}2.2 Return the result of step 2.1. \\
2420 8. Clamp excess digits of $c$. (\textit{mp\_clamp}) \\
2430 This algorithm will quickly calculate the value of $a \mbox{ (mod }2^b\mbox{)}$. First if $b$ is less than or equal to zero the
2431 result is set to zero. If $b$ is greater than the number of bits in $a$ then it simply copies $a$ to $c$ and returns. Otherwise, $a$
2441 We first avoid cases of $b \le 0$ by simply mp\_zero()'ing the destination in such cases. Next if $2^b$ is larger
2447 leading digit of both (line 46) and then mp\_clamp().
2451 $\left [ 3 \right ] $ & Devise an algorithm that performs $a \cdot 2^b$ for generic values of $b$ \\
2458 $\left [ 2 \right ] $ & Modify the preceding algorithm to handle values of the form \\
2463 & any $n$-bit input. Note that the time of addition is ignored in the \\
2466 $\left [ 5 \right ] $ & Improve the previous algorithm to have a working time of at most \\
2467 & $O \left (2^{(k-1)}n + \left ({2n^2 \over k} \right ) \right )$ for an appropriate choice of $k$. Again ignore \\
2468 & the cost of addition. \\
2470 $\left [ 2 \right ] $ & Devise a chart to find optimal values of $k$ for the previous problem \\
2471 & for $n = 64 \ldots 1024$ in steps of $64$. \\
2474 & calculating the result of a signed comparison. \\
2480 For most number theoretic problems including certain public key cryptographic algorithms, the ``multipliers'' form the most important subset of
2481 algorithms of any multiple precision integer package. The set of multiplier algorithms include integer multiplication, squaring and modular reduction
2482 where in each of the algorithms single precision multiplication is the dominant operation performed. This chapter will discuss integer multiplication
2485 The importance of the multiplier algorithms is for the most part driven by the fact that certain popular public key algorithms are based on modular
2486 exponentiation, that is computing $d \equiv a^b \mbox{ (mod }c\mbox{)}$ for some arbitrary choice of $a$, $b$, $c$ and $d$. During a modular
2487 exponentiation the majority\footnote{Roughly speaking a modular exponentiation will spend about 40\% of the time performing modular reductions,
2488 35\% of the time performing squaring and 25\% of the time performing multiplications.} of the processor time is spent performing single precision
2491 For centuries general purpose multiplication has required a lengthly $O(n^2)$ process, whereby each digit of one multiplicand has to be multiplied
2492 against every digit of the other multiplicand. Traditional long-hand multiplication is based on this process; while the techniques can differ the
2495 This technique led to the discovery of polynomial basis algorithms (\textit{good reference?}) and subquently Fourier Transform based solutions.
2501 Computing the product of two integers in software can be achieved using a trivial adaptation of the standard $O(n^2)$ long-hand multiplication
2504 simplify most discussions, it will be assumed that the inputs have comparable number of digits.
2508 facet of this algorithm, is that it has been modified to only produce a certain amount of output digits as resolution. The importance of this
2509 modification will become evident during the discussion of Barrett modular reduction. Recall that for a $n$ and $m$ digit input the product
2510 will be at most $n + m$ digits. Therefore, this algorithm can be reduced to a full multiplier by having it produce $n + m$ digits of the product.
2512 Recall from sub-section 4.2.2 the definition of $\gamma$ as the number of bits in the type \textbf{mp\_digit}. We shall now extend the variable set to
2513 include $\alpha$ which shall represent the number of bits in the type \textbf{mp\_word}. This implies that $2^{\alpha} > 2 \cdot \beta^2$. The
2514 constant $\delta = 2^{\alpha - 2lg(\beta)}$ will represent the maximal weight of any column in a product (\textit{see sub-section 5.2.2 for more information}).
2526 \hspace{3mm}1.2 Return the result of step 1.1 \\
2529 2. Init $t$ to be of size $digs$ \\
2544 6. Clamp excess digits of $t$. \\
2556 This algorithm computes the unsigned product of two inputs $a$ and $b$, limited to an output precision of $digs$ digits. While it may seem
2557 a bit awkward to modify the function from its simple $O(n^2)$ description, the usefulness of partial multipliers will arise in a subsequent
2558 algorithm. The algorithm is loosely based on algorithm 14.12 from \cite[pp. 595]{HAC} and is similar to Algorithm M of Knuth \cite[pp. 268]{TAOCPV2}.
2559 Algorithm s\_mp\_mul\_digs differs from these cited references since it can produce a variable output precision regardless of the precision of the
2562 The first thing this algorithm checks for is whether a Comba multiplier can be used instead. If the minimum digit count of either
2564 temporary mp\_int variable $t$ is used to hold the intermediate result of the product. This allows the algorithm to be used to
2567 All of step 5 is the infamous $O(n^2)$ multiplication loop slightly modified to only produce upto $digs$ digits of output. The $pb$ variable
2568 is given the count of digits to read from $b$ inside the nested loop. If $pb \le 1$ then no more output digits can be produced and the algorithm
2569 will exit the loop. The best way to think of the loops are as a series of $pb \times 1$ multiplications. That is, in each pass of the
2590 Each row of the product is added to the result after being shifted to the left (\textit{multiplied by a power of the radix}) by the appropriate
2591 count. That is in pass $ix$ of the inner loop the product is added starting at the $ix$'th digit of the reult.
2611 sing the Comba routine are that min$(a.used, b.used) < \delta$ and the number of digits of output is less than
2616 $t$ (line 37) to the exact size of the output to avoid further re--allocations. At this point we now
2619 This implementation of multiplication has the caveat that it can be trimmed to only produce a variable number of
2620 digits as output. In each iteration of the outer loop the $pb$ variable is set (line 49) to the maximum
2621 number of inner loop iterations.
2623 Inside the inner loop we calculate $\hat r$ as the mp\_word product of the two mp\_digits and the addition of the
2628 Each digit of the product is stored in turn (line 69) and the carry propagated (line 72) to the
2633 One of the huge drawbacks of the ``baseline'' algorithms is that at the $O(n^2)$ level the carry must be
2636 Comba who described a method of implementing fast multipliers that do not require nested carry fixup operations. As an
2640 At the heart of the Comba technique is once again the long-hand algorithm. Except in this case a slight
2641 twist is placed on how the columns of the result are produced. In the standard long-hand algorithm rows of products
2645 In the Comba algorithm the columns of the result are produced entirely independently of each other. That is at
2646 the $O(n^2)$ level a simple multiplication and addition step is performed. The carries of the columns are propagated
2647 after the nested loop to reduce the amount of work requiored. Succintly the first step of the algorithm is to compute
2654 Where $\vec x_n$ is the $n'th$ column of the output vector. Consider the following example which computes the vector $\vec x$ for the multiplication
2655 of $576$ and $241$.
2674 At this point the vector $x = \left < 10, 34, 45, 31, 6 \right >$ is the result of the first step of the Comba multipler.
2683 \textbf{Input}. Vector $\vec x$ of dimension $k$ \\
2702 At the nested $O(n^2)$ level the Comba method adds the product of two single precision variables to each column of the output
2703 independently. A serious obstacle is if the carry is lost, due to lack of precision before the algorithm has a chance to fix
2704 the carries. For example, in the multiplication of two three-digit numbers the third column of output will be the sum of
2705 three single precision multiplications. If the precision of the accumulator for the output digits is less then $3 \cdot (\beta - 1)^2$ then
2706 an overflow can occur and the carry information will be lost. For any $m$ and $n$ digit inputs the maximum weight of any column is
2709 The maximum number of terms in any column of a product is known as the ``column weight'' and strictly governs when the algorithm can be used. Recall
2710 from earlier that a double precision type has $\alpha$ bits of resolution and a single precision digit has $lg(\beta)$ bits of precision. Given these
2723 Let $\rho = lg(\beta)$ represent the number of bits in a single precision digit. By further re-arrangement of the equation the final solution is
2732 $256$ digits would allow for numbers in the range of $0 \le x < 2^{7168}$ which, is much larger than most public key cryptographic algorithms require.
2742 Place an array of \textbf{MP\_WARRAY} single precision digits named $W$ on the stack. \\
2776 This algorithm performs the unsigned multiplication of $a$ and $b$ using the Comba method limited to $digs$ digits of precision.
2778 The outer loop of this algorithm is more complicated than that of the baseline multiplier. This is because on the inside of the
2782 The $ty$ variable is set to the minimum count of $ix$ or the number of digits in $b$. That way if $a$ has more digits than
2789 move $ty$ downards so the equality remains valid. The $iy$ variable is the number of iterations until
2792 After every inner pass we store the lower half of the accumulator into $W_{ix}$ and then propagate the carry of the accumulator
2795 To measure the benefits of the Comba method over the baseline method consider the number of operations that are required. If the
2796 cost in terms of time of a multiply and addition is $p$ and the cost of a carry propagation is $q$ then a baseline multiplication would require
2808 As per the pseudo--code we first calculate $pa$ (line 48) as the number of digits to output. Next we begin the outer loop
2809 to produce the individual columns of the product. We use the two aliases $tmpx$ and $tmpy$ (lines 62, 63) to point
2812 The inner loop (lines 71 to 74) of this implementation is where the tradeoff come into play. Originally this comba
2813 implementation was ``row--major'' which means it adds to each of the columns in each pass. After the outer loop it would then fix
2815 one mp\_word per iteration. On processors such as the Athlon XP and P4 this did not matter much since the cache bandwidth
2816 is very high and it can keep the ALU fed with data. It did, however, matter on older and embedded cpus where cache is often
2821 a carry for the next pass. After the outer loop we use the final carry (line 77) as the last digit of the product.
2825 the use of polynomial basis representation for two integers $a$ and $b$ as $f(x) = \sum_{i=0}^{n} a_i x^i$ and
2826 $g(x) = \sum_{i=0}^{n} b_i x^i$ respectively, is required. In this system both $f(x)$ and $g(x)$ have $n + 1$ terms and are of the $n$'th degree.
2832 However, numerical analysis theory indicates that only $2n + 1$ distinct points in $W(x)$ are required to determine the values of the $2n + 1$ unknown
2833 coefficients. This means by finding $\zeta_y = W(y)$ for $2n + 1$ small values of $y$ the coefficients of $W(x)$ can be found with
2837 The coefficients of the polynomial $W(x)$ are unknown which makes finding $W(y)$ for any value of $y$ impossible. However, since
2838 $W(x) = f(x)g(x)$ the equivalent $\zeta_y = f(y) g(y)$ can be used in its place. The benefit of this technique stems from the
2840 by multiplying $f(y)g(y)$ involves multiplying integers that are much smaller than either of the inputs.
2845 simple to explain. The $2n + 1$'th coefficient of $W(x)$ is numerically equivalent to the most significant column in an integer multiplication.
2849 If more points are required they should be of small values and powers of two such as $2^q$ and the related \textit{mirror points}
2850 $\left (2^q \right )^{2n} \cdot \zeta_{2^{-q}}$ for small values of $q$. The term ``mirror point'' stems from the fact that
2859 Using such points will allow the values of $f(y)$ and $g(y)$ to be independently calculated using only left shifts. For example, when $n = 2$ the
2860 polynomial $f(2^q)$ is equal to $2^q((2^qa_2) + a_1) + a_0$. This technique of polynomial representation is known as Horner's method.
2862 As a general rule of the algorithm when the inputs are split into $n$ parts each there are $2n - 1$ multiplications. Each multiplication is of
2863 multiplicands that have $n$ times fewer digits than the inputs. The asymptotic running time of this algorithm is
2864 $O \left ( k^{lg_n(2n - 1)} \right )$ for $k$ digit inputs (\textit{assuming they have the same number of digits}). Figure~\ref{fig:exponent}
2865 summarizes the exponents for various values of $n$.
2882 \caption{Asymptotic Running Time of Polynomial Basis Multiplication}
2887 of solving for the 2001 terms of $W(x)$ will certainly consume any savings the algorithm could offer for all but exceedingly large
2892 the algorithms incur an overhead (\textit{at the $O(n)$ work level}) since they require a system of equations to be solved. This makes the
2895 Let $m$ represent the number of digits in the multiplicands (\textit{assume both multiplicands have the same number of digits}). There exists a
2899 The exact location of $y$ depends on several key architectural elements of the computer platform in question.
2902 \item The ratio of clock cycles for single precision multiplication versus other simpler operations such as addition, shifting, etc. For example
2903 on the AMD Athlon the ratio is roughly $17 : 1$ while on the Intel P4 it is $29 : 1$. The higher the ratio in favour of multiplication the lower
2906 \item The complexity of the linear system of equations (\textit{for the coefficients of $W(x)$}) is. Generally speaking as the number of splits
2907 grows the complexity grows substantially. Ideally solving the system will only involve addition, subtraction and shifting of integers. This
2910 \item To a lesser extent memory bandwidth and function call overheads. Provided the values are in the processor cache this is less of an
2915 A clean cutoff point separation occurs when a point $y$ is found such that all of the cutoff point conditions are met. For example, if the point
2916 is too low then there will be values of $m$ such that $m > y$ and the Comba method is still faster. Finding the cutoff points is fairly simple when
2920 Karatsuba \cite{KARA} multiplication when originally proposed in 1962 was among the first set of algorithms to break the $O(n^2)$ barrier for
2922 light algebra \cite{KARAP} that the following polynomial is equivalent to multiplication of the two integers the polynomials represent.
2929 this algorithm recursively, the work factor becomes $O(n^{lg(3)})$ which is substantially better than the work factor $O(n^2)$ of the Comba technique. It turns
2931 $\zeta_0$, $\zeta_{\infty}$ and $\zeta_{1}$. Consider the resultant system of equations.
2942 of this system of equations has made Karatsuba fairly popular. In fact the cutoff point is often fairly low\footnote{With LibTomMath 0.18 it is 70 and 109 digits for the Intel P4 and AMD Athlon respectively.}
2979 19. Clear all of the temporary variables. \\
2989 This algorithm computes the unsigned product of two inputs using the Karatsuba multiplication algorithm. It is loosely based on the description
2994 be used for both of the inputs meaning that it must be smaller than the smallest input. Step 3 chooses the radix point $B$ as half of the
3000 of an additional temporary variable, the algorithm can avoid an addition memory allocation operation.
3002 The remaining steps 13 through 18 compute the Karatsuba polynomial through a variety of digit shifting and addition operations.
3011 The new coding element in this routine, not seen in previous routines, is the usage of goto statements. The conventional
3013 to handle error recovery with a single piece of code. Lines 62 to 76 handle initializing all of the temporary variables
3014 required. Note how each of the if statements goes to a different label in case of failure. This allows the routine to correctly free only
3019 number of digits for the next section of code.
3021 The first algebraic portion of the algorithm is to split the two inputs into their halves. However, instead of using mp\_mod\_2d and mp\_rshd
3022 to extract the halves, the respective code has been placed inline within the body of the function. To initialize the halves, the \textbf{used} and
3027 By inlining the calculation of the halves, the Karatsuba multiplier has a slightly lower overhead and can be used for smaller magnitude inputs.
3034 chosen such that $\zeta$ is easy to compute and the resulting system of equations easy to reduce. Here, the points $\zeta_{0}$,
3036 of the $W(x)$.
3038 With the five relations that Toom-Cook specifies, the following system of equations is formed.
3050 A trivial solution to this matrix requires $12$ subtractions, two multiplications by a small power of two, two divisions by a small power
3051 of two, two divisions by three and one multiplication by three. All of these $19$ sub-operations require less than quadratic time, meaning that
3052 the algorithm can be faster than a baseline multiplication. However, the greater complexity of this algorithm places the cutoff point
3100 Now solve the system of equations. \\
3123 This algorithm computes the product of two mp\_int variables $a$ and $b$ using the Toom-Cook approach. Compared to the Karatsuba multiplication, this
3124 algorithm has a lower asymptotic running time of approximately $O(n^{1.464})$ but at an obvious cost in overhead. In this
3129 integers the coefficients of the polynomial basis representations $f(x)$ and $g(x)$ are known and can be used to find the relations required.
3136 $w_1, w_2$ and $w_3$ to be isolated. The steps 18 through 25 perform the system reduction required as previously described. Each step of
3152 Toom--Cook than a Comba or baseline approach (this is a savings of more than 99$\%$). For most ``crypto'' sized numbers this
3156 combinations of mp\_rshd() and mp\_mod\_2d() function calls. At this point $a = a2 \cdot \beta^2 + a1 \cdot \beta + a0$ and similiarly
3160 we get those out of the way first (lines 73 and 78). Next we compute $w1, w2$ and $w3$ using Horners method.
3162 After this point we solve for the actual values of $w1, w2$ and $w3$ by reducing the $5 \times 5$ system which is relatively
3166 Now that algorithms to handle multiplications of every useful dimensions have been developed, a rather simple finishing touch is required. So far all
3167 of the multiplication algorithms have been unsigned multiplications which leaves only a signed multiplication algorithm to be established.
3192 7. Return the result of the unsigned multiplication performed. \\
3201 This algorithm performs the signed multiplication of two inputs. It will make use of any of the three unsigned multiplication algorithms
3202 available when the input is of appropriate size. The \textbf{sign} of the result is not set until the end of the algorithm since algorithm
3212 The implementation is rather simplistic and is not particularly noteworthy. Line 22 computes the sign of the result using the ``?''
3218 Squaring is a special case of multiplication where both multiplicands are equal. At first it may seem like there is no significant optimization
3219 available but in fact there is. Consider the multiplication of $576$ against $241$. In total there will be nine single precision multiplications
3221 the multiplication of $123$ against $123$. The nine products are $3 \cdot 3$, $3 \cdot 2$, $3 \cdot 1$, $2 \cdot 3$, $2 \cdot 2$, $2 \cdot 1$,
3222 $1 \cdot 3$, $1 \cdot 2$ and $1 \cdot 1$. On closer inspection some of the products are equivalent. For example, $3 \cdot 2 = 2 \cdot 3$
3226 required for multiplication. The following diagram gives an example of the operations required.
3241 Starting from zero and numbering the columns from right to left a very simple pattern becomes obvious. For the purposes of this discussion let $x$
3242 represent the number being squared. The first observation is that in row $k$ the $2k$'th column of the product has a $\left (x_k \right)^2$ term in it.
3244 The second observation is that every column $j$ in row $k$ where $j \ne 2k$ is part of a double product. Every non-square term of a column will
3245 appear twice hence the name ``double product''. Every odd column is made up entirely of double products. In fact every column is made up of double
3249 occurs at column $2k + 1$. For example, on row $1$ of the previous squaring, column one is part of the double product with column one from row zero.
3250 Column two of row one is a square and column three is the first unique column.
3253 The baseline squaring algorithm is meant to be a catch-all squaring algorithm. It will handle any of the input sizes that the faster routines
3264 1. Init a temporary mp\_int of at least $2 \cdot a.used +1$ digits. (\textit{mp\_init\_size}) \\
3283 5. Clamp excess digits of $t$. (\textit{mp\_clamp}) \\
3295 This algorithm computes the square of an input using the three observations on squaring. It is based fairly faithfully on algorithm 14.16 of HAC
3296 \cite[pp.596-597]{HAC}. Similar to algorithm s\_mp\_mul\_digs, a temporary mp\_int is allocated to hold the result of the squaring. This allows the
3299 The outer loop of this algorithm begins on step 4. It is best to think of the outer loop as walking down the rows of the partial results, while
3300 the inner loop computes the columns of the partial result. Step 4.1 and 4.2 compute the square term for each row, and step 4.3 and 4.4 propagate
3307 Similar to algorithm s\_mp\_mul\_digs, after every pass of the inner loop, the destination is correctly set to the sum of all of the partial
3331 The first obvious solution is to make an array of mp\_words which will hold all of the columns. This will indeed eliminate all of the carry
3333 that $2a + 2b + 2c = 2(a + b + c)$. That is the sum of all of the double products is equal to double the sum of all the products. For example,
3336 However, we cannot simply double all of the columns, since the squares appear only once per row. The most practical solution is to have two
3348 Place an array of \textbf{MP\_WARRAY} mp\_digits named $W$ on the stack. \\
3384 This algorithm computes the square of an input using the Comba technique. It is designed to be a replacement for algorithm
3385 s\_mp\_sqr when the number of input digits is less than \textbf{MP\_WARRAY} and less than $\delta \over 2$.
3386 This algorithm is very similar to the Comba multiplier except with a few key differences we shall make note of.
3392 of the products just outside the inner loop we have to avoid doing this. This is also a good thing since we perform
3395 Finally the last difference is the addition of the ``square'' term outside the inner loop (step 5.8). We add in the square
3396 only to even outputs and it is the square of the term at the $\lfloor ix / 2 \rfloor$ position.
3405 This implementation is essentially a copy of Comba multiplication with the appropriate changes added to make it faster for
3406 the special case of squaring.
3410 is that $\zeta_y = f(y)g(y)$ is actually equivalent to $\zeta_y = f(y)^2$ since $f(y) = g(y)$. Instead of performing $2n + 1$
3414 Let $f(x) = ax + b$ represent the polynomial basis representation of a number to square.
3415 Let $h(x) = \left ( f(x) \right )^2$ represent the square of the polynomial. The Karatsuba equation can be modified to square a
3422 Upon closer inspection this equation only requires the calculation of three half-sized squares: $a^2$, $b^2$ and $(a + b)^2$. As in
3423 Karatsuba multiplication, this algorithm can be applied recursively on the input and will achieve an asymptotic running time of
3426 If the asymptotic times of Karatsuba squaring and multiplication are the same, why not simply use the multiplication algorithm
3444 2. If any of the initializations on step 1 failed return(\textit{MP\_MEM}). \\
3475 This algorithm computes the square of an input $a$ using the Karatsuba technique. This algorithm is very similar to the Karatsuba based
3478 The radix point for squaring is simply placed exactly in the middle of the digits when the input has an odd number of digits, otherwise it is
3480 as the radix point. The first two squares in steps 6 and 7 are rather straightforward while the last square is of a more compact form.
3483 Now if $5n$ single precision additions and a squaring of $n$-digits is faster than multiplying two $n$-digit numbers and doubling then
3486 Let $p$ represent the cost of a single precision addition and $q$ the cost of a single precision multiplication both in terms of time\footnote{Or
3505 ratio of 1:7. } than simpler operations such as addition.
3514 This implementation is largely based on the implementation of algorithm mp\_karatsuba\_mul. It uses the same inline style to copy and
3516 count of both $x0$ and $x1$ is fixed up and $x0$ is clamped before the calculations begin. At this point $x1$ and $x0$ are valid equivalents
3529 instead of multiplication to find the five relations. The reader is encouraged to read the description of the latter algorithm and try to
3552 5. Return the result of the unsigned squaring performed. \\
3561 This algorithm computes the square of the input using one of four different algorithms. If the input is very large and has at least
3563 neither of the polynomial basis algorithms should be used then either the Comba or baseline algorithm is used.
3574 $\left [ 3 \right ] $ & Devise an efficient algorithm for selection of the radix point to handle inputs \\
3575 & that have different number of digits in Karatsuba multiplication. \\
3577 $\left [ 2 \right ] $ & In section 5.3 the fact that every column of a squaring is made up \\
3578 & of double products and at most one square is stated. Prove this statement. \\
3587 $\left [ 3 \right ] $ & Implement a threaded version of Comba multiplication (and squaring) where you \\
3588 & compute subsets of the columns in each thread. Determine a cutoff point where \\
3592 & increase the throughput of mp\_exptmod() for random odd moduli in the range \\
3598 \section{Basics of Modular Reduction}
3601 such as factoring. Modular reduction algorithms are the third class of algorithms of the ``multipliers'' set. A number $a$ is said to be \textit{reduced}
3602 modulo another number $b$ by finding the remainder of the division $a/b$. Full integer division with remainder is a topic to be covered
3608 other forms of residues.
3615 range $0 \le x < c^2$ which can be taken advantage of to create several efficient algorithms. They have also been used to create redundancy check
3616 algorithms known as CRCs, error correction codes such as Reed-Solomon and solve a variety of number theoeretic problems.
3620 division. Barretts observation was that the residue $c$ of $a$ modulo $b$ is equal to
3628 DSP intuition on its own will not work as these numbers are considerably larger than the precision of common DSP floating point data types.
3632 The trick used to optimize the above equation is based on a technique of emulating floating point data types with fixed precision integers. Fixed
3633 point arithmetic would become very popular as it greatly optimize the ``3d-shooter'' genre of games in the mid 1990s when floating point units were
3640 to fixed point first by multiplying by $2^q$. Let $a = 9(2^q)$ represent the fixed point representation of $9$ and $b = 5(2^q)$ represent the
3641 fixed point representation of $5$. The product $ab$ is equal to $45(2^{2q})$ which when normalized by dividing by $2^q$ produces $45(2^q)$.
3644 of two fixed point numbers. Using fixed point arithmetic, division can be easily approximated by multiplying by the reciprocal. If $2^q$ is
3645 equivalent to one than $2^q/b$ is equivalent to the fixed point approximation of $1/b$ using real arithmetic. Using this fact dividing an integer
3652 The precision of the division is proportional to the value of $q$. If the divisor $b$ is used frequently as is the case with
3657 leads to a product of $19$ which when divided by $2^q$ produces $2$. However, with $q = 4$ the reciprocal is $\lfloor 2^q/5 \rfloor = 3$ and
3658 the result of the emulated division is $\lfloor 3 \cdot 19 / 2^q \rfloor = 3$ which is correct. The value of $2^q$ must be close to or ideally
3660 to work correctly. Plugging this form of divison into the original equation the following modular residue equation arises.
3666 Using the notation from \cite{BARRETT} the value of $\lfloor 2^q / b \rfloor$ will be represented by the $\mu$ symbol. Using the $\mu$
3673 Provided that $2^q \ge a$ this algorithm will produce a quotient that is either exactly correct or off by a value of one. In the context of Barrett
3674 reduction the value of $a$ is bound by $0 \le a \le (b - 1)^2$ meaning that $2^q \ge b^2$ is sufficient to ensure the reciprocal will have enough
3677 Let $n$ represent the number of digits in $b$. This algorithm requires approximately $2n^2$ single precision multiplications to produce the quotient and
3687 that could be achieved a full division\footnote{A division requires approximately $O(2cn^2)$ single precision multiplications for a small value of $c$.
3688 See~\ref{sec:division} for further details.} might as well be used in its place. The key to optimizing the reduction is to reduce the precision of
3691 Let $a$ represent the number of which the residue is sought. Let $b$ represent the modulus used to find the residue. Let $m$ represent
3692 the number of digits in $b$. For the purposes of this discussion we will assume that the number of digits in $a$ is $2m$, which is generally true if
3694 $m - 1$'th digit of $a$ will contribute at most a value of $1$ to the quotient because $\beta^k < b$ for any $0 \le k \le m - 1$. Another way to
3699 Since the digits of $a'$ do not contribute much to the quotient the observation is that they might as well be zero. However, if the digits
3707 Note that the original divisor $2^q$ has been replaced with $\beta^{m+1}$ where in this case $q$ is a multiple of $lg(\beta)$. Also note that the
3712 can be off by an additional value of one for a total of at most two. This implies that
3720 For example, let $\beta = 10$ represent the radix of the digits. Let $b = 9999$ represent the modulus which implies $m = 4$. Let $a = 99929878$
3721 represent the value of which the residue is desired. In this case $q = 8$ since $10^7 < 9999^2$ meaning that $\mu = \lfloor \beta^{q}/b \rfloor = 10001$.
3732 half of the product. It would be nice to be able to remove those digits from the product to effectively cut down the number of single precision
3733 multiplications. If the number of digits in the modulus $m$ is far less than $\beta$ a full product is not required for the algorithm to work properly.
3734 In fact the lower $m - 2$ digits will not affect the upper half of the product at all and do not need to be computed.
3736 The value of $\mu$ is a $m$-digit number and $q_0$ is a $m + 1$ digit number. Using a full multiplier $(m + 1)(m) = m^2 + m$ single precision
3738 of single precision multiplications to ${m^2 + m} \over 2$ single precision multiplications.
3742 multiple of the modulus, that is $0 \le a - b \cdot \lfloor (q_0 \cdot \mu) / \beta^{m+1} \rfloor < 3b$. If $b$ is $m$ digits than the
3743 result of reduction equation is a value of at most $m + 1$ digits (\textit{provided $3 < \beta$}) implying that the upper $m - 1$ digits are
3746 The next optimization arises from this very fact. Instead of computing $b \cdot \lfloor (q_0 \cdot \mu) / \beta^{m+1} \rfloor$ using a full
3747 $O(m^2)$ multiplication algorithm only the lower $m+1$ digits of the product have to be computed. Similarly the value of $a$ can
3748 be reduced modulo $\beta^{m+1}$ before the multiple of $b$ is subtracted which simplifes the subtraction as well. A multiplication that produces
3763 Let $m$ represent the number of digits in $b$. \\
3764 1. Make a copy of $a$ and store it in $q$. (\textit{mp\_init\_copy}) \\
3771 Subtract the multiple of modulus from the input. \\
3795 This algorithm will reduce the input $a$ modulo $b$ in place using the Barrett algorithm. It is loosely based on algorithm 14.42 of HAC
3800 a multiple of it would either accomplish nothing or actually enlarge the input. The input $a$ must be in the range $0 \le a < b^2$ in order
3801 for the quotient to have enough precision. If $a$ is the product of two numbers that were already reduced modulo $b$, this will not be a problem.
3802 Technically the algorithm will still work if $a \ge b^2$ but it will take much longer to finish. The value of $\mu$ is passed as an argument to this
3807 instead of stopping at a given level of precision it starts at a given level of precision. This optimal algorithm can only be used if the number
3808 of digits in $b$ is very much smaller than $\beta$.
3812 ``borrow'' from the higher digits might leave a negative result. After the multiple of the modulus has been subtracted from $a$ the residue must be
3826 the number of single precision multiplications required. However, the optimization is only safe if $\beta$ is much larger than the number of digits
3831 In order to use algorithm mp\_reduce the value of $\mu$ must be calculated in advance. Ideally this value should be computed once and stored for
3854 is equivalent and much faster. The final value is computed by taking the integer quotient of $\lfloor \mu / b \rfloor$.
3863 This simple routine calculates the reciprocal $\mu$ required by Barrett reduction. Note the extended usage of algorithm mp\_div where the variable
3868 Montgomery reduction\footnote{Thanks to Niels Ferguson for his insightful explanation of the algorithm.} \cite{MONT} is by far the most interesting
3869 form of reduction in common use. It computes a modular residue which is not actually equal to the residue of the input yet instead equal to a
3872 Throughout this entire section the variable $n$ will represent the modulus used to form the residue. As will be discussed shortly the value of
3873 $n$ must be odd. The variable $x$ will represent the quantity of which the residue is sought. Similar to the Barrett algorithm the input
3877 to explain this is that $n$ is (\textit{or multiples of $n$ are}) congruent to zero modulo $n$. Adding zero will not change the value of the residue.
3880 this is an application of the fact that if $x$ is evenly divisible by any $k \in \Z$ then division in $\Z$ will be congruent to
3907 $x$ is assumed to be initially much larger than $n$ the addition of $n$ will contribute an insignificant magnitude to $x$. Let $r$ represent the
3908 final result of the Montgomery algorithm. If $k > lg(n)$ and $0 \le x < n^2$ then the final result is limited to
3929 \caption{Example of Montgomery Reduction (I)}
3933 Consider the example in figure~\ref{fig:MONT1} which reduces $x = 5555$ modulo $n = 257$ when $k = 9$ (note $\beta^k = 512$ which is larger than $n$). The result of
3934 the algorithm $r = 178$ is congruent to the value of $2^{-9} \cdot 5555 \mbox{ (mod }257\mbox{)}$. When $r$ is multiplied by $2^9$ modulo $257$ the correct residue
3937 Let $k = \lfloor lg(n) \rfloor + 1$ represent the number of bits in $n$. The current algorithm requires $2k^2$ single precision shifts
3939 Fortunately there exists an alternative representation of the algorithm.
3950 \hspace{3mm}1.1 If the $t$'th bit of $x$ is one then \\
3960 This algorithm is equivalent since $2^tn$ is a multiple of $n$ and the lower $k$ bits of $x$ are zero by step 2. The number of single
3983 \caption{Example of Montgomery Reduction (II)}
3988 With this algorithm a single shift right at the end is the only right shift required to reduce the input instead of $k$ right shifts inside the
3989 loop. Note that for the iterations $t = 2, 5, 6$ and $8$ where the result $x$ is not changed. In those iterations the $t$'th bit of $x$ is
3990 zero and the appropriate multiple of $n$ does not need to be added to force the $t$'th bit of the result to zero.
3993 Instead of computing the reduction on a bit-by-bit basis it is actually much faster to compute it on digit-by-digit basis. Consider the
4014 The value $\mu n \beta^t$ is a multiple of the modulus $n$ meaning that it will not change the residue. If the first digit of
4015 the value $\mu n \beta^t$ equals the negative (modulo $\beta$) of the $t$'th digit of $x$ then the addition will result in a zero digit. This
4026 In each iteration of the loop on step 1 a new value of $\mu$ must be calculated. The value of $-1/n_0 \mbox{ (mod }\beta\mbox{)}$ is used
4027 extensively in this algorithm and should be precomputed. Let $\rho$ represent the negative of the modular inverse of $n_0$ modulo $\beta$.
4035 \hline \textbf{Step ($t$)} & \textbf{Value of $x$} & \textbf{Value of $\mu$} \\
4042 \caption{Example of Montgomery Reduction}
4046 which implies the result is not the modular residue of $x$ modulo $n$. However, recall that the residue is actually multiplied by $\beta^{-k}$ in
4099 on algorithm 14.32 of \cite[pp.601]{HAC} except it merges the multiplication of $\mu n \beta^t$ with the addition in the inner loop. The
4102 advance of this algorithm. Finally the variable $k$ is fixed and a pseudonym for $n.used$.
4105 the size of the input. This algorithm is discussed in sub-section 6.3.3.
4107 Step 5 is the main reduction loop of the algorithm. The value of $\mu$ is calculated once per iteration in the outer loop. The inner loop
4122 This is the baseline implementation of the Montgomery reduction algorithm. Lines 31 to 36 determine if the Comba based
4123 routine can be used instead. Line 47 computes the value of $\mu$ for that particular iteration of the outer loop.
4125 The multiplication $\mu n \beta^{ix}$ is performed in one step in the inner loop. The alias $tmpx$ refers to the $ix$'th digit of $x$ and
4131 nature of the inner loop. The Barrett reduction algorithm requires two slightly modified multipliers which can be implemented with the Comba
4135 The biggest obstacle is that at the $ix$'th iteration of the outer loop the value of $x_{ix}$ is required to calculate $\mu$. This means the
4140 the speed of the algorithm.
4151 Place an array of \textbf{MP\_WARRAY} mp\_word variables called $\hat W$ on the stack. \\
4153 Copy the digits of $x$ into the array $\hat W$ \\
4175 9. Clamp excessive digits of $x$. \\
4187 This algorithm will compute the Montgomery reduction of $x$ modulo $n$ using the Comba technique. It is on most computer platforms significantly
4189 on the input as the baseline reduction algorithm. An additional two restrictions are imposed on this algorithm. The number of digits $k$ in the
4191 a modulus of at most $3,556$ bits in length.
4193 As in the other Comba reduction algorithms there is a $\hat W$ array which stores the columns of the product. It is initially filled with the
4194 contents of $x$ with the excess digits zeroed. The reduction loop is very similar the to the baseline loop at heart. The multiplication on step
4196 as those on the ARM processors take a variable length time to complete depending on the number of bytes of result it must produce. By performing
4197 a single precision multiplication instead half the amount of time is spent.
4200 4.3 will do. In effect over the $n.used$ iterations of the outer loop the $n.used$'th lower columns all have the their carries propagated forwards. Note
4201 how the upper bits of those same words are not reduced modulo $\beta$. This is because those values will be discarded shortly and there is no
4204 Step 5 will propagate the remainder of the carries upwards. On step 6 the columns are reduced modulo $\beta$ and shifted simultaneously as they are
4214 The $\hat W$ array is first filled with digits of $x$ on line 48 then the rest of the digits are zeroed on line 55. Both loops share
4217 The value of $\mu$ is calculated in an interesting fashion. First the value $\hat W_{ix}$ is reduced modulo $\beta$ and cast to a mp\_digit. This
4218 forces the compiler to use a single precision multiplication and prevents any concerns about loss of precision. Line 110 fixes the carry
4219 for the next iteration of the loop by propagating the carry from $\hat W_{ix}$ to $\hat W_{ix+1}$.
4221 The for loop on line 109 propagates the rest of the carries upwards through the columns. The for loop on line 126 reduces the columns
4251 This algorithm will calculate the value of $\rho$ required within the Montgomery reduction algorithms. It uses a very interesting trick
4252 to calculate $1/n_0$ when $\beta$ is a power of two.
4261 This source code computes the value of $\rho$ required to perform Montgomery reduction. It has been modified to avoid performing excess
4265 The Diminished Radix method of modular reduction \cite{DRMET} is a fairly clever technique which can be more efficient than either the Barrett
4266 or Montgomery methods for certain forms of moduli. The technique is based on the following simple congruence.
4274 of the above equation is very simple. First write $x$ in the product form.
4314 once or twice and occasionally three times. For simplicity sake the value of $x$ is bounded by the following simple polynomial.
4320 The true bound is $0 \le x < (n - k - 1)^2$ but this has quite a few more terms. The value of $q$ after step 1 is bounded by the following.
4326 Since $k^2$ is going to be considerably smaller than $n$ that term will always be zero. The value of $x$ after step 3 is bounded trivially as
4334 sum in step 4 will exceed $n - k$. In practice fewer than three passes of the algorithm are required to reduce virtually every input in the
4368 Figure~\ref{fig:EXDR} demonstrates the reduction of $x = 123456789$ modulo $n - k = 253$ when $n = 256$ and $k = 3$. Note that even while $x$
4373 \subsection{Choice of Moduli}
4374 On the surface this algorithm looks like a very expensive algorithm. It requires a couple of subtractions followed by multiplication and other
4375 modular reductions. The usefulness of this algorithm becomes exceedingly clear when an appropriate modulus is chosen.
4377 Division in general is a very expensive operation to perform. The one exception is when the division is by a power of the radix of representation used.
4379 by two (\textit{or powers of two}) is very simple for binary computers to perform. It would therefore seem logical to choose $n$ of the form $2^p$
4380 which would imply that $\lfloor x / n \rfloor$ is a simple shift of $x$ right $p$ bits.
4382 However, there is one operation related to division of power of twos that is even faster than this. If $n = \beta^p$ then the division may be
4384 Also with the choice of $n = \beta^p$ reducing $x$ modulo $n$ merely requires zeroing the digits above the $p-1$'th digit of $x$.
4386 Throughout the next section the term ``restricted modulus'' will refer to a modulus of the form $\beta^p - k$ whereas the term ``unrestricted
4387 modulus'' will refer to a modulus of the form $2^p - k$. The word ``restricted'' in this case refers to the fact that it is based on the
4388 $2^p$ logic except $p$ must be a multiple of $lg(\beta)$.
4390 \subsection{Choice of $k$}
4391 Now that division and reduction (\textit{step 1 and 3 of figure~\ref{fig:DR}}) have been optimized to simple digit operations the multiplication by $k$
4392 in step 2 is the most expensive operation. Fortunately the choice of $k$ is not terribly limited. For all intents and purposes it might
4393 as well be a single digit. The smaller the value of $k$ is the faster the algorithm will be.
4396 The restricted Diminished Radix algorithm can quickly reduce an input modulo a modulus of the form $n = \beta^p - k$. This algorithm can reduce
4397 an input $x$ within the range $0 \le x < n^2$ using only a couple passes of the algorithm demonstrated in figure~\ref{fig:DR}. The implementation
4398 of this algorithm has been optimized to avoid additional overhead associated with a division by $\beta^p$, the multiplication by $k$ or the addition
4399 of $x$ and $q$. The resulting algorithm is very efficient and can lead to substantial improvements over Barrett and Montgomery reduction when modular
4421 7. Clamp excess digits of $x$. \\
4434 This algorithm will perform the Dimished Radix reduction of $x$ modulo $n$. It has similar restrictions to that of the Barrett reduction
4435 with the addition that $n$ must be of the form $n = \beta^m - k$ where $0 < k <\beta$.
4438 and addition of $x \mbox{ mod }\beta^m$ are all performed simultaneously inside the loop on step 4. The division by $\beta^m$ is emulated by accessing
4441 $x$ before the addition of the multiple of the upper half.
4443 At step 8 if $x$ is still larger than $n$ another pass of the algorithm is required. First $n$ is subtracted from $x$ and then the algorithm resumes
4454 the algorithm will resume if further reduction passes are required. In theory it could be placed at the top of the function however, the size of
4455 the modulus and question of whether $x$ is large enough are invariant after the first pass meaning that it would be a waste of time.
4457 The aliases $tmpx1$ and $tmpx2$ refer to the digits of $x$ where the latter is offset by $m$ digits. By reading digits from $x$ offset by $m$ digits
4458 a division by $\beta^m$ can be simulated virtually for free. The loop on line 64 performs the bulk of the work (\textit{corresponds to step 4 of algorithm 7.11})
4461 By line 67 the pointer $tmpx1$ points to the $m$'th digit of $x$ which is where the final carry will be placed. Similarly by line 74 the
4465 With the same logic at line 81 the value of $x$ is known to be greater than or equal to $n$ meaning that an unsigned subtraction can be used
4466 as well. Since the destination of the subtraction is the larger of the inputs the call to algorithm s\_mp\_sub cannot fail and the return code
4498 of restricted Diminished Radix form if all of the digits are equal to $\beta - 1$ except the trailing digit which may be any value.
4522 step 3 then $n$ must be of Diminished Radix form.
4532 The unrestricted Diminished Radix algorithm allows modular reductions to be performed when the modulus is of the form $2^p - k$. This algorithm
4533 is a straightforward adaptation of algorithm~\ref{fig:DR}.
4536 algorithm is much faster than either Montgomery or Barrett reduction when the moduli are of the appropriate form.
4544 \hspace{11.5mm}($a \ge 0$, $n > 1$, $0 < k < \beta$, $n + k$ is a power of two) \\
4574 The algorithm mp\_count\_bits calculates the number of bits in an mp\_int which is used to find the initial value of $p$. The call to mp\_div\_2d
4579 The unsigned s\_mp\_add, mp\_cmp\_mag and s\_mp\_sub are used in place of their full sign counterparts since the inputs are only valid if they are
4583 To setup this reduction algorithm the value of $k = 2^p - n$ is required.
4606 This algorithm computes the value of $k$ required for the algorithm mp\_reduce\_2k. By making a temporary variable $x$ equal to $2^p$ a subtraction
4607 is sufficient to solve for $k$. Alternatively if $n$ has more than one digit the value of $k$ is simply $\beta - n_0$.
4617 An integer $n$ is a valid unrestricted Diminished Radix modulus if either of the following are true.
4624 If either condition is true than there is a power of two $2^p$ such that $0 < 2^p - n < \beta$. If the input is only
4625 one digit than it will always be of the correct form. Otherwise all of the bits above the first digit must be one. This arises from the fact
4626 that there will be value of $k$ that when added to the modulus causes a carry in the first digit which propagates all the way to the most
4627 significant bit. The resulting sum will be a power of two.
4635 \textbf{Output}. $1$ if of proper form, $0$ otherwise \\
4641 \hspace{3mm}4.1 If the ($x \mbox{ mod }lg(\beta)$)'th bit of the $\lfloor x / lg(\beta) \rfloor$ of $n$ is zero then return($0$). \\
4651 This algorithm quickly determines if a modulus is of the form required for algorithm mp\_reduce\_2k to function properly.
4663 So far three very different algorithms for modular reduction have been discussed. Each of the algorithms have their own strengths and weaknesses
4664 that makes having such a selection very useful. The following table sumarizes the three algorithms along with comparisons of work factors. Since
4679 In theory Montgomery and Barrett reductions would require roughly the same amount of time to complete. However, in practice since Montgomery
4680 reduction can be written as a single function with the Comba technique it is much faster. Barrett reduction suffers from the overhead of
4683 For almost every cryptographic algorithm Montgomery reduction is the algorithm of choice. The one set of algorithms where Diminished Radix reduction truly
4685 primes of the form $\beta^m - k$ can be found and shared amongst users. These primes will allow the Diminished Radix algorithm to be used in
4693 & calculates the correct value of $\rho$. \\
4705 Exponentiation is the operation of raising one variable to the power of another, for example, $a^b$. A variant of exponentiation, computed
4706 in a finite field or ring, is called modular exponentiation. This latter style of operation is typically used in public key
4707 cryptosystems such as RSA and Diffie-Hellman. The ability to quickly compute modular exponentiations is of great benefit to any
4712 the number of multiplications becomes prohibitive. Imagine what would happen if $b$ $\approx$ $2^{1024}$ as is the case when computing an RSA signature
4715 Fortunately there is a very simple algorithm based on the laws of exponents. Recall that $lg_a(a^b) = b$ and that $lg_a(a^ba^c) = b + c$ which
4716 are two trivial relationships between the base and the exponent. Let $b_i$ represent the $i$'th bit of $b$ starting from the least
4723 By taking the base $a$ logarithm of both sides of the equation the following equation is the result.
4730 $a^{2^{i+1}}$. This observation forms the basis of essentially all fast exponentiation algorithms. It requires $k$ squarings and on average
4731 $k \over 2$ multiplications to compute the result. This is indeed quite an improvement over simply multiplying by $a$ a total of $b-1$ times.
4757 This algorithm starts from the most significant bit and works towards the least significant bit. When the $i$'th bit of $b$ is set $a$ is
4758 multiplied against the current product. In each iteration the product is squared which doubles the exponent of the individual terms of the
4761 For example, let $b = 101100_2 \equiv 44_{10}$. The following chart demonstrates the actions of the algorithm.
4766 \hline \textbf{Value of $i$} & \textbf{Value of $c$} \\
4777 \caption{Example of Left to Right Exponentiation}
4781 called ``Left to Right'' because it reads the exponent in that order. All of the exponentiation algorithms that will be presented are of this nature.
4784 The first algorithm in the series of exponentiation algorithms will be an unbounded algorithm where the exponent is a single digit. It is intended
4785 to be used when a small power of an input is required (\textit{e.g. $a^5$}). It is faster than simply multiplying $b - 1$ times for all values of
4813 This algorithm computes the value of $a$ raised to the power of a single digit $b$. It uses the left to right exponentiation algorithm to
4814 quickly compute the exponentiation. It is loosely based on algorithm 14.79 of HAC \cite[pp. 615]{HAC} with the difference that the
4817 A copy of $a$ is made first to allow destination variable $c$ be the same as the source variable $a$. The result is set to the initial value of
4821 on step 3.1. In the following step if the most significant bit of $b$ is one the copy of $a$ is multiplied against $c$. The value
4822 of $b$ is shifted left one bit to make the next bit down from the most signficant bit the new most significant bit. In effect each
4823 iteration of the loop moves the bits of the exponent $b$ upwards to the most significant location.
4832 Line 29 sets the initial value of the result to $1$. Next the loop on line 31 steps through each bit of the exponent starting from
4834 the squaring the result $c$ is multiplied by the base $g$ if and only if the most significant bit of the exponent is set. The shift on line
4835 47 moves all of the bits of the exponent upwards towards the most significant location.
4839 slower than squaring. Recall from the previous algorithm that $b_{i}$ refers to the $i$'th bit of the exponent $b$. Suppose instead it referred to
4840 the $i$'th $k$-bit digit of the exponent of $b$. For $k = 1$ the definitions are synonymous and for $k > 1$ algorithm~\ref{fig:KARY}
4841 computes the same exponentiation. A group of $k$ bits from the exponent is called a \textit{window}. That is it is a small window on only a
4842 portion of the entire exponent. Consider the following modification to the basic left to right exponentiation algorithm.
4866 The squaring on step 2.1 can be calculated by squaring the value $c$ successively $k$ times. If the values of $a^g$ for $0 < g < 2^k$ have been
4868 $2^{k - 1} + 1$ multiplications. This algorithm assumes that the number of bits in the exponent is evenly divisible by $k$.
4872 original algorithm would on average have required $200$ multiplications and $400$ squrings to compute the same value. The total number of squarings
4873 has increased slightly but the number of multiplications has nearly halved.
4875 \subsection{Optimal Values of $k$}
4876 An optimal value of $k$ will minimize $2^{k} + \lceil n / k \rceil + n - 1$ for a fixed number of bits in the exponent $n$. The simplest
4877 approach is to brute force search amongst the values $k = 2, 3, \ldots, 8$ for the lowest result. Table~\ref{fig:OPTK} lists optimal values of $k$
4878 for various exponent sizes and compares the number of multiplication and squarings required against algorithm~\ref{fig:LTOR}.
4898 \caption{Optimal Values of $k$ for $k$-ary Exponentiation}
4903 A simple modification to the previous algorithm is only generate the upper half of the table in the range $2^{k-1} \le g < 2^k$. Essentially
4904 this is a table for all values of $g$ where the most significant bit of $g$ is a one. However, in order for this to be allowed in the
4905 algorithm values of $g$ in the range $0 \le g < 2^{k-1}$ must be avoided.
4907 Table~\ref{fig:OPTK2} lists optimal values of $k$ for various exponent sizes and compares the work required against algorithm~\ref{fig:KARY}.
4927 \caption{Optimal Values of $k$ for Sliding Window Exponentiation}
4941 \hspace{3mm}2.1 If the $i$'th bit of $b$ is a zero then \\
4957 algorithm requires the same number of squarings it can potentially have fewer multiplications. The pre-computed table $a^g$ is also half
4963 a single squaring took place instead of a squaring and multiplication. In total the first method requires $10$ multiplications and $18$
4970 Modular exponentiation is essentially computing the power of a base within a finite field or ring. For example, computing
4971 $d \equiv a^b \mbox{ (mod }c\mbox{)}$ is a modular exponentiation. Instead of first computing $a^b$ and then reducing it
4975 one of the algorithms presented in chapter six.
4979 value of $(1/a) \mbox{ mod }c$ is computed using the modular inverse (\textit{see \ref{sec;modinv}}). If no inverse exists the algorithm
5020 negative the algorithm tries to perform a modular exponentiation with the modular inverse of the base $G$. The temporary variable $tmpG$ is assigned
5021 the modular inverse of $G$ and $tmpX$ is assigned the absolute value of $X$. The algorithm will recuse with these new values with a positive
5024 If the exponent is positive the algorithm resumes the exponentiation. Line 77 determines if the modulus is of the restricted Diminished Radix
5025 form. If it is not line 70 attempts to determine if it is of a unrestricted Diminished Radix form. The integer $dr$ will take on one
5026 of three values.
5029 \item $dr = 0$ means that the modulus is not of either restricted or unrestricted Diminished Radix form.
5030 \item $dr = 1$ means that the modulus is of restricted Diminished Radix form.
5031 \item $dr = 2$ means that the modulus is of unrestricted Diminished Radix form.
5061 Setup the table of small powers of $g$. First find $g^{2^{winsize}}$ and then all multiples of it. \\
5117 No more windows left. Check for residual bits of exponent. \\
5137 This algorithm computes the $x$'th power of $g$ modulo $p$ and stores the result in $y$. It takes advantage of the Barrett reduction
5140 The first two steps determine the optimal window size based on the number of bits in the exponent. The larger the exponent the
5141 larger the window size becomes. After a window size $winsize$ has been chosen an array of $2^{winsize}$ mp\_int variables is allocated. This
5142 table will hold the values of $g^x \mbox{ (mod }p\mbox{)}$ for $2^{winsize - 1} \le x < 2^{winsize}$.
5144 After the table is allocated the first power of $g$ is found. Since $g \ge p$ is allowed it must be first reduced modulo $p$ to make
5145 the rest of the algorithm more efficient. The first element of the table at $2^{winsize - 1}$ is found by squaring $M_1$ successively $winsize - 2$
5146 times. The rest of the table elements are found by multiplying the previous element by $M_1$ modulo $p$.
5148 Now that the table is available the sliding window may begin. The following list describes the functions of all the variables in the window.
5150 \item The variable $mode$ dictates how the bits of the exponent are interpreted.
5152 \item When $mode = 0$ the bits are ignored since no non-zero bit of the exponent has been seen yet. For example, if the exponent were simply
5156 \item When $mode = 2$ the algorithm is in the middle of forming a window and new bits are appended to the window from the most significant bit
5159 \item The variable $bitcnt$ indicates how many bits are left in the current digit of the exponent left to be read. When it reaches zero a new digit
5161 \item The variable $buf$ holds the currently read digit of the exponent.
5165 \item The variable $bitbuf$ holds the current bits of the window being formed.
5168 All of step 12 is the window processing loop. It will iterate while there are digits available form the exponent to read. The first step
5172 After a digit is made available step 12.3 will extract the most significant bit of the current digit and move all other bits in the digit
5178 the two cases of $mode = 1$ and $mode = 2$ respectively.
5198 Lines 32 through 46 determine the optimal window size based on the length of the exponent in bits. The window divisions are sorted
5200 on line 38 the value of $x$ is already known to be greater than $140$.
5202 The conditional piece of code beginning on line 48 allows the window size to be restricted to five bits. This logic is used to ensure
5203 the table of precomputed powers of $G$ remains relatively small.
5210 \section{Quick Power of Two}
5211 Calculating $b = 2^a$ can be performed much quicker than with any of the previous algorithms. Recall that a logical shift left $m << k$ is
5212 equivalent to $m \cdot 2^k$. By this logic when $m = 1$ a quick power of two can be achieved.
5246 routines are less performance oriented than the algorithms of chapters five, six and seven but are no less important.
5248 The first section describes a method of integer division with remainder that is universally well known. It provides the signed division logic
5249 for the package. The subsequent section discusses a set of algorithms which allow a single digit to be the 2nd operand for a variety of operations.
5251 various representations of integers. For example, converting from an mp\_int to a string of character.
5257 the basis of this algorithm is the long-hand division algorithm taught to school children. Throughout this discussion several common variables
5285 As children we are taught this very simple algorithm for the case of $\beta = 10$. Almost instinctively several optimizations are taught for which
5286 their reason of existing are never explained. For this example let $y = 5471$ represent the dividend and $x = 23$ represent the divisor.
5288 To find the first digit of the quotient the value of $k$ must be maximized such that $kx\beta^t$ is less than or equal to $y$ and
5289 simultaneously $(k + 1)x\beta^t$ is greater than $y$. Implicitly $k$ is the maximum value the $t$'th digit of the quotient may have. The habitual method
5293 As a result $k\beta^2$ is added to the quotient which now equals $q = 200$ and $4600$ is subtracted from $y$ to give a remainder of $y = 841$.
5296 $y = 841 - 3x\beta = 181$. Finally the last iteration of the loop produces $k = 7$ which leads to the quotient $q = 230 + 7 = 237$ and the
5302 As alluded to earlier the quotient digit $k$ can be estimated from only the leading digits of both the divisor and dividend. When $p$ leading
5303 digits are used from both the divisor and dividend to form an estimation the accuracy of the estimation rises as $p$ grows. Technically
5304 speaking the estimation is based on assuming the lower $\vert \vert y \vert \vert - p$ and $\vert \vert x \vert \vert - p$ lower digits of the
5307 The value of the estimation may off by a few values in either direction and in general is fairly correct. A simplification \cite[pp. 271]{TAOCPV2}
5308 of the estimation technique is to use $t + 1$ digits of the dividend and $t$ digits of the divisor, in particularly when $t = 1$. The estimate
5310 represent the most significant digits of the dividend and divisor respectively.
5315 cases $\hat k = \lfloor (y_t\beta + y_{t-1}) / x_s \rfloor$ and $\hat k x_s \ge y_t\beta + y_{t-1} - x_s + 1$. The latter portion of the inequalility
5316 $-x_s + 1$ arises from the fact that a truncated integer division will give the same quotient for at most $x_s - 1$ values. Next a series of
5345 For the purposes of division a normalized input is when the divisors leading digit $x_n$ is greater than or equal to $\beta / 2$. By multiplying both
5347 remainder. The purpose of normalization is to ensure the leading digit of the divisor is sufficiently large such that the estimated quotient will
5348 lie in the domain of a single digit. Consider the maximum dividend $(\beta - 1) \cdot \beta + (\beta - 1)$ and the minimum divisor $\beta / 2$.
5380 Normalize the inputs such that the leading digit of $y$ is greater than or equal to $\beta / 2$. \\
5384 Find the leading digit of the quotient. \\
5410 \hspace{3mm}13.1 If $i > x.used$ then jump to the next iteration of this loop. \\
5437 14. Clamp excess digits of $q$ \\
5455 After the first two trivial cases of inputs are handled the variable $q$ is setup to receive the digits of the quotient. Two unsigned copies of the
5456 divisor $y$ and dividend $x$ are made as well. The core of the division algorithm is an unsigned division and will only work if the values are
5457 positive. Now the two values $x$ and $y$ must be normalized such that the leading digit of $y$ is greater than or equal to $\beta / 2$.
5460 At this point the division algorithm can begin producing digits of the quotient. Recall that maximum value of the estimation used is
5461 $2\beta - {2 \over \beta}$ which means that a digit of the quotient must be first produced by another means. In this case $y$ is shifted
5462 to the left (\textit{step ten}) so that it has the same number of digits as $x$. The loop on step eleven will subtract multiples of the
5463 shifted copy of $y$ until $x$ is smaller. Since the leading digit of $y$ is greater than or equal to $\beta/2$ this loop will iterate at most two
5464 times to produce the desired leading digit of the quotient.
5466 Now the remainder of the digits can be produced. The equation $\hat q = \lfloor {{x_i \beta + x_{i-1}}\over y_t} \rfloor$ is used to fairly
5470 Recall from section~\ref{sec:divest} that the estimation is never too low but may be too high. The next step of the estimation process is
5474 After both phases of estimation the quotient digit may still be off by a value of one\footnote{This is similar to the error introduced
5475 by optimizing Barrett reduction.}. Steps 13.6 and 13.7 subtract the multiple of the divisor from the dividend (\textit{Similar to step 3.3 of
5476 algorithm~\ref{fig:raddiv}} and then subsequently add a multiple of the divisor if the quotient was too large.
5478 Now that the quotient has been determine finializing the result is a matter of clamping the quotient, fixing the sizes and de-normalizing the
5479 remainder. An important aspect of this algorithm seemingly overlooked in other descriptions such as that of Algorithm 14.20 HAC \cite[pp. 598]{HAC}
5491 The implementation of this algorithm differs slightly from the pseudo code presented previously. In this algorithm either of the quotient $c$ or
5499 Lines 109 and 113 handle the two trivial cases of inputs which are division by zero and dividend smaller than the divisor
5500 respectively. After the two trivial cases all of the temporary variables are initialized. Line 148 determines the sign of
5503 The number of bits in the leading digit is calculated on line 151. Implictly an mp\_int with $r$ digits will require $lg(\beta)(r-1) + k$ bits
5504 of precision which when reduced modulo $lg(\beta)$ produces the value of $k$. In this case $k$ is the number of bits in the leading digit which is
5508 Throughout the variables $n$ and $t$ will represent the highest digit of $x$ and $y$ respectively. These are first used to produce the
5509 leading digit of the quotient. The loop beginning on line 184 will produce the remainder of the quotient digits.
5511 The conditional ``continue'' on line 187 is used to prevent the algorithm from reading past the leading edge of $x$ which can occur when the
5515 Lines 214, 216 and 223 through 225 manually construct the high accuracy estimations by setting the digits of the two mp\_int
5520 This section briefly describes a series of single digit helper algorithms which come in handy when working with small constants. All of
5547 This algorithm initiates a temporary mp\_int with the value of the single digit and uses algorithm mp\_add to add the two values together.
5556 Clever use of the letter 't'.
5562 Single digit multiplication arises enough in division and radix conversion that it ought to be implement as a special case of the baseline
5563 multiplication algorithm. Essentially this algorithm is a modified version of algorithm s\_mp\_mul\_digs where one of the multiplicands
5587 10. Clamp excess digits of $c$. \\
5596 This algorithm quickly multiplies an mp\_int by a small single digit value. It is specially tailored to the job and has a minimal of overhead.
5607 read from the source. This function uses pointer aliases $tmpa$ and $tmpc$ for the digits of $a$ and $c$ respectively.
5611 divisor is only a single digit a specialized variant of the division algorithm can be used to compute the quotient.
5636 9. Clamp excess digits of $q$. \\
5646 This algorithm divides the mp\_int $a$ by the single mp\_digit $b$ using an optimized approach. Essentially in every iteration of the
5647 algorithm another digit of the dividend is reduced and another digit of quotient produced. Provided $b < \beta$ the value of $\hat w$
5650 If the divisor $b$ is equal to three a variant of this algorithm is used which is called mp\_div\_3. It replaces the division by three with
5661 Like the implementation of algorithm mp\_div this algorithm allows either of the quotient or remainder to be passed as a \textbf{NULL} pointer to
5670 Finding the $n$'th root of an integer is fairly easy as far as numerical analysis is concerned. Algorithms such as the Newton-Raphson approximation
5678 In this case the $n$'th root is desired and $f(x) = x^n - a$ where $a$ is the integer of which the root is desired. The derivative of $f(x)$ is
5680 such as the real numbers. As a result the root found can be above the true root by few and must be manually adjusted. Ideally at the end of the
5681 algorithm the $n$'th root $b$ of an integer $a$ is desired such that $b^n \le a$.
5720 This algorithm finds the integer $n$'th root of an input using the Newton-Raphson approach. It is partially optimized based on the observation
5721 that the numerator of ${f(x) \over f'(x)}$ can be derived from a partial denominator. That is at first the denominator is calculated by finding
5722 $x^{b - 1}$. This value can then be multiplied by $x$ and have $a$ subtracted from it to find the numerator. This saves a total of $b - 1$
5725 The initial value of the approximation is t$2 = 2$ which allows the algorithm to start with very small values and quickly converge on the
5726 root. Ideally this algorithm is meant to find the $n$'th root of an input where $n$ is bounded by $2 \le n \le 5$.
5737 Random numbers come up in a variety of activities from public key cryptography to simple simulations and various randomized algorithms. Pollard-Rho
5738 factoring for example, can make use of random values as starting points to find factors of a composite integer. In this case the algorithm presented
5747 \textbf{Output}. A pseudo-random number of $b$ digits \\
5765 This algorithm produces a pseudo-random integer of $b$ digits. By ensuring that the first digit is non-zero the algorithm also guarantees that the
5766 final result has at least $b$ digits. It relies heavily on a third-part random number generator which should ideally generate uniformly all of
5777 The ability to emit a radix-$n$ textual representation of an integer is useful for interacting with human parties. For example, the ability to
5778 be given a string of characters such as ``114585'' and turn it into the radix-$\beta$ equivalent would make it easier to enter numbers
5782 For the purposes of this text we will assume that a simple lower ASCII map (\ref{fig:ASC}) is used for the values of from $0$ to $63$ to
5783 printable characters. For example, when the character ``N'' is read it represents the integer $23$. The first $16$ characters of the
5821 \textbf{Input}. A string $str$ of length $sn$ and radix $r$. \\
5833 \hspace{3mm}6.1 Let $y$ denote the position in the map of $str_{iy}$. \\
5846 This algorithm will read an ASCII string and produce the radix-$\beta$ mp\_int representation of the same integer. A minus symbol ``-'' may precede the
5849 as part of larger input without any significant problem.
5867 \textbf{Output}. The radix-$r$ representation of $a$ \\
5893 This algorithm computes the radix-$r$ representation of an mp\_int $a$. The ``digits'' of the representation are extracted by reducing
5894 successive powers of $\lfloor a / r^k \rfloor$ the input modulo $r$ until $r^k > a$. Note that instead of actually dividing by $r^k$ in
5895 each iteration the quotient $\lfloor a / r \rfloor$ is saved for the next iteration. As a result a series of trivial $n \times 1$ divisions
5896 are required instead of a series of $n \times k$ divisions. One design flaw of this approach is that the digits are produced in the reverse order
5902 \hline \textbf{Value of $a$} & \textbf{Value of $d$} & \textbf{Value of $str$} \\
5911 \caption{Example of Algorithm mp\_toradix.}
5928 The greatest common divisor of two integers $a$ and $b$, often denoted as $(a, b)$ is the largest integer $k$ that is a proper divisor of
5957 relatively expensive operations to perform and should ideally be avoided. There is another approach based on a similar relationship of
5970 \hspace{3mm}1.1 Swap $a$ and $b$ such that $a$ is the smallest of the two. \\
5981 \textbf{Proof} \textit{Algorithm~\ref{fig:gcd2} will return the greatest common divisor of $a$ and $b$.}
5984 divisible by the greatest common divisor (\textit{until the last iteration}) and in the last iteration of the algorithm $b = 0$, therefore, in the
5985 second to last iteration of the algorithm $b = a$ and clearly $(a, a) = a$ which concludes the proof. \textbf{QED}.
5987 As a matter of practicality algorithm \ref{fig:gcd1} decreases far too slowly to be useful. Specially if $b$ is much larger than $a$ such that
5988 $b - a$ is still very much larger than $a$. A simple addition to the algorithm is to divide $b - a$ by a power of some integer $p$ which does
5992 However, instead of factoring $b - a$ to find a suitable value of $p$ the powers of $p$ can be removed from $a$ and $b$ that are in common first.
5993 Then inside the loop whenever $b - a$ is divisible by some power of $p$ it can be safely removed.
6013 \hspace{3mm}5.1 Swap $a$ and $b$ such that $a$ is the smallest of the two. \\
6026 This algorithm is based on the first except it removes powers of $p$ first and inside the main loop to ensure the tuple $\left < a, b \right >$
6027 decreases more rapidly. The first loop on step two removes powers of $p$ that are in common. A count, $k$, is kept which will present a common
6028 divisor of $p^k$. After step two the remaining common divisor of $a$ and $b$ cannot be divisible by $p$. This means that $p$ can be safely
6029 divided out of the difference $b - a$ so long as the division leaves no remainder.
6031 In particular the value of $p$ should be chosen such that the division on step 5.3.1 occur often. It also helps that division by $p$ be easy
6032 to compute. The ideal choice of $p$ is two since division by two amounts to a right logical shift. Another important observation is that by
6034 largest of the pair.
6079 This algorithm will produce the greatest common divisor of two mp\_ints $a$ and $b$. The algorithm was originally based on Algorithm B of
6083 The first two steps handle the cases where either one of or both inputs are zero. If either input is zero the greatest common divisor is the
6084 largest input or zero if they are both zero. If the inputs are not trivial than $u$ and $v$ are assigned the absolute values of
6087 Step five will divide out any common factors of two and keep track of the count in the variable $k$. After this step, two is no longer a
6088 factor of the remaining greatest common divisor between $u$ and $v$ and can be safely evenly divided out of either whenever they are even. Step
6089 six and seven ensure that the $u$ and $v$ respectively have no more factors of two. At most only one of the while--loops will iterate since
6092 By step eight both of $u$ and $v$ are odd which is required for the inner logic. First the pair are swapped such that $v$ is equal to
6094 factors of two from the difference $u$ to ensure that in the next iteration of the loop both are once again odd.
6096 After $v = 0$ occurs the variable $u$ has the greatest common divisor of the pair $\left < u, v \right >$ just after step six. The result
6097 must be adjusted by multiplying by the common factors of two ($2^k$) removed earlier.
6106 This function makes use of the macros mp\_iszero and mp\_iseven. The former evaluates to $1$ if the input mp\_int is equivalent to the
6109 trivial cases of inputs are handled on lines 24 through 30. After those lines the inputs are assumed to be non-zero.
6111 Lines 32 and 37 make local copies $u$ and $v$ of the inputs $a$ and $b$ respectively. At this point the common factors of two
6112 must be divided out of the two inputs. The block starting at line 44 removes common factors of two by first counting the number of trailing
6113 zero bits in both. The local integer $k$ is used to keep track of how many factors of $2$ are pulled out of both values. It is assumed that
6114 the number of factors will not exceed the maximum value of a C ``int'' data type\footnote{Strictly speaking no array in C may have more than
6117 At this point there are no more common factors of two in the two values. The divisions by a power of two on lines 62 and 68 remove
6118 any independent factors of two such that both $u$ and $v$ are guaranteed to be an odd integer before hitting the main body of the algorithm. The while loop
6119 on line 73 performs the reduction of the pair until $v$ is equal to zero. The unsigned comparison and subtraction algorithms are used in
6120 place of the full signed routines since both values are guaranteed to be positive and the result of the subtraction is guaranteed to be non-negative.
6123 The least common multiple of a pair of integers is their product divided by their greatest common divisor. For two integers $a$ and $b$ the
6127 The least common multiple arises often in coding theory as well as number theory. If two functions have periods of $a$ and $b$ respectively they will
6130 Similarly in number theory if a composite $n$ has two prime factors $p$ and $q$ then maximal order of any unit of $\Z/n\Z$ will be $[ p - 1, q - 1] $.
6151 This algorithm computes the least common multiple of two mp\_int inputs $a$ and $b$. It computes the least common multiple directly by
6152 dividing the product of the two inputs by their greatest common divisor.
6162 To explain the Jacobi Symbol we shall first discuss the Legendre function\footnote{Arrg. What is the name of this?} off which the Jacobi symbol is
6177 \textbf{Proof.} \textit{Equation \ref{eqn:legendre} correctly identifies the residue status of an integer $a$ modulo a prime $p$.}
6206 One of the terms on the right hand side must be zero. \textbf{QED}
6209 The Jacobi symbol is a generalization of the Legendre function for any odd non prime moduli $p$ greater than 2. If $p = \prod_{i=0}^n p_i$ then
6255 The value of $\left ( {{p \mbox{ mod }a'} \over a'} \right )$ can be found by using the same equation recursively. The value of
6257 factors of $p$ do not have to be known. Furthermore, if $(a, p) = 1$ then the algorithm will terminate when the recursion requests the
6258 Jacobi symbol computation of $\left ( {1 \over a'} \right )$ which is simply $1$.
6302 is based on algorithm 2.149 of HAC \cite[pp. 73]{HAC}.
6304 Step numbers one and two handle the trivial cases of $a = 0$ and $a = 1$ respectively. Step five determines the number of two factors in the
6320 As a matter of practicality the variable $a'$ as per the pseudo-code is reprensented by the variable $a1$ since the $'$ symbol is not valid for a C
6323 The two simple cases of $a = 0$ and $a = 1$ are handled at the very beginning to simplify the algorithm. If the input is non-trivial the algorithm
6327 After a local copy of $a$ is made all of the factors of two are divided out and the total stored in $k$. Technically only the least significant
6328 bit of $k$ is required, however, it makes the algorithm simpler to follow to perform an addition. In practice an exclusive-or and addition have the same
6331 Line 58 through 71 determines the value of $\left ( { 2 \over p } \right )^k$. If the least significant bit of $k$ is zero than
6332 $k$ is even and the value is one. Otherwise, the value of $s$ depends on which residue class $p$ belongs to modulo eight. The value of
6341 The modular inverse of a number actually refers to the modular multiplicative inverse. Essentially for any integer $a$ such that $(a, p) = 1$ there
6342 exist another integer $b$ such that $ab \equiv 1 \mbox{ (mod }p\mbox{)}$. The integer $b$ is called the multiplicative inverse of $a$ which is
6344 fields of integers. However, the former will be the matter of discussion.
6346 The simplest approach is to compute the algebraic inverse of the input. That is to compute $b \equiv a^{\Phi(p) - 1}$. If $\Phi(p)$ is the
6347 order of the multiplicative subgroup modulo $p$ then $b$ must be the multiplicative inverse of $a$. The proof of which is trivial.
6353 However, as simple as this approach may be it has two serious flaws. It requires that the value of $\Phi(p)$ be known which if $p$ is composite
6354 requires all of the prime factors. This approach also is very slow as the size of $p$ grows.
6363 Where $a$, $b$, $p$ and $q$ are all integers. If such a pair of integers $ \left < b, q \right >$ exist than $b$ is the multiplicative inverse of
6365 However, instead of using that algorithm directly a variant known as the binary Extended Euclidean algorithm will be used in its place. The
6419 This algorithm computes the modular multiplicative inverse of an integer $a$ modulo an integer $b$. This algorithm is a variation of the
6433 If $v$, the greatest common divisor of $a$ and $b$ is not equal to one then the algorithm will report an error as no inverse exists. Otherwise, $C$
6434 is the modular inverse of $a$. The actual value of $C$ is congruent to, but not necessarily equal to, the ideal modular inverse which should lie
6436 then only a couple of additions or subtractions will be required to adjust the inverse.
6448 the Diophantine $Cb + Da = 1$ only $B$ and $D$ are required to find the inverse of $a$.
6450 The algorithm fast\_mp\_invmod is a direct adaptation of algorithm mp\_invmod with all all steps involving either $A$ or $C$ removed. This
6463 As will be discussed it is possible to limit the probability of error so well that for practical purposes the probablity of error might as
6464 well be zero. For the purposes of these discussions let $n$ represent the candidate integer of which the primality is in question.
6470 would require a prohibitive amount of time as $n$ grows.
6472 Instead of dividing by every prime, a smaller, more mangeable set of primes may be used instead. By performing trial division with only a subset
6473 of the primes less than $\sqrt{n} + 1$ the algorithm cannot prove if a candidate is prime. However, often it can prove a candidate is not prime.
6475 The benefit of this test is that trial division by small values is fairly efficient. Specially compared to the other algorithms that will be
6477 $1 - {1.12 \over ln(q)}$. The graph (\ref{pic:primality}, will be added later) demonstrates the probability of success for the range
6480 At approximately $q = 30$ the gain of performing further tests diminishes fairly quickly. At $q = 90$ further testing is generally not going to
6481 be of any practical use. In the case of LibTomMath the default limit $q = 256$ was chosen since it is not too high and will eliminate
6482 approximately $80\%$ of all candidate integers. The constant \textbf{PRIME\_SIZE} is equal to the number of primes in the test base. The
6483 array \_\_prime\_tab is an array of the first \textbf{PRIME\_SIZE} prime numbers.
6516 The algorithm defaults to a return of $0$ in case an error occurs. The values in the prime table are all specified to be in the range of a
6527 upto $1619$ are used. Note that the value of \textbf{PRIME\_SIZE} is a constant dependent on the size of a mp\_digit.
6530 The Fermat test is probably one the oldest tests to have a non-trivial probability of success. It is based on the fact that if $n$ is in
6531 fact prime then $a^{n} \equiv a \mbox{ (mod }n\mbox{)}$ for all $0 < a < n$. The reason being that if $n$ is prime than the order of
6537 of a base will divide $n - 1$ which would then be reported as prime. Such a base yields what is known as a Fermat pseudo-prime. Several
6575 value must be equal to $-1$. The squarings are stopped as soon as $-1$ is observed. If the value of $1$ is observed first it means that
6609 This algorithm performs one trial round of the Miller-Rabin algorithm to the base $b$. It will set $c = 1$ if the algorithm cannot determine
6610 if $b$ is composite or $c = 0$ if $b$ is provably composite. The values of $s$ and $r$ are computed such that $a' = a - 1 = 2^sr$.
6631 Donald Knuth, \textit{The Art of Computer Programming}, Third Edition, Volume Two, Seminumerical Algorithms, Addison-Wesley, 1998
6634 A. Menezes, P. van Oorschot, S. Vanstone, \textit{Handbook of Applied Cryptography}, CRC Press, 1996
6646 Andre Weimerskirch and Christof Paar, \textit{Generalizations of the Karatsuba Algorithm for Polynomial Multiplication}, Submitted to Design, Codes and Cryptography, March 2002
6652 P.L.Montgomery. \textit{Modular multiplication without trial division}. Mathematics of Computation, 44(170):519-521, April 1985.
6658 J. Daemen and R. Govaerts and J. Vandewalle, \textit{Block ciphers based on Modular Arithmetic}, State and {P}rogress in the {R}esearch of {C}ryptography, 1993, pp. 80-89