An Algorithm for Inversion in GF(2 m ) Suitable for Implementation - PowerPoint PPT Presentation

An Algorithm for Inversion in GF(2 m ) Suitable for Implementation Using a Polynomial Multiply Instruction on GF(2) K. Kobayashi, N. Takagi, and K. Takagi Graduate School of Information Science, Nagoya University

Outline Background and objective Preliminaries GF(2 m ) A polynomial multiply instruction on GF(2) A conventional algorithm for inversion in GF(2 m ) A new algorithm for inversion in GF(2 m ) Evaluation Concluding remarks – p.1

Background and Objective GF(2 m ) plays important roles in error-correcting codes and cryptography A fast algorithm for inversion in GF(2 m ) is required Polynomial multiply instruction on GF(2) accelerates multiplication in GF(2 m ) . We propose a fast algorithm for inversion in GF(2 m ) that is suitable for implementation using a polynomial multiply instruction on GF(2) – p.2

GF(2 m ) (1/2) GF(2 m ) extension field of GF(2) any element A ( x ) ∈ GF(2 m ) A ( x ) = a m − 1 x m − 1 + · · · + a 1 x + a 0 ( a i ∈ { 0 , 1 } ) Addition in GF(2 m ) polynomial addition on GF(2) A ( x ) + B ( x ) = (( a m − 1 + b m − 1 ) mod 2) x m − 1 + · · · + (( a 0 + b 0 ) mod 2) executed by exclusive-OR operation for every coefficient – p.3

GF(2 m ) (2/2) Multiplication in GF(2 m ) polynomial multiplication modulo G ( x ) on GF(2) G ( x ) : the irreducible polynomial with degree m A ( x ) · B ( x ) = A ( x ) × B ( x ) mod G ( x ) · : multiplication in GF(2 m ) × : polynomial multiplication in GF(2) Multiplicative inverse of A ( x ) The element A − 1 ( x ) is such that A ( x ) · A − 1 ( x ) = 1 . time-consuming operation – p.4

MULGF2 MULGF2 instruction A typical polynomial multiply instruction on GF(2) calculates the 2 -word polynomial product from two 1 -word polynomial operands rs rt HI LO accelerates multiplication in GF(2 m ) A multiplier for MULGF2 can be realized very easily “carry-free” version of an integer multiplier – p.5

Algorithm for Inversion in GF(2 m ) By extending the Euclid’s algorithm for polynomial, we can execute inversion in GF(2 m ) . R − 1 ( x ) := G ( x ); R 0 ( x ) := A ( x ); j := 0; repeat j := j + 1; Q j ( x ) := R j − 2 ( x ) ÷ R j − 1 ( x ); R j ( x ) := R j − 2 ( x ) − Q j ( x ) × R j − 1 ( x ); until R j ( x ) = 0; outputs R j − 1 ( x ) as GCD ( A ( x ) , G ( x )) ▽ – p.6

Algorithm for Inversion in GF(2 m ) By extending the Euclid’s algorithm for polynomial, we can execute inversion in GF(2 m ) . R − 1 ( x ) := G ( x ); U − 1 ( x ) := 0; R 0 ( x ) := A ( x ); U 0 ( x ) := 1; j := 0; repeat j := j + 1; Q j ( x ) := R j − 2 ( x ) ÷ R j − 1 ( x ); R j ( x ) := R j − 2 ( x ) − Q j ( x ) × R j − 1 ( x ); U j ( x ) := U j − 2 ( x ) − Q j ( x ) × U j − 1 ( x ); until R j ( x ) = 0; outputs R j − 1 ( x ) as GCD ( A ( x ) , G ( x )) outputs U j − 1 ( x ) as A − 1 ( x ) ( A ( x ) × A − 1 ( x )mod G ( x )=1 ) – p.6

Software Implementation of EA software implementation of the Euclid’s algorithm S ( x ) := G ( x ); R ( x ) := A ( x ); 1st iteration while R ( x ) � = 0 do x 3 x 2 S: + + 1 x 2 R: + 1 δ := deg( S ( x )) − deg( R ( x )); if deg( S ( x )) < deg( R ( x )) then R ( x ) ↔ S ( x ); δ := − δ ; end if S ( x ) := S ( x ) − x δ × R ( x ); end while ▽ – p.7

Software Implementation of EA software implementation of the Euclid’s algorithm S ( x ) := G ( x ); R ( x ) := A ( x ); 1st iteration while R ( x ) � = 0 do x 3 x 2 S: + + 1 x 2 R: + 1 δ := deg( S ( x )) − deg( R ( x )); 3−2 if deg( S ( x )) < deg( R ( x )) then S(x) := S(x) − x R(x); R ( x ) ↔ S ( x ); δ := − δ ; end if S ( x ) := S ( x ) − x δ × R ( x ); end while ▽ – p.7

Software Implementation of EA software implementation of the Euclid’s algorithm S ( x ) := G ( x ); R ( x ) := A ( x ); 1st iteration while R ( x ) � = 0 do x 3 x 2 S: + + 1 x 2 R: + 1 δ := deg( S ( x )) − deg( R ( x )); if deg( S ( x )) < deg( R ( x )) then 2nd iteration x 2 S: + x + 1 R ( x ) ↔ S ( x ); δ := − δ ; end if x 2 R: + 1 S ( x ) := S ( x ) − x δ × R ( x ); end while ▽ – p.7

Software Implementation of EA software implementation of the Euclid’s algorithm S ( x ) := G ( x ); R ( x ) := A ( x ); 1st iteration while R ( x ) � = 0 do x 3 x 2 S: + + 1 x 2 R: + 1 δ := deg( S ( x )) − deg( R ( x )); if deg( S ( x )) < deg( R ( x )) then 2nd iteration R ( x ) ↔ S ( x ); δ := − δ ; x 2 S: + x + 1 x 2 end if R: + 1 2−2 S ( x ) := S ( x ) − x δ × R ( x ); S(x) := S(x) − x R(x); end while ▽ – p.7

Software Implementation of EA software implementation of the Euclid’s algorithm S ( x ) := G ( x ); R ( x ) := A ( x ); 1st iteration while R ( x ) � = 0 do x 3 x 2 S: + + 1 x 2 R: + 1 δ := deg( S ( x )) − deg( R ( x )); if deg( S ( x )) < deg( R ( x )) then 2nd iteration x 2 S: + x + 1 R ( x ) ↔ S ( x ); δ := − δ ; end if x 2 R: + 1 S ( x ) := S ( x ) − x δ × R ( x ); 3rd iteration end while x 1 S: x 2 R: + 1 ▽ – p.7

Software Implementation of EA software implementation of the Euclid’s algorithm S ( x ) := G ( x ); R ( x ) := A ( x ); 1st iteration while R ( x ) � = 0 do x 3 x 2 S: + + 1 x 2 R: + 1 δ := deg( S ( x )) − deg( R ( x )); if deg( S ( x )) < deg( R ( x )) then 2nd iteration x 2 S: + x + 1 R ( x ) ↔ S ( x ); δ := − δ ; end if x 2 R: + 1 S ( x ) := S ( x ) − x δ × R ( x ); 3rd iteration end while x 1 S: x 2 R: + 1 S(x) <−> R(x); 2−1 S(x) := S(x) − x R(x); ▽ – p.7

Software Implementation of EA software implementation of the Euclid’s algorithm S ( x ) := G ( x ); R ( x ) := A ( x ); 1st iteration while R ( x ) � = 0 do x 3 x 2 S: + + 1 x 2 R: + 1 δ := deg( S ( x )) − deg( R ( x )); if deg( S ( x )) < deg( R ( x )) then 2nd iteration x 2 R ( x ) ↔ S ( x ); δ := − δ ; S: + x + 1 end if x 2 R: + 1 S ( x ) := S ( x ) − x δ × R ( x ); 3rd iteration end while x 1 S: x 2 1st & 2nd iterations correspond R: + 1 to one polynomial division 4th iteration x 1 S: x 2 R: + 1 – p.7

Main Idea Key point The conventional algorithm can not use MULGF2 efficiently S ( x ) := S ( x ) − x δ × R ( x ); New algorithm based on Brunner’s hardware algorithm for inversion use MULGF2 efficiently executed with regularity – p.8

HW implementation Hardware algorithm for inversion [Brunner et al., ’93] δ = 0 S ( x ) := G ( x ); R ( x ) := A ( x ); δ := 0; 1st iteration for i = 1 to 2 m do x 3 x 2 S: + + 1 if r m = 0 then x 2 R: + 1 R ( x ) := x × R ( x ); δ := δ + 1; else if s m = 1 then S ( x ) := S ( x ) − R ( x ); end if S ( x ) := x × S ( x ); if δ = 0 then R ( x ) ↔ S ( x ); δ := δ + 1; else δ := δ − 1; end if end if end for ▽ – p.9

HW implementation Hardware algorithm for inversion [Brunner et al., ’93] δ = 0 S ( x ) := G ( x ); R ( x ) := A ( x ); δ := 0; 1st iteration for i = 1 to 2 m do x 3 x 2 S: + + 1 if r m = 0 then x 2 R: + 1 R ( x ) := x × R ( x ); δ := δ + 1; R(x) := x R(x); else if s m = 1 then δ := δ + 1; S ( x ) := S ( x ) − R ( x ); end if S ( x ) := x × S ( x ); if δ = 0 then R ( x ) ↔ S ( x ); δ := δ + 1; else δ := δ − 1; end if end if end for ▽ – p.9

HW implementation Hardware algorithm for inversion [Brunner et al., ’93] δ = 0 S ( x ) := G ( x ); R ( x ) := A ( x ); δ := 0; 1st iteration for i = 1 to 2 m do x 3 x 2 S: + + 1 if r m = 0 then x 2 R: + 1 R ( x ) := x × R ( x ); δ := δ + 1; δ = 1 2nd iteration else x 3 x 2 S: + + 1 if s m = 1 then x 3 R: + x S ( x ) := S ( x ) − R ( x ); end if S ( x ) := x × S ( x ); if δ = 0 then R ( x ) ↔ S ( x ); δ := δ + 1; else δ := δ − 1; end if end if end for ▽ – p.9

HW implementation Hardware algorithm for inversion [Brunner et al., ’93] δ = 0 S ( x ) := G ( x ); R ( x ) := A ( x ); δ := 0; 1st iteration for i = 1 to 2 m do x 3 x 2 S: + + 1 if r m = 0 then x 2 R: + 1 R ( x ) := x × R ( x ); δ := δ + 1; δ = 1 2nd iteration else x 3 x 2 S: + + 1 if s m = 1 then x 3 R: + x S ( x ) := S ( x ) − R ( x ); end if S(x) := x (S(x) − R(x)); δ := δ − 1; S ( x ) := x × S ( x ); if δ = 0 then R ( x ) ↔ S ( x ); δ := δ + 1; else δ := δ − 1; end if end if end for ▽ – p.9

HW implementation Hardware algorithm for inversion [Brunner et al., ’93] δ = 0 S ( x ) := G ( x ); R ( x ) := A ( x ); δ := 0; 1st iteration for i = 1 to 2 m do x 3 x 2 S: + + 1 if r m = 0 then x 2 R: + 1 R ( x ) := x × R ( x ); δ := δ + 1; δ = 1 2nd iteration else x 3 x 2 S: + + 1 if s m = 1 then x 3 R: + x S ( x ) := S ( x ) − R ( x ); δ = 0 end if 3rd iteration x 3 x 2 S: + + x S ( x ) := x × S ( x ); x 3 if δ = 0 then R: + x R ( x ) ↔ S ( x ); δ := δ + 1; else δ := δ − 1; end if end if end for ▽ – p.9

HW implementation Hardware algorithm for inversion [Brunner et al., ’93] δ = 0 1st iteration S ( x ) := G ( x ); R ( x ) := A ( x ); δ := 0; for i = 1 to 2 m do x 3 x 2 S: + + 1 if r m = 0 then x 2 R: + 1 R ( x ) := x × R ( x ); δ := δ + 1; δ = 1 2nd iteration else x 3 x 2 S: + + 1 if s m = 1 then x 3 R: + x S ( x ) := S ( x ) − R ( x ); δ = 0 3rd iteration end if x 3 x 2 S: + + x S ( x ) := x × S ( x ); x 3 if δ = 0 then R: + x R ( x ) ↔ S ( x ); δ := δ + 1; S(x) := x (S(x)−R(x)); else S(x) <−> R(x); δ := δ − 1; end if δ := δ + 1; end if end for ▽ – p.9