Embed Size (px)
Citation preview
1HMC VLSI Lab
Very High Radix Montgomery Very High Radix Montgomery MultiplicationMultiplicationDavid Harris, Kyle Kelley and Ted Jiang
Harvey Mudd College
Claremont, CA
Supported by Intel Circuit Research Labs
2HMC VLSI Lab
OutlineOutline• RSA Encryption• Montgomery Multiplication• Radix 2 Implementations
– Tenca-Koç Radix 2– Improved Radix 2
• Very High Radix Implementations– Very High Radix– Parallel Very High Radix– Quotient Pipelining
• Results• Future Work
3HMC VLSI Lab
RSA EncryptionRSA Encryption
• Most widely used public key system.– Good for encryption and signatures.– Invented by Rivest, Shamir, Adleman (1978)
• Public e and private d keys are long #s– n = 256-2048+ bits– Satisfy xde mod M = x for all x– Finding d from e is as hard as factoring M
• Encryption: B = Ae mod M• Decryption: C = Bd mod M = Aed = A
4HMC VLSI Lab
RSA DerivationRSA Derivation
• Choose two large random primes p, q• M = pq• Totient: = (p-1)(q-1)• Public key e
– e is coprime to
• Private key d – such that de = 1 mod
• Then xed mod M = x – According to Fermat’s Little Theorem
5HMC VLSI Lab
Cryptographic AlgorithmsCryptographic Algorithms
• DES, AES– Symmetric key algorithms
• Require exchange of secret key
– Computationally efficient
• RSA, ECC– Public key algorithms
• No key exchange needed (e.g. ecommerce)
– Computationally expensive– Use public key to exchange symmetric
key
6HMC VLSI Lab
Modular ExponentiationModular Exponentiation
• Critical operation in RSA and for– Digital signature algorithm– Diffie-Hellman key exchange
• SSL, IPSec, IPv6
– Elliptic curve cryptosystems
• Done with modular multiplications– Ex: A27 = ((((((A2) * A)2)2) * A)2) * A– Division after each multiplication to compute
modulo– Maximum 2n, average 1.5n mults needed
7HMC VLSI Lab
Binary Extension FieldsBinary Extension Fields
• Building blocks are polynomials in x– Operations performed modulo some
irreducible polynomial f(x) of degree n– Arithmetic done modulo 2– Called GF(2n)
• Example: GF(23)– 0, 1, x, x+1, x2, x2+1, x2+x, x2+x+1
• Computation is the same as GF(p)– Except that no carries are propagated
8HMC VLSI Lab
Montgomery MultiplicationMontgomery Multiplication
• Faster way to do modular exponentation– Operate on Montgomery residues– Division becomes a simple shift– Requires conversion to and from
residues only once per exponentiation
9HMC VLSI Lab
Montgomery ResiduesMontgomery Residues
• Let the modulus M be an odd n-bit integer– 2n-1 < M < 2n
• Define R = 2n
• Define the M-residue of an integer A < M as– AA = AR mod M
• There is a one-to-one correspondence between integers and M-residues for
0 < A < M-1
10HMC VLSI Lab
Montgomery MultiplicatonMontgomery Multiplicaton
• DefineZ = MM(X, Y) = X Y R-1 mod M
• Where R-1 is the inverse of R mod M: R-1R = 1 (mod M)
• Montgomery Mult finds residue of Z = XY mod MZ = X Y R-1 mod M
= (XR) (YR) R-1 mod M
= XYR mod M
= ZR mod M
11HMC VLSI Lab
Montgomery ReductionMontgomery Reduction
Precompute M’ satisfying RR-1 – MM’ = 1
Convert mult and mod to 3 mult and shift
Multiply: Z = X × Y
Reduce: reduce = Z × M’ mod R
Z = [Z + reduce × M] / R
Normalize: if Z ≥ M then Z = Z – M
Why is Z + Reduce × M divisible by R?
Mult
Mult
Mult Shift for R-1
Drop bits
12HMC VLSI Lab
Reduction ProofReduction Proof
[ Z + reduce × M ] mod R= [ Z + (Z × M’ mod R) × M ] mod R= [ Z + Z × M’M ] mod R= [ Z + Z(RR-1 - 1) ] mod R= ZRR-1 mod R= 0 mod R
So Z + reduce × M is divisible by R
13HMC VLSI Lab
More Comments on M’More Comments on M’
• RR-1 – MM’ = 1 – Implies M’ -M-1 mod R– M’ is odd
• M’ is precomputed from M using the extended Euclidian algorithm– M is held constant over many mults
• Only least significant v bits of M’ are needed when computing in radix 2v
– Dusse & Kaliski, Eurocrypt ’90s
14HMC VLSI Lab
CPU Crypto AcceleratorsCPU Crypto Accelerators
• VIA Esther Padlock Hardware Security– Montgomery Multiplier < 0.5 mm2 die area– Accessed by x86 instruction– 256b - 32Kb keys in 128 bit granularity– Also supports AES
• SmartMIPS Smart Card Extensions– RSA, ECC, AES applications– GF(2n) multiply, MAC instructions– Carry propagation for multiword adds– AES permutations and rotations
• Intel LaGrande Technology– Trusted computing
15HMC VLSI Lab
Embedded Crypto AcceleratorsEmbedded Crypto Accelerators
3COM Router 5000 Series Encryption Accelerator
IBM PCI SSL Cryptography Accelerator
16HMC VLSI Lab
Radix 2 AlgorithmRadix 2 Algorithm
• In radix 2, process one bit of X per step– Reduction becomes trivial because M’ mod 2 = 1– Two multiplies and one shift per step
Z = 0for i = 0 to n-1
Z = Z + Xi × Y
reduce = Z0 trivial
Z = Z + reduce × M make Z divisible by 2
Z = Z/2if Z ≥ M then Z = Z – M final Mod M
Z = X × Y
reduce = Z × M’ mod R
Z = [Z + reduce × M] / R
if Z ≥ M then Z = Z – M
17HMC VLSI Lab
Final ModuloFinal Modulo
• Result before last step in range – 0 Z < 2M– Reducing Z-M at the end is a hassle
• Allow 0 X, Y < 2M to avoid reduction– Then if R > 4M, 0 Z < 2M– Hence add two bits to R to avoid
subtraction at end of each step
Walter, Electronic Letters ’99
18HMC VLSI Lab
ConversionConversion
• Conversion of integers to/from Montgomery residues takes one MM operation (if r2 mod M is precomputed and saved):
• Modular exponentiation takes two conversion steps and ~2n multiplication steps.
xMrxrMrxxMMx
MxrMrxrrxMMx
mod 1 mod1)1,(
mod mod),(11
122
19HMC VLSI Lab
Reconfigurable HardwareReconfigurable Hardware
• Building hardwired n-bit unit is limiting– Slow for large n– Not scalable to different n
• Better to design for w-bit words– Break n-bit operand into e w-bit words
• e = n/w
– This is called scalable
• Also handle both GF(p) and GF(2n)– Requires conditionally killing carries– Called unified
20HMC VLSI Lab
Tenca-Koç Montgomery MultiplierTenca-Koç Montgomery Multiplier
Z = 0
for i = 0 to n-1
(Ca, Z0) = Z0 + Xi × Y0
reduce = Z0
(Cb, Z0) = Z0 + reduce × M0
for j = 1 to e
(Ca,Zj) = Zj + Ca + Xi × Yj
(Cb,Zj) = Zj + Cb + reduce × Mj
Zj-1 = (Zj0, Zj-1
w-1:1)
M = (M(e-1), …, M1, M0), Y = (Y(e-1), …, Y1, Y0), Z = (Z(e-1), …, Z1, Z0), X = (Xn-1, …, X1, X0)
Tenca, Koçç, Trans. Computers, 2003
21HMC VLSI Lab
Processing ElementsProcessing Elements
• Keep Z in carry-save redundant form– Tc = 2tAND + 2tCSA + tMUX + tBUF(w) + tREG
3:2C
SA
3:2C
SA
(w)
Cin
Cb
xi
Zw-1:0
Yw-1:0
Mw-1:0
Ca
Cout
Cin
Cout
reset
(w)
Z0
Zw-1
Z0
Zw-1:0
Mw-1:0
Yw-1:0
reduce
22HMC VLSI Lab
ParallelismParallelism
• Two dimensions of parallelism:– Width of processing element w– Number of pipelined PEs p
• Multiply takes k = n/p kernel cycles
FIFO
0YM
Mem
X Mem
PE1 PE2 PE3 PE p
SequenceControl
Result
Z
MY
xKernel
Z’
23HMC VLSI Lab
Pipeline TimingPipeline Timing
Ker
nel
Cyc
le 1
Case I: e > 2p-1e = 4, p = 2
Case II: e < 2p-1e = 4, p = 4
tim
e
spacePE1 PE2
1 x0
x1
x0
x1
x0
x1
x0
x1
x3
x3
x3
x3
x2
x2
x2
x2
2
3
4
5
6
7
8
9
10
11
12
13
Ker
nel
Cyc
le 2
PE1 PE2 PE3 PE4
KernelStall
MYw-1:0Zw-2:-1
MY2w-1:wZ2w-2:w-1
MY3w-1:2wZ3w-2:2w-1
MY4w-1:3wZ4w-2:3w-1
MYw-1:0Zw-2:-1
MY2w-1:wZ2w-2:w-1
MY3w-1:2wZ3w-2:2w-1
MY4w-1:3wZ4w-2:3w-1
MYw-1:0Zw-2:-1
MY2w-1:wZ2w-2:w-1
MY3w-1:2wZ3w-2:2w-1
MY4w-1:3wZ4w-2:3w-1
MYw-1:0Zw-2:-1
MY2w-1:wZ2w-2:w-1
MY3w-1:2wZ3w-2:2w-1
MY4w-1:3wZ4w-2:3w-1
x1
MY5w-1:4wZ5w-2:4w-1
x0
MY5w-1:4wZ5w-2:4w-1
x3
MY5w-1:4wZ5w-2:4w-1
x2
MY5w-1:4wZ5w-2:4w-1
x0
x0
x0
x0
MYw-1:0Zw-2:-1
MY2w-1:wZ2w-2:w-1
MY3w-1:2wZ3w-2:2w-1
MY4w-1:3wZ4w-2:3w-1
x0
MY5w-1:4wZ5w-2:4w-1
MYw-1:0Zw-2:-1
MY2w-1:wZ2w-2:w-1
MY3w-1:2wZ3w-2:2w-1
MY4w-1:3wZ4w-2:3w-1
MY5w-1:4wZ5w-2:4w-1
MYw-1:0Zw-2:-1
MY2w-1:wZ2w-2:w-1
MY3w-1:2wZ3w-2:2w-1
MY4w-1:3wZ4w-2:3w-1
MY5w-1:4wZ5w-2:4w-1
MYw-1:0Zw-2:-1
MY2w-1:wZ2w-2:w-1
MY3w-1:2wZ3w-2:2w-1
MY4w-1:3wZ4w-2:3w-1
MY5w-1:4wZ5w-2:4w-1
x1
x2
x3
x1
x2
x3
x1
x2
x3
x1
x2
x3
x1
x2
x3
x0
x0
x0
x0
MYw-1:0Zw-2:-1
MY2w-1:wZ2w-2:w-1
MY3w-1:2wZ3w-2:2w-1
MY4w-1:3wZ4w-2:3w-1
x0
MY5w-1:4wZ5w-2:4w-1
MYw-1:0Zw-2:-1
MY2w-1:wZ2w-2:w-1
MY3w-1:2wZ3w-2:2w-1
MY4w-1:3wZ4w-2:3w-1
MY5w-1:4wZ5w-2:4w-1
MYw-1:0Zw-2:-1
MY2w-1:wZ2w-2:w-1
MY3w-1:2wZ3w-2:2w-1
MY4w-1:3wZ4w-2:3w-1
MY5w-1:4wZ5w-2:4w-1
MYw-1:0Zw-2:-1
MY2w-1:wZ2w-2:w-1
MY3w-1:2wZ3w-2:2w-1
MY4w-1:3wZ4w-2:3w-1
MY5w-1:4wZ5w-2:4w-1
x1
x2
x3
x1
x2
x3
x1
x2
x3
x1
x2
x3
x1
x2
x3
Ker
nel
Cyc
le 1
Ker
nel
Cyc
le 2
14
15
16
17
18
19
20
24HMC VLSI Lab
QueueQueue
• If full PEs cause stall, queue results
• Convert back to nonredundant form– Saves queue space– CPA needed for final result anyway
Z’ Z
Result
FIFO(0 or more words)
firstcycle
byp
ass
1x0
0100w w
sum
carry CP
A
25HMC VLSI Lab
Improved DesignImproved Design
• Don’t wait two cycles for MSB• Kick off dependent operation right away
on the available bits• Take extra cycle(s) at the end to handle
the extra bits• For p processing elements, cycle count
reduces from 2p to p + (p/w)
Harris, Krishnamurthy, Anders, Mathew, Hsu, Arith 2005.
26HMC VLSI Lab
Improved PEImproved PE
• Left-shift M and Y – Rather than right-shift Z
• Same amount of hardware
3:2C
SA
3:2C
SA
(w)Cin
Cb
xi
reduce
Zw-1:0
Mw-1:0Yw-1:0
M-1
Zw-2:-1
Yw-2:-1
Mw-2:-1
Mw-1
Ca
Cout
Cin
Cout
reset
(w)
Yw-1
Y-1
Z0
27HMC VLSI Lab
Pipeline TimingPipeline Timing
Ker
nel
Cyc
le 1
Case I: e > p+1e = 4, p = 2
Case II: e < p+1e = 4, p = 4
tim
espace
PE1 PE2
1 MYw-1:0Zw-2:-1
x0
MYw-2:-1Zw-3:-2
x1MY2w-1:wZ2w-2:w-1
x0
MY2w-2:w-1Z2w-3:w-2
x1MY3w-1:2wZ3w-2:2w-1
x0
MY3w-2:2w-1Z3w-3:2w-2
x1MY4w-1:3wZ4w-2:3w-1
x0
MY4w-2:3w-1Z4w-3:3w-2
x1
x3
x3
x3
x3
x2
x2
x2
x2
2
3
4
5
6
7
8
9
10
11
12
13
Ker
nel
Cyc
le 2
Ker
nel
Cyc
le 1
PE1 PE2x0
x1x0
x1x0
x1x0
x1
MYw-3:-2Zw-4:-3
x2
MY2w-3:w-2Z2w-4:w-3
x2
MY3w-3:2w-2Z3w-4:2w-3
x2
MY4w-3:3w-2Z4w-4:3w-3
x2
MYw-4:-3Zw-5:-4
x3
MY2w-4:w-3Z2w-5:w-4
x3
MY3w-4:2w-3Z3w-5:2w-4
x3
MY4w-4:3w-3Z4w-5:3w-4
x3
PE3 PE4
Ker
nel
Cyc
le 2 x4
x5x4
x4
x4
x6
x7
Kernel StallMYw-1:0Zw-2:-1
MYw-2:-1Zw-3:-2
MY2w-1:wZ2w-2:w-1
MY2w-2:w-1Z2w-3:w-2
MY3w-1:2wZ3w-2:2w-1
MY3w-2:2w-1Z3w-3:2w-2
MY4w-1:3wZ4w-2:3w-1
MY4w-2:3w-1Z4w-3:3w-2
MYw-1:0Zw-2:-1
MYw-2:-1Zw-3:-2
MY2w-1:wZ2w-2:w-1
MY2w-2:w-1Z2w-3:w-2
MY3w-1:2wZ3w-2:2w-1
MY3w-2:2w-1Z3w-3:2w-2
MY4w-1:3wZ4w-2:3w-1
MY4w-2:3w-1Z4w-3:3w-2
MYw-1:0Zw-2:-1
MYw-2:-1Zw-3:-2
MY2w-1:wZ2w-2:w-1
MY2w-2:w-1Z2w-3:w-2
MY3w-1:2wZ3w-2:2w-1
MY3w-2:2w-1Z3w-3:2w-2
MY4w-1:3wZ4w-2:3w-1
MY4w-2:3w-1Z4w-3:3w-2
MYw-3:-2Zw-4:-3
MY2w-3:w-2Z2w-4:w-3
MY3w-3:2w-2Z3w-4:2w-3
MY4w-3:3w-2Z4w-4:3w-3
MYw-4:-3Zw-5:-4
MY3w-4:2w-3Z3w-5:2w-4
MY4w-4:3w-3Z4w-5:3w-4
MY2w-4:w-3Z2w-5:w-4
x5
x6
x7
x5
x6
x7
x5
x6
x7
MY5w-1:4wZ5w-2:4w-1
x0
MY5w-2:4w-1Z5w-3:4w-2
x1
14
MY5w-1:4wZ5w-2:4w-1
x2
MY5w-2:4w-1Z5w-3:4w-2
x3
x0
MY5w-3:4w-2Z5w-4:4w-3
x2
MY5w-4:4w-3Z5w-5:4w-4
x3
MY5w-1:4wZ5w-2:4w-1
x1MY5w-2:4w-1Z5w-3:4w-2
x4
MY5w-3:4w-2Z5w-4:4w-3
x6
MY5w-4:4w-3Z5w-5:4w-4
x7
MY5w-1:4wZ5w-2:4w-1
MY5w-2:4w-1Z5w-3:4w-2
x5
28HMC VLSI Lab
LatencyLatency
• Tenca-Koç
k(e+1) + 2(p-1) n > 2pw – w k(2p+1) + e - 2 n 2pw – w
• Improved Design
(k+1)(e+1) + p-2 n > pw k(p+1) + 2e - 1 n pw
29HMC VLSI Lab
BreakBreak
30HMC VLSI Lab
BreakBreak
31HMC VLSI Lab
BreakBreak
32HMC VLSI Lab
Very High RadixVery High Radix
• Handle many bits of X at a time– Radix 2v processes v bits of X
• Only f = n/v outer loop iterations needed• k = n/pv kernel cycles with p PEs
– Hardware changes• w bit AND v w bit multiplier• Right shift by v bits after each step
– Use v w so bits are available to shift
• Cycle time gets longer
– Reduce becomes more complicated• Must drive v lsbs to 0
33HMC VLSI Lab
Very High Radix AlgorithmVery High Radix Algorithm
Z = 0
for i = 0 to f-1
Z = Z + Xi × Y reduce = (M’ × Z) mod 2v reduce bottom v bits
Z = Z + reduce × M
Z = Z / 2v
Z = X × Y
reduce = Z × M’ mod R
Z = [Z + reduce × M] / R
34HMC VLSI Lab
Scalable Very High Radix MMScalable Very High Radix MM
Z = 0
for i = 0 to f-1
(CA, Z0) = Z0 + X0 × Y0
reduce = (M’ × Z0) mod 2v only reduce bottom v bits
(CB, Z0) = Z0 + reduce × M0
for j = 1 to e + (v + 1) / w - 1 (CA, Zj) = Zj + CA + Xi × Yj
(CB, Zj) = Zj + CB + reduce × Mj
Zj-1 = (Zjv-1:0, Zj-1
w-1:v)
2 mul, 1 shift
in inner loop
35HMC VLSI Lab
Very High Radix PEVery High Radix PE
Z
*
X
Y
reduce
M
M'
v
v+w0
1*
1 0CA CB
w
w
v
v v
w+1
w w
v+w
w+1
v+w
YMZ to next PE
Y
first
first to next PE
v+w
w w
vv
v
w-vMAC MAC
upper
low
er
v
Kelley, Harris IWSOC 2005Kelley, Harris IWSOC 2005
36HMC VLSI Lab
Pipeline TimingPipeline Timing
Each MAC is given a full cycle
Tc = tMUL(v,w) + tCPA(v+w) + tmux + tREG
Two MAC columns for each PE
Four cycle latency between PEs:
1) Z0 = Xi × Y0
2) reduce = M’ × Z0 mod 2v
3) Z0 = Z0 + reduce × M0
4) Z1 = Z1 + reduce × M1, shift into Z0
Zw-1:0
reduce
Xv-1:0
Yw-1:0
Zw-1:0
Y2w-1:w
Z2w-1:w
Y3w-1:2w
Z3w-1:2w
Y4w-1:3w
Z4w-1:3w
Y 5w-1:4w
Z5w-1:4w
Y6w-1:5w
Z6w-1:5w
Mw-1:0
Zw-1:0
Y2w-1:w
Z2w-1:w
M3w-1:2w
Z3w-1:2w
M4w-1:3w
Z4w-1:3w
M5w-1:4w
Z5w-1:4w
M6w-1:5w
Z6w-1:5w
Zw-1:0
reduce
X 2v-1:v
Yw-1:0
Zw-1:0
Y2w-1:w
Z2w-1:w
Y3w-1:2w
Z3w-1:2w
Y4w-1:3w
Z4w-1:3w
Y5w-1:4w
Z5w-1:4w
Y6w-1:5w
Z6w-1:5w
Mw-1:0
Zw-1:0
M2w-1:w
Z2w-1:w
M3w-1:2w
Z3w-1:2w
M4w-1:3w
Z4w-1:3w
M5w-1:4w
Z5w-1:4w
M6w-1:5w
Z6w-1:5w
Zw-1:0
reduce
Yw-1:0
Zw-1:0
Y2w-1:w
Z2w-1:w
Y3w-1:2w
Z3w-1:2w
Y4w-1:3w
Z4w-1:3w
Y5w-1:4w
Z5w-1:4w
Y6w-1:5w
Z6w-1:5w
Mw-1:0
Zw-1:0
M2w-1:w
Z2w-1:w
M3w-1:2w
Z3w-1:2w
M4w-1:3w
Z4w-1:3w
M5w-1:4w
Z5w-1:4w
M6w-1:5w
Z6w-1:5w
X3v-1:2v
Zw-1:0
reduce
Yw-1:0
Zw-1:0
Y2w-1:w
Z2w-1:w
Y 3w-1:2w
Z3w-1:2w
Y4w-1:3w
Z4w-1:3w
Y5w-1:4w
Z5w-1:4w
Mw-1:0
Zw-1:0
M2w-1:w
Z2w-1:w
M3w-1:2w
Z3w-1:2w
Yw-1:0
Zw-1:0
Ker
nelS
tall
PE 1 PE 2 PE 3
Ke
rnel
Cyc
le1
Ke
rnel
Cyc
le2
X4v-1:3v
X5v-1:4v
… … … … … …
1
Cycle #
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
37HMC VLSI Lab
Very High Radix LatencyVery High Radix Latency
k(e + 3) + 4(p - 1) + 2 n > 4pw – 2w k(4p + 1) + (e - 1) n 4pw – 2w
• Design limited for small n by 4-cycle latency between PEs
38HMC VLSI Lab
Parallel Very High RadixParallel Very High Radix
• Eliminate two of the cycles– Multiplication to compute reduce
• By precomputing M = M’ × M mod R
– Dependency of Z0 on reduce• By prescaling X by 2v so Z0 = 0
• Math proposed by Orup Arith95– But no scalable very high radix HW
~
39HMC VLSI Lab
Improvement 1: Eliminate MultiplyImprovement 1: Eliminate Multiply
Z = 0
for i = 0 to f-1
Z = Z + Xi × Y
Z = Z + Z0 × M M = (M’ mod 2v)M mod R
Z = Z / 2v
M = M’ × M mod R (precompute)
Z = X × Y
Z = [Z + Z × M] / R
Z = X × Y
reduce = Z × M’ mod R
Z = [Z + reduce × M] / R~
~
~
~
40HMC VLSI Lab
Improvement 2: Prescale X by 2Improvement 2: Prescale X by 2vv
Z = 0
for i = 0 to f
Z = Z + 2vXi × Y + Z0 × M
Z = Z / 2v
Z = 0
for i = 0 to f
Z = (Z + Z0 × M) / 2v + Xi × Y
Z = 0
for i = 0 to f-1
Z = Z + Xi × Y
Z = Z + Z0 × M
Z = Z / 2v
~
~
~
Because Z0 is independent of 2vXi
Final result in range 0 Z < 2n+v+1
- avoid final small mod in successive mults by using larger R
One more iteration
41HMC VLSI Lab
Improvement 3: Avoid LSW addImprovement 3: Avoid LSW add
Z = 0
for i = 0 to f
Z = (Z + Z0 × M) / 2v + Xi × Y
Z = 0
for i = 0 to f
reduce = Z0
Z = Z >> v + reduce × M + Xi × Y
~
M + 1M =
~
2v
(Z + Z0 × M) / 2v
= Z >> v + (Z0 × M + Z mod 2v) / 2v
= Z >> v + (Z0 × (M+1)) / 2v
= Z >> v + Z0 × M
~
~
~
M M’M -1 mod 2v
So M + 1 is divisible
~
~
42HMC VLSI Lab
Scalable Parallel Very High RadixScalable Parallel Very High Radix
Z = 0
for i = 0 to f
C = 0
reduce = Z0
for j = 0 to e + v/w (C, Zj) = Zj + C + reduce × Mj
+ Xi × Yj
Zj-1 = (Zjv-1:0, Zj-1
w-1:v)
43HMC VLSI Lab
Parallel Very High Radix PEParallel Very High Radix PE
Kelley, Harris Asilomar 2005Kelley, Harris Asilomar 2005
44HMC VLSI Lab
Pipeline TimingPipeline Timing
Xv-1:0
Yw-1:0
Zw-1:0
Y2w-1:w
Z2w-1:w
Y3w-1:2w
Z3w-1:2w
Y4w-1:3w
Z4w-1:3w
Y5w-1:4w
Z5w-1:4w
Y6w-1:5w
Z6w-1:5w
Yw-1:0
Zw-1:0
Y2w-1:w
Z2w-1:w
Y3w-1:2w
Z3w-1:2w
Y4w-1:3w
Z4w-1:3w
Y5w-1:4w
Z5w-1:4w
Ker
nel S
tall
PE 1 PE 2 PE 3
Ke
rne
l Cyc
le 1
Ke
rne
l Cyc
le 2
X5v-1:4v
… … … …
1
Cycle #
2
3
4
5
6
7
8
9
10
11
12
13
14
15
X2v-1:v
Yw-1:0
Zw-1:0
Y2w-1:w
Z2w-1:w
Y3w-1:2w
Z3w-1:2w
Y4w-1:3w
Z4w-1:3w
Y5w-1:4w
Z5w-1:4w
Y6w-1:5w
Z6w-1:5w
X3v-1:2v
Yw-1:0
Zw-1:0
Z3w-1:2w
Y4w-1:3w
Z4w-1:3w
Y5w-1:4w
Y6w-1:5w
Z6w-1:5w
X4v-1:3v
Yw-1:0
Zw-1:0
Y2w-1:w
Z2w-1:w
Y3w-1:2w
Z3w-1:2w
Y4w-1:3w
Z4w-1:3w
Y5w-1:4w
Z5w-1:4w
Y6w-1:5w
Z6w-1:5w
PE 4
Y2w-1:w
Z2w-1:w
Y3w-1:2w
Z5w-1:4w
X6v-1:5v
Yw-1:0
Zw-1:0
Y2w-1:w
Z2w-1:w
Y3w-1:2w
Z3w-1:2w
X7v-1:6v
Yw-1:0
Zw-1:0
Two cycle latency between PEs:
1) Z0 = Z0 + Xi × Y0 + reduce × M0
2) Z1 = Z1 + Xi × Y1 + reduce × M1,
shift into Z0
Tc = tMUL(v,w) + 2tCSA + tCPA(v+w) + tREG
45HMC VLSI Lab
Parallel Very High Radix LatencyParallel Very High Radix Latency
k(e+1) + e+1 + 2(f mod p) n > 2pw – v k(2p+1) + e+1 + 2(f mod p) n 2pw
– v
46HMC VLSI Lab
Quotient PipeliningQuotient Pipelining
• Reduce depends on previous Z– Pipeline reduce calculation to avoid
reduce being on the critical path– Parallel Very High Radix can be viewed
as 0-stage Quotient Pipeline architecture
47HMC VLSI Lab
00-stage Quotient Pipelining-stage Quotient Pipelining
• Parallel Very High Radix
– reduce × Mj and Xi ×
Yj occurs simultaneously
– Require reduce in non-redundant form
– Solution: Delay reduce × Mj
calculation by d PE’s: d-stage delay Quotient Pipelining
48HMC VLSI Lab
dd-Stage Delay Quotient Pipelining-Stage Delay Quotient Pipelining
• Parallel Design– M = (M’ mod 2v) × M >> v
– reduce produced by PEi is used by PEi+1
• Quotient Pipelining– M = (M’ mod 2v(d+1)) × M >> v(d+1)– Where d is the # of delay stages
– Reduce produced by PEi is used by PEi+1+d
• Parallel: d = 0-Stage Quotient Pipelining
49HMC VLSI Lab
1-Stage Quotient Pipelined Algorithm1-Stage Quotient Pipelined Algorithm
Z = 0 oldreduce = 0for i = 0 to f
reduce = Z0
Z = Z >> v + oldreduce × M + Xi × Y
oldreduce = reduceZ = Z << v + oldreduce
50HMC VLSI Lab
1-Stage Scalable Quotient Pipelining1-Stage Scalable Quotient Pipelining
Z = 0 oldreduce = 0for i = 0 to f
C = 0reduce = Z0
for j = 0 to e (C, Zj) = (Zj
v-1:0, Zj-1w- 1:v) +
oldreduce × Mj + Xj × Yj + Coldreduce = reduce
Z = Z << v + oldreduce
51HMC VLSI Lab
Quotient Pipelined PEQuotient Pipelined PE
Y
first
Z
X
*
3:2
CS
A
3:2
CS
A
3:2
CS
A
3:2
CS
A
Z
C
* OldReduce
Up
pe
rL
ow
er
OldReduce
M M
Y
first
w
v+w
w
w
v
v
w
v+1
v+1
v
v
w-v
w-v
OldReduce*MOldReduce*M
52HMC VLSI Lab
Quotient Pipelined PerformanceQuotient Pipelined Performance
• Tc = tMUL(v,w) + tCSA + tREG
k(e+1) + e+1 + 2(f mod p) for n > 2pw – v k(2p+1) + e+1 + 2(f mod p) for n 2pw – v
k = n’/pve = n’/wf = n’/vn’ = n+2v• Differs from Parallel design:
– Parallel: n’ = n+v– Extra v to account for the extra stage of delay
Y
first
Z
X
*
3:2
CS
A
3:2
CS
A
3:2
CS
A
3:2
CS
A
Z
C
* OldReduce
Up
per
Low
er
OldReduce
M M
Y
first
w
v+w
w
w
v
v
w
v+1
v+1
v
v
w-v
w-v
OldReduce*MOldReduce*M
53HMC VLSI Lab
Comparison of LatenciesComparison of Latencies
• Tenca-Koç Radix 2n2/wp + n/p + 2p – 2 n > 2wp – w 2n + n/p + n/w – 2 n 2wp – w
• Improved Radix 2n2/wp + n/w + n/p + p – 1 n > wpn + n/p + 2n/w – 1 n wp
• Very High Radixn2/wpv + 3n/pv + 4p – 2 n > 4wp – 2w 4n/v + n/pv + n/w - 1 n 4wp – 2w
• Parallel Very High Radixn2/wpv + n/pv + n/w + 1 n > 2wp – v 2n/v + n/pv + n/w + 1 n 2wp – v
54HMC VLSI Lab
Latency vs. # of PEsLatency vs. # of PEs
• Assume w = 16, v = 1 or 16• Let m = wvp be the amount of HW• For small m
– All similar– Cycles m
• For large m– Saturates– High radix
is better10
100
1000
10000
100000
10 100 1000 10000 100000
m = wpv
cycles
tk (256)
tk (1024)
imp (256)
imp(1024)
high(256)
high(1024)
parallel(256)
parallel(1024)
55HMC VLSI Lab
Comparison of Cycle TimesComparison of Cycle Times
• Tenca-Koç / Improved Radix 2Tc = 2tAND + 2tCSA + tMUX + tBUF(w) + tREG
• Very High RadixTc = tMUL(v,w) + tCPA(v+w) + tmux + tREG
• Parallel Very High Radix
Tc = tMUL(v,w) + 2tCSA + tCPA(v+w) + tREG
• Quotient Pipelining
Tc = tMUL(v,w) + tCSA + tREG
56HMC VLSI Lab
Synthesis ResultsSynthesis Results
• Xilinx Virtex II Pro XC2V250-6– ~5n RAM bits needed for X, Y, M, Z, FIFO
Arch Freq (MHz)
LUTs/PE
Regs/PE
16 × 16 Mults/PE
RAM
Improved Radix 2
144 85
69
0 5n
Very High Radix
107 178
218
2 5n
Parallel Very High Radix
107 133
147
2 5n
Quotient
Pipelined
138 238
226
2 5n
57HMC VLSI Lab
Exponentiation TimesExponentiation Times
• On average, 1.5n + 2 Montgomery multiplies are needed for modular exponentiation– Texp = Tc * latency(n, w, v, p) * (1.5n + 2)
58HMC VLSI Lab
Hardware ResultsHardware Results
Arch Freq (MHz) p n Latency (cycles) Texp (ms)
Improved Radix 2
w = 16
144 16 256 303 0.811024 4239 45.3
64 256 291 0.781024 1167 12.5
Very High Radix
w = v = 16
107 4 256 90 0.321024 1086 15.6
16 256 80 0.281024 330 4.74
Parallel Very High Radix
w = v = 16
107 4 256 85 0.311024 1105 15.9
16 256 50 0.181024 325 4.67
Quotient
Pipelined
w = v = 16
138 4 256 95 0.261024 1139 12.7
16 256 53 0.151024 334 3.72
59HMC VLSI Lab
Athena TeraFire 5008Athena TeraFire 5008
• 5.5 ms 1024-bit exponentiation
• 95 Kgates IP block
60HMC VLSI Lab
Software ResultsSoftware Results
• 1024 bit modular exponentiation– 2.4 GHz Pentium 4, FLINT/C library
• 92 ms without Montgomery’s alg• 41 ms with Montgomery’s alg
– 2.4 GHz Pentium 4, GMP library• 25 ms with Karatsuba’s algs
– 80 MHz ARM• 876 ms with Montgomery’s alg
61HMC VLSI Lab
SummarySummary
• Latency (cycles)– Comparable per full adder for all designs when p small– Saturates when p gets too big
• Improved radix 2 design 2x better than T-K
• Very high radix even better (by v/4 or v/2)
• Cycle Time– Worse for very high radix– But only slightly so on FPGAs with efficient multiplier
hardware
• Total Time– Radix 2 best when little HW is available– Radix 216 attractive for FPGAs for minimum latency when
plenty of HW is available
62HMC VLSI Lab
Future WorkFuture Work
• Better pipelining of parallel design
• Radix 2 parallel design
• Radix 4/8 with precomputed multiples
• Karatsuba Algorithm
• Side channel attack countermeasures
• Reconfigurable Logic on CPUs
63HMC VLSI Lab
Pipelining Parallel DesignPipelining Parallel Design
Y
first
Z
X
*
3:2 CS
A
3:2 CS
A
3:2 CS
A
3:2 CS
A
Z
C
Reduce
Upper
Lower
Reduce
M M
Y
first
w
w
w
v
v
w
v+1
v+1
v
v
w-v
w-v
*
Tc = tMUL(v,w) + 2tCSA + tREG
64HMC VLSI Lab
Parallel Radix 2Parallel Radix 2
• Tc = tAND + 2tCSA + tREG
Z = 0
for i = 0 to n
C = 0
reduce = Z0
for j = 0 to e
(C, Zj) = Zj + C + reduce × Mj + Xi × Yj
Zj-1 = (Zj0, Zj-1
w-1:1)
3:2
CS
A
3:2
CS
A
(w)
Cin
xi
reduce
Z
MY
Z
YM
Cout
Cin
Cout
(w)
65HMC VLSI Lab
Radix 4/8 with Precomputed MultiplesRadix 4/8 with Precomputed Multiples
• Todorov & Twalbeh extended T-K to radix 4/8– Precompute multiples of Y, M– Use mux instead of AND / MUL
• Improve latency using right shifts
• Does Booth encoding help?
• Tc = tMUX + 2tCSA + tREG
66HMC VLSI Lab
Karatsuba AlgorithmKaratsuba Algorithm
• “The Karatsuba multiplication arouses our curiosity, since it seems simple, and one could pleasantly occupy a (preferably rainy) Sunday afternoon trying it out.”– M. Welschenbach, Cryptography in C and C++
• A = A12n + A0; B = B12n + B0
• Regular Multiplication (O(n2))– AB = 22nA1B1 + 2n(A0B1 + A1B0) + A0B0
• Karatsuba Multiplication (O(n1.585))– C0 = A0B0; C1 = A1B1; C2 = (A0 + A1)(B0 + B1) – C0 – C1
– AB = 22nC1 + 2nC2 + C0
67HMC VLSI Lab
Side Channel AttacksSide Channel Attacks
• Monitor chip activity to try deducing private key– Timing– Current consumption– Photon emissions
• How vulnerable is very high radix MM to side channel attacks?
• How can it be improved?– CVSL, other differential logic families?– Differential registers– Inherent symmetry of addition & multiplication
68HMC VLSI Lab
Reconfigurable Logic on CPUReconfigurable Logic on CPU
• Add FPGA for dynamically reconfigurable accelerators– ~1000 transistors / 4-input LUT
• Differentiates Intel from competition by unique reconfigurable logic fabric
69HMC VLSI Lab
ApplicationsApplications
• Montgomery Mult – RSA, ECC, Diffie-Hellman Key Exchange
• AES accelerator – symmetric key crypto
• Viterbi decoder • Pattern matching
– Genome BLAST, Google, network security
• DSP accelerators – photoshop filters, video encoding
70HMC VLSI Lab
ExampleExample
Montecito
2 cores 28.5M Tran each
24MB L3$ 1550M Transistors
Alternative
2 cores 20MB L3$
1300M Transistors250 KLUT FPGA
250M Transistors
FPGA
FPGA
71HMC VLSI Lab
Superblock OrganizationSuperblock Organization
• Each contain substantial resources– CLBs, memories, multipliers, etc.
• Chip provides one or more superblock– Accelerators are compiled for one or
more Superblocks– Easy reconfiguration without recompile– “Memory manager” controls how many
can be downloaded at a time
72HMC VLSI Lab
ConclusionsConclusions
• High radix best when multipliers are cheap– Is this a research direction of relevance to
Intel?
• Focus of future research– Low radix improvements– Side channel security– FPGA coprocessor architectures– Other Discussion ?
