Marco Teórico

Exponentiation is a fundamental operation for the Diffie-Hellman key exchange algorithm [29] and is also used for other cryptographic applications such as random number generation [85]. The n-ary scheme is used to increase throughput ofGF(2m_{) exponentiation [42, 83]. In the}

case ofn= 23 _{(i.e. eight-ary scheme), to compute the exponentiationA}h_{for A}∈_GF(2m_{) and}

a positive integer h = ∑⌈ m 3⌉−1 i=0 hi2 3i_{, where 0} ≤ _h i < 8, one rewrites h as h = ∑7 w=1λ(w)w,

where λ(w) = ∑_{i:hi=w}23i_{. Then, this eight-ary exponentiation scheme requires finding the}

coefficientsλ(w) and precomputing and storing odd powers for 1< w< 8. This takes at most

⌈_m

3

⌉

+2 iterations to complete [42, 83]. In this section, a new architecture for the eight-ary field exponentiation scheme when theGF(2m_{) elements are represented in the GNB is presented.}

The proposed architecture is based on the digit-level hybrid-triple GNB multiplier presented in Section 5.3.2 (Figure 5.6) and computes the exponentiation results using⌈m₃⌉iterations, while it does not require any storage of precomputed values.

In the following, the proposed formulations for field exponentiation is first derived, fol- lowed by presenting its corresponding proposed architecture.

Proposition 5.4.1 Let F = Ah denotes the exponentiation of an arbitrary GF(2m)element A represented in the GNB, where1 <h <2mis an arbitrary positive integer. Therefore, one can compute F using the following recurrence:

F(i)=Ahk′−1−i(_F(i−1))2 3 , (5.6) where k′ =⌈m₃⌉, h=∑k_i=′−₀1hk′−1−i8k ′_−1−i ,0≤ hk′−1−i < 8, F(−1)= 1, and F= F(k ′₋₁₎ .

Proof By substituting fori = 0, . . . ,k′ −1 in (5.6), wherek′ = ⌈m₃⌉andhk′−1−i ∈[0,7] are the

coefficients of the radix-8 representation ofh, one gets

F(k′−1)=A(((hk′−18+hk′−2)8+hk′−3)8+···+h1)8+h0

That is,F(k′−1)= F, sinceh= ∑_ik₌′−₀1hk′−1−i8k

′_−1−i .

Note that (5.6) reads h left-to-right. Similarly, one can read h right-to-left by using F(i) = Ahi(_F(i−1))2 −3 , for 0 ≤ i < k′, where h = 23(k′−1)∑k′−1 i=0 hi2−3(k ′_−1−i) and F = (F(k′−1))2 3(k′−1) . Based on (5.6), the eight-ary exponentiation architecture of Figure 5.7 is proposed, which is constructed based on the proposed digit-level hybrid-triple GNB multiplier of Figure (5.6) (either Figure 5.6a or Figure 5.6b, depending on whether the target application requires a low area design or a high speed design, respectively). It is noted that, in this figure, the 1 inputs to

A

m

F

m

m

m

m

m

m

m

m

m

m

m

m

m

m

m

m

Figure 5.7: Architecture of the proposed eight-ary field exponentiation scheme.

multiplexers represent the field element 1 = (1, . . . ,1) represented in the GNB. As shown in this figure, the architecture is composed of one DL-PIPO hybrid-triple GNB multiplier and four 2 : 1m-bits multiplexers. The first three multiplexers (0, 1, and 2), respectively, are controlled by the coefficients s(₀i), s(₁i), ands(₂i) of the binary representation ofhk′−1−i = s

(i) 0 + s (i) 1 2+ s (i) 2 2 2_,

where k′ = ⌈m₃⌉ and 0 ≤ hk′−1−i < 8 for all 0 ≤ i < k′ in (5.6). The last multiplexer, i.e.

3, passes the field element 1 = (1, . . . ,1) during the first iteration, while it selects the 3-fold right cyclic shift of the multiplier’s output during the remaining iterations. Therefore, by using this architecture one computes F = Ah_afterk′ _{runs of the hybrid-triple multiplication. This is}

equivalent tok′×(L+1) clock cycles in the case of parallel preloading of the multiplier, where

L = kif a low area hybrid multiplier is used otherwise it becomes L = k+1 for using a high speed hybrid multiplier (k=⌈m_d⌉,dis the digit size).

One can see that, the proposed eight-ary exponentiation architecture does not require any storage of precomputed values, while it has almost the same latency, compared to the existing schemes. Also, it is noted that the proposed architecture uses the same latency regardless of the exponent’s value. This in turn prevents leakage of time/power dissipation information.

5.5

Conclusion

In this paper, three new architectures for digit-level (DL) single multiplication using GNB have been proposed; two multipliers with fully serial-in-parallel-out (FSIPO) and one with parallel-in-serial-out (PISO). The two DL-FSIPO single GNB multipliers have been proposed for the first time in the literature. They do not require preloading of the inputs and, hence, are advantageous for applications where the parallel loading of inputs is not possible due to limited size of the data-path.

Using the proposed single digit-level multiplier architectures, a new digit-level serial-in- parallel-out (DL-SIPO) hybrid-double GNB multiplier and for the first time in the literature a new digit-level parallel-in-parallel-out (DL-PIPO) hybrid-triple GNB multiplier have been proposed. The proposed digit-level hybrid-double and hybrid-triple multipliers, perform two and three field multiplications, respectively, using the same latency as a single digit-level field multiplication.

As an application of the proposed hybrid-triple multiplier, a new digit-level eight-ary field exponentiation architecture has been presented which offers computational latency similar to the existing eight-ary schemes, however, without requiring storage of precomputed values.

Chapter 6

Digit-Level Architectures for

GF

(2

m

)

Multiplication in the PB

In this chapter, and to the best of the author knowledge, two new architectures of GF(2m₎

digit-level FSIPO (DL-FSIPO) multipliers for dedicated PBs are proposed for the first time in literature. The new digit-level serial PB architectures generate the output bits in parallel after

kiterations. In the new DL-FSIPO PB multiplication schemes, both inputs enter the multiplier digit-by-digit serially, one digit per a clock cycle starting from the most or least significant digit (MSD or LSD), as the computations are carried out. Therefore, the new MSD and LSD DL- FSIPO PB multiplication structures are expected to be advantageous for resource constrained applications where the data-path of the inputs might have limited capacity, specially, when the value ofmis large. In addition, by using additional parallel-in-serial-out register, one can also generate the output bits of the proposed DL-FSIPO PB multipliers serially over 2kclock cycles. The latter scheme is advantageous over the serial-serial schemes in [46, 14] for performingn

consecutive multiplications. The serial-serial schemes presented in [46, 14] require 2knclock cycles to complete n consecutive GF(2m_{) digit-level multiplications. The same number of} nconsecutive digit-level multiplications can be run using onlyk(n+1) clock cycles based on the proposed DL-FSIPO multiplication schemes with an additional parallel-in-serial-out output register.

It is noted that, a preliminary MSB bit-level version of this chapter appears in ARITH 22, the 22nd IEEE Symposium On Computer Arithmetic (June 2015). The rest of the chapter is organized as follows. Sections 6.1 and 6.2, respectively, present the proposed MSD and LSD DL-FSIPO PB multiplication schemes. Section 6.3, presents comparisons between the proposed MSD and LSD DL-FSIPO PB multiplication schemes and the other existing coun- terparts. Section 6.4 gives some conclusions.