Finite Field Multiplier Using Redundant Representation
Huapeng Wu, M. Anwar Hasan, Ian F. Blake, Shuhong Gao January 3, 2002
Abstract This article presents simple and highly regular architectures for finite field multipliers using a redundant representation. The basic idea is to embed a finite field into a cyclotomic ring which has a basis with the elegant multiplicative structure of a cyclic group. One important feature of our architectures is that they provide area-time trade-offs which enable us to implement the multipliers in a partial-parallel/hybrid fashion. This hybrid architecture has great significance in its VLSI implementation in very large fields. The squaring operation using the redundant representation is simply a permutation of the coordinates. It is shown that when there is an optimal normal basis, the proposed bit-serial and hybrid multiplier architectures have very low space complexity. Constant multiplication is also considered and is shown to have advantage in using the redundant representation.
Index terms: Finite field arithmetic, cyclotomic ring, redundant set, normal basis, multiplier, squaring.
H. Wu is with the Centre for Applied Cryptographic Research, University of Waterloo, Waterloo, Canada. Email:
[email protected]. M. A. Hasan is with the Department of Electrical and Computer Engineering, University of Waterloo. E-mail:
[email protected]. I. F. Blake is with the Department of Electrical and Computer Engineering, University of Toronto, Toronto, Canada. E-mail:
[email protected]. S. Gao is with the Department of Mathematical Sciences, Clemson University. E-mail:
[email protected]. Gao was supported in part by NSF grant #DMS9970637, NSA grant #MDA90400-1-0048 and ONR grant #N00014-00-1-0565.
1
1
INTRODUCTION
Efficient computations in finite fields and their architectures are important in many applications including coding theory, computer algebra systems and public-key cryptosystems (e.g., elliptic curve cryptosystems). Although all finite fields of the same cardinality are isomorphic, their arithmetic efficiency depends greatly on the choice of bases for field element representations. The most commonly used bases are polynomial bases (PB) and normal bases (NB), sometimes combined with dual bases (DB)[15]. A major advantage of normal bases in the fields of characteristic two is that the squaring operation in NB is simply a cyclic shift of the coordinates of elements, so these are useful for computing large exponentiations and multiplicative inverses [13, 11, 1]. Also, the multiplication table of a normal basis is symmetric, so suitable for hardware implementation. This is the basis for the multiplier of Massey-Omura [16] and that of Onyszchuk et al. [18]. Recently, Gao et al. [7, 8] have proposed a novel method to perform fast multiplication with a normal basis generated by Gauß periods. The main idea is to embed a field in a larger ring, perform multiplication (using the Fast Fourier Transform) there and then convert the result back to the field. The ring they use is referred to as a cyclotomic ring which has an extremely simple basis whose elements form a cyclic group. One purpose of this paper is to make this idea more explicit and present architectures that are suitable for hardware implementation.
, which are one of the two types of fields used most commonly in practice (the other one is where is a prime). We We are mainly interested in finite fields of characteristic two, i.e.
show how to find the smallest cyclotomic ring in which
can be embedded. Since “embed-
ding” is not unique, each element in the ring can be represented in more than one way, i.e., the representation contains certain amount of redundancy. In this article, we also discuss how this redundant representation of a field element can be efficiently converted to a normal basis and vice versa. Another purpose of our paper is to present architectures for arithmetic in
. Both bit-serial
and hybrid multipliers using the redundant representation are proposed and their complexities are discussed. A modified form of the multipliers using the redundant representation with reduced complexity are also presented. The bit-serial and hybrid architectures of this modified multiplier have lower complexity compared to the previously reported normal basis multipliers. A constant 2
multiplier using the redundant representation is also considered. We should mention other related work here. Itoh and Tsujii [14] constructed a multiplier for a class of fields defined by irreducible all-one-polynomials (AOPs) and equally-spaced-polynomials (ESPs). Wolf [22] found a simple multiplication architecture for irreducible AOP’s. Drolet [4] uses maximum subfields in cyclotomic rings. Silverman [19] considered a special case when there is a type I optimal normal basis. This case is also considered in [7, 8]. A more recent article on redundant representation is [10]. The organization of this paper is as follows: Section 2 shows how redundant representation of a field element can be derived from cyclotomic rings. In Section 3, multiplication operation using the redundant representation is discussed and then basis conversions are given. Architectures of bit-serial, bit-parallel, hybrid, and constant multipliers are presented in Section 4. For the field which has a type II ONB, we show in Section 5 that more efficient architectures can be developed using a basis derived from the redundant representation. This multiplier architecture is highly regular and also has low complexity. Finally, a few concluding remarks are given in Section 6.
2
CYCLOTOMIC FIELDS AND REDUNDANT REPRESENTATION
, over over . In particular, divides for some is defined to be the splitting field of and is thus coprime to the characteristic. Let be a primitive -th root of unity in some extension is generated by over and elements of can be written in the form of . Then "!!!# %$ %$ & ('*) ,+ (1) +++ & .$ 0/ , ' ) , gives an Here the representation is not unique, that is, each -tuple - & & 123 different tuples may give the same element. For example, since element 4!!!5of %$ but 6 6 +++ & 6 / and - & & +++ & / both represent 6 , while -tuples - & & 8 6 +++ 6 / 76 6 , the++3+ two - & & & and - & & & / both represent 8 . Because such ;: redundant representations, ++of + & %$ as a redundant basis for and by a slight abuse of terminology, we denote 9 & & & An ordered set of field elements is denoted by =?=@=BA . Let
be any field and
a positive integer. The -th cyclotomic field, denoted by
1
1
3
23 .
any subfield of
23 containing
. Note that a redundant basis is unique up to order for a given
: / , called the -th cyclotomic ring, On the other hand, we may consider the ring 9> - / and elements of denoted by . If we let be the congruence class of , then can also and elements in the form (1). But now the representation is unique +3+so+ the & & & be+++ represented % $ . $ & form a true basis for . Note that the elements & & & & form a ' cyclic group of order and ' ! &+ (2) This simple multiplication table allows us to design efficient architectures of low complexity as shown in Section 3. Suppose that
is embedded in
23
, where
is a prime power. Then arithmetic in
using the redundant representation can be performed following these three steps: 1. Represent elements in
2. View them in the ring
in the form (1); and do arithmetic there;
3. Finally convert the result back to
.
We characterize here all the fields that can be embedded in
Theorem 1 [15] Let is contained in
23 when .
% be a prime power and be a positive integer with - & / . Then iff divides the multiplicative order of modulo .
Let be the multiplicative order of modulo . By Theorem 2.47 (page 65) of [15], has degree 23Proof: so it is isomorphic to . The theorem follows, as is contained in if and only if . 5 "!
there is a redundant basis of size
Remark 1 If there is a type I optimal normal basis in for
. 4
then
is contained in
, so
Here a basis for
is
& & 3+ ++ & !
and the correspondence between field elements and ring
elements is
"!!!# ! ! - * / - ( / !!!# - ! ( / !
6 ! "!!!# ! ! ! !3!!# ! ! +
This is the case considered by Silverman, Gao, et al. [19, 7, 8].
there is a redundant basis of size
Remark 2 If there is a type II optimal normal basis in
for
then
is contained in
!
, so
.
6
% .
This case will be considered in more detail in Section 5. In concluding this section, in Table 1 we give the smallest values of
3
for
such that
is contained in
MULTIPLICATION USING REDUNDANT REPRESENTATION
From now on we only consider fields of characteristic two.
3.1 Multiplication Operation Consider the basis of our redundant representation for
over
9 & & & 3+ ++ & %$ : +
:
& ) be represented with respect to (w.r.t.) , i.e., ' .' $ ' '
. Note that the coordinates of w.r.t. and %' $ ' , where (' ' & ' ) ' are and the lists of coefficients and are not unique. , the product of field elements and can be given by Since ' %$ ' %$ .$ %$ %$ % $ . $ ' - ! / ' - / (' - $ ' / (' $ ' & ' ' ' ' / in the subscript denotes that is to be reduced modulo . where - Let any two field elements
5
151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175
907 1217 613 617 311 169 1571 317 749 2123 967 163 653 415 661 499 2339 833 677 1021 361 173 347 349 701
6.0 8.0 4.0 4.0 2.0 1.1 10.0 2.0 4.7 13.3 6.0 1.0 4.0 2.5 4.0 3.0 14.0 5.0 4.0 6.0 2.1 1.0 2.0 2.0 4.0
176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200
1409 709 179 359 181 1087 547 367 799 1481 373 1123 941 379 573 383 769 773 389 869 197 3547 437 797 401
8.0 4.0 1.0 2.0 1.0 6.0 3.0 2.0 4.3 8.0 2.0 6.0 5.0 2.0 3.0 2.0 4.0 4.0 2.0 4.5 1.0 18.0 2.2 4.0 2.0
201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225
1609 809 841 409 821 619 829 2081 419 211 2111 535 853 643 1291 1297 1303 1091 877 575 443 1043 2677 449 1919
8.0 4.0 4.1 2.0 4.0 3.0 4.0 10.0 2.0 1.0 10.0 2.5 4.0 3.0 6.0 6.0 6.0 5.0 4.0 2.6 2.0 4.7 12.0 2.0 8.5
226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250
227 5449 1603 2749 461 463 929 467 1007 941 709 1423 717 479 1067 1447 1331 487 733 491 581 1483 1489 1169 625
that contains as a subfield.
Table 1: Smallest cyclotomic field
% $ , we have If we define .$ (' $ ' & 6 & & +3++ & + '
1.0 24.0 7.0 12.0 2.0 2.0 4.0 2.0 4.3 4.0 3.0 6.0 3.0 2.0 4.4 6.0 5.5 2.0 3.0 2.0 2.4 6.0 6.0 4.7 2.5
(3)
Then a multiplication operation using the redundant representation is decided by expression (3). On the other hand, the squaring of an element follows:
using basis
" !!! .$ 2 %$ + 6
can simply be performed as
$ . Note that is odd because of the minimum Since , we have if can be written as of the redundant basis, thus "!!!# .$ !!3!# .$ %$ !3!!# %$ %$ + Clearly, a squaring operation using redundant representation is equivalent to a permutation of the element coordinates.
3.2 Gauß Periods, Normal Bases and Redundant Bases Some redundant bases can be easily introduced by the normal bases generated with the Gauß period, and by doing so one can find the relation/conversion between the redundant basis and the normal basis. This is discussed below.
& be is a prime, and let be a prime power with - & / . Let integers such that , then for any be the unique subgroup of order of the multiplicative group of , the element primitive th root of unity in The Gauß periods, which were discovered by Gauß, are defined as follows: Let
, where
(4)
! ! . is a square root of unity in ! is a th root of unity in
) . For example, when , $ . This is the case which will be discussed in Section 5.
is called a Gauß period of type be checked that #" , and
- & /
over
. So,
It can
Gauß periods have been used to construct normal bases with low complexity [17, 3]. (For a
9 & & +++ & : in over if and / , where is the order of modulo . Furthermore, such a normal basis has only if - & with %$ if even and otherwise [3, 21, 6]. Gauß periods complexity at most %$ / / , which of type - & and - & generate optimal normal bases (ONBs) with complexity - & /
definition of the complexity of a normal basis the reader is referred to [3].) A Gauß period of type over
naturally introduces a normal basis
are usually called type-I and type-II ONBs, respectively [17].
7
- & / , from (4) we have +++ ! $ : & & ' &
!$ !$ : 9 &
& & +++ & 9 ' ' . Note that each element in is a sum of where is a primitive th root of unity in ! ! 6 +++ , elements. Let the set of these elements be denoted as & ! & & & 6 & & +3++ & . Consider another set of elements: & & ++3+ & ! . It can be seen that elements in can serve as a “representation basis” for . Indeed for any element ) ! ! ) ! ! 5 then , we have ) +3++ , and thus, ) . Let & & ' & , there exist integers 6 & & +++ & and & . For any integer ) 6 & & +++ & , such that ,- / . Therefore, . Obviously, besides element “1”, the basis of our redundant representation contains exactly the or . same elements as For a normal basis generated with Gauß period of type
3.3 Conversions of Bases Among the three steps of redundant representation arithmetic, the first and the final steps deal with the change of representations. In this subsection we discuss the conversions between the normal basis and the redundant basis derived from the Gauß period. We show that such conversions can be done in hardware with almost no cost. Before giving the conversions between normal basis
and redundant basi
, we first intro-
duce two intermediate “bases”. Following the discussion in the previous subsection, we separate each sum of terms of
Clearly,
9 & & + ++ &
and put the
& & & ++3+ &
can serve as a “basis” of
elements in an ordered set and let it be denoted by
& ++3+ &
Let
)
& +++ &
:+
. The second intermediate “basis” is given by
9 & & & + ++ & ! ! : +
From the discussion in the previous subsection, we know that
ments as
&
:
has exactly the same
ele-
permutation can be carried out as follows. but with a different order. Moreover, the - & & +++ & ! ! / w.r.t. for & . For any & "! ! , write and 8
where
, where ! - $ /
!
denotes
and
$
correspondence between the
6 !
. Then ' " ! &
!
(5)
to be reduced modulo . In this way, we create a one-to-one
and
based coordinates.
Obviously, conversions between the normal basis and the redundant basis can be divided into three steps: (a) Conversions between the normal basis and the intermediate basis (b) Conversions between two intermediate bases (c) Conversions between
and
;
;
and the redundant basis
Step (b) has been solved in (5). It can be implemented as a rewiring of lines and has almost no
- & & +++ & ! ! / w.r.t. the
cost in hardware. Step (c) is even simpler. Note that the redundant basis can be obtained by including the element “ ” before the first element of
. If we let
redundant representation, then
(' ' for & & +++ &
Conversely, if
(' ’s are given, then ' ' ('
and
" 6+
(6)
6 & +
if otherwise
(7)
can be given / + + +
as follows. If - $ & $ & & $! $ w.r.t. the normal basis , then w.r.t one has - $ & $ & +++ & $! $ / - $ & ++3 + & $ & $ & +3 + + & $ & +++ & $! $ & ++3 + & $! $ / + (8) In Step (a), the conversion from the normal basis
!
!
to the intermediate basis
!
The reverse conversion, however, is much more complicated. Note that it is not possible to convert every redundant representation, since some of them may not represent an element in the field
. Two tasks have to be performed in this step: One is to identify the representation of a 9
field element w.r.t.
, and the second is to convert the identified field element’s representation
back to the normal basis. For the interest of this paper which deals with finite field multiplication, it is sufficient to
' ! ! basis. Suppose that the coordinates &
consider identifying the product of two field elements in
and then convert it back to the normal
of the product
w.r.t.
are given. Then,
we have the following lemma.
& ) are respectively given in by ! ! ! $ ! $ ! ' and ! ' '5 '
Lemma 1 Assume that
&
! ! !3!! ! ! and ! ! !!! ! ! (9) in obtained using (3) also has the property: 6 & & +++ & . Then for the product ! ! !!! ! ! for 6 & & +++ & . where
.
The assertion of the lemma is immediately clear from the following fact. The representations of and
Clearly,
- / w.r.t.
-/
& )
are images of a homomorphism , namely the embedding of and
for some
! - 8! /
into
. Note that the image of the embedding is
characterized by the property expressed in (9). Consequently,
is also in the
image of and thus of the claimed form. The lemma allows us to identify the
basis representation of the product of two field ele-
ments also represented by . Once the product is obtained in this the corresponding normal basis as
- $ & ++3 + & $ & $ & ++ + & $ & +++ & $! $ & + + + & $! $ / !
!
!
basis, it can be converted to
- $ & $ & +++ & $! $ / +
(10)
Thus, Step (a) of basis conversion can be realized with (8) and (10).
3.4 Further Results on Redundant Basis )
+ + + & ! & & .$ / obtained Lemma 2 Let and consider its basis representation ! + + + & & & % $ from its normal basis representation by using (8) and (5). Then the last coordinates
10
are a mirror reflection of the first
Proof:
Let
be a primitive
:
! ! th
coordinates if
root of unity. Then
is an even integer.
$ '
!
generates a normal basis
9 & & + ++ & , thus in . Since is an even number and "!!!# "!!!# "!!! - !!3!# / - $ $ "!!!# $ / + (11) $ $ + + +
+ + + & The two are respectively given by 9 & & +3+& + ! & ! : & +++ bases $ +3++ $ : +++ & intermediate
& & & & & and 9 & & & . It can be seen
from (11) that the coordinates of w.r.t have the same values. If a line is drawn at the
basis element sequence between and , then for any coordinate middle the itsofmirror reflection coordinate .$ B$ must have the same value. and . Let denote a primitive th root of unity in . For example, let $ $ is a Gauß period of type - & / Since has order in , then
& & & +++ & : over and generates a normal basis in : 9 . Subsequently,
:
9 & & & & & & & & +++ & & & & and are respectively given by and :
9 & & & +++ & . Finally, the redundant representation basis can be obtained by including
the element “1” before the element in . Let the normal basis representation of a field element be - $ & $ & $ & $ & $ & $ & $ / . We can obtain its representation as follows: - $ & $ & $ & $ & $ & $ & $ & $ & $ & $ & $ & $ & $ & $ & $ & $ & $ & $ & $ & $ & $ & $ & $ & $ & $ & $ & $ & $ / +
coordinates are a mirror reflection
It can be seen that in the basis representation the first coordinates. The corresponding redundant basis representation of is obtained of the last 6
simply by including a “ ” before the first coordinate in the representation. +++ & ; / of the redundant repreAlso note that only eight consecutive coordinates - & &
consecutive coordinates
sentation, which include all the seven coordinates w.r.t. determining the element
the normal basis, are necessary for
. This fact can be exploited when a multiplication operation using 11
153 163 169 175
613 653 677 701
281 299 313 323
0.46 0.46 0.46 0.46
177 193 199 205
Table 2: Ratios of
to
709 773 797 821
326 357 368 374
0.46 0.46 0.46 0.46
207 213 219 235
for some useful values of
redundant representations is implemented. If we denote
829 853 877 941
375 393 396 428
0.45 0.46 0.45 0.45
with k=4.
as the minimal number of consecutive
coordinates of the redundant representation needed to determine the element, then Table 2 shows
/ type - & .
some values of
for the fields given in Table 1 which can be generated with the Gauß period of
& ) , let - & & ++3+ & .$ 0/ and - & & +++ & .$ 0/ w.r.t. , . Assume that ! - & & +++ & %$ / is obtained using (3). If where
and is even, then . Lemma 3 For
.$ & %$ & +++ & . Then from (3) we . $ % $ % $ ' .$ ' ' ' 4 ' ' . Note that - & & +3++ & .$ 0/ have exactly have ' ' ' +3++ & .$ / copies of the normal basis coordinates, and the same property also applies to - & & ! .$ (' ' ! ' ' (refer to (9)). Then ' can be written as a sum of partial sums, where each ' %$ ' ' 6 partial sum is a sum of same values which is clearly zero since is even. Then ' ( . and Proof:
It follows from Lemma 2,
This property will be used later to obtain efficient architecture for finite field multiplier.
4
ARCHITECTURES FOR REDUNDANT BASIS MULTIPLICATION
&
!
are represented with respect to the redundant basis .
In this section we present architectures for hardware implementation of the multiplication:
based on (3), where
and
12
Conversion between
and the normal basis , as discussed in Subsection 3.3, can be performed
without any logic gates.
4.1 Bit-Serial Multipliers Parallel-in serial-out version
An architecture for a parallel-in-serial-out (PISO) multiplier is
shown in Fig. 1. The -bit register, which is initially loaded with
, is cyclically shifted with
and the resulting bits are added using XOR gates (arranged in a binary tree form for minimum delay). For a straightforward implementation, this PISO multiplier requires flip-flops, AND XOR gates, and the multiplication is completed in clock cycles. gates and a clock. The contents of this register are bit-wise multiplied with the coordinates of
2
The PISO multiplier architecture shown in Fig. 1 can be optimized and its time and space
. $ / ' ' taken into consideration. Since the redundant basis coordinates contain copies of the / 6 ( ' (' !!3! ' . If + 3 + + & & & , suppose normal basis coordinates $ for all & - ++3+ & , respectively, then part of the PISO these coordinates are bit-wise multiplied with & & ' (' !3!!@ (' , which requires AND and multiplier (refer to Fig. 1) computes (' (' !!! ' , one can equivalently compute ' - !!!% / , XOR gates. Since complexities can be greatly reduced if certain properties of the redundant representation basis are
XOR gates. This reduces the total number of AND gates , while the number of XOR gates remains the same. in the PISO multiplier from to
which requires only AND and
3
It is also possible to reduce the number of clock cycles needed by the PISO multiplier. Towards this end, if we can change the order of the input bits to the PISO multiplier such that in
) clock cycles the multiplier generates those consecutive coordinates of 6 + + + & & & ), then the computation time that have at least one copy of , for all & - / to clock cycles. The value of can be considerably lower would reduce from - and 6 ! ! 6 that than . Table 2 lists minimum values of (denoted as ) for , the are of interest to elliptic curve cryptosystems. It can be seen from the table that for 6 computation time is reduced by more than %. In fact for any even value of , the computation the first
(
!
!
Note that input can directly come from a register that is not necessarily part of the multiplier. As a result, in determining the circuit complexity of the multiplier, no register is considered for . 3 One more AND gate may be saved if one can ensure that always has . 2
13
5
