Prime Numbers

9.2 Enhancements to modular arithmetic 449
Algorithm 9.2.5 (Montgomery product). This algorithm returns M(c, d)
for integers 0 ≤ c, d < N, with N odd, and R =2 s >N.
1. [Montgomery mod function M]
M(c, d) {
x = cd;
z = y/R; // From Theorem 9.2.1.
2. [Adjust result]
if(z ≥ N) z = z − N;
return z;
}
The [Adjust result] step in this algorithm always works because cd < RN by
hypothesis. The only importance of the choice that R beapoweroftwois
that fast arithmetic may be employed in the evaluation of z = y/R.
Algorithm 9.2.6 (Montgomery powering). This algorithm returns
x y mod N, for0 ≤ x0, andR chosen as in Algorithm 9.2.5. We
denote by (y0,...,yD−1) the binary bits of y.
1. [Initialize]
x =(xR) modN; // Via some divide/mod method.
p = R mod N; // Via some divide/mod method.
2. [Power ladder]
for(D − 1 ≥ j ≥ 0) {
p = M(p, p); // Via Algorithm 9.2.5.
if(yj == 1) p = M(p, x);
} // Now p is x y .
3. [Final extraction of power]
return M(p, 1);
Later in this chapter we shall have more to say about general power ladders;
the ladder here is exhibited primarily to show how one may call the M()
function to advantage.
The speed enhancements of an eventual powering routine all center on the
M() function, in particular on the computation of z = y/R. Wehavenoted
that to get z, two multiplies are required, as in equation (9.7). But the story
does not end here; in fact, the complexity of the Montgomery mod operation
can be brought (asymptotically, large N) down to that of one size-N multiply.
(To state it another way, the composite operation M(x ∗ y) asymptotically
requires two size-N multiplies, which can be thought of as one for the “∗”
operation.) The details of the optimizations are intricate, involving various
manifestations of the inner multiply loops of the M() function [Koç etal.
1996], [Bosselaers et al. 1994]. But these details stem at least in part from
a wasted operation in equation (9.7): The right-shifting effectively destroys
some of the bits generated by the two multiplies. We shall see this shifting
phenomenon again in the next section. In actual program implementations
of Montgomery’s scheme, one can assign a word-size base B =2 b ,sothat