How to perform the Multiplicative Inverse Modulo in International Data Encryption Algorithm? I don't understand on how to perform it…

For example, let's say I have a value of cf80 and the value that is appearing to me is this 3080. This is the thing that I've done based on my understanding:

answer = 53120 % 65537  
53120(integer value of 3080) = 3080

When I convert the result in hexadecimal, the value is 3080 but the correct result should be 9194.

  • $\begingroup$ I can't understand your example or your explanation of what you have tried. Do you want to try to edit it, to explain more clearly? $\endgroup$
    – D.W.
    Mar 14, 2013 at 18:26
  • 1
    $\begingroup$ Straighten notations. CF80 in hexadecimal is 53120 in decimal, but not 3080 by any stretch of imagination; that is -3080 modulo 65536, or -3081 modulo 65537; also, 3080 converted to hexadecimal is 0C08, not 3080. In the context you want unsigned numbers, and displaying them as such (in decimal or hexadecimal). Most importantly, the multiplicative inverse of $x$ is $y$ such that $x⋅y=1$ in the multiplicative group $\pmod{65537}$ (with 65536 mapped to the 16-bit value 0x0000), and you make absolutely no step towards computing that $y$ when $x$ is 53120 or hexadecimal CF80, your goal. $\endgroup$
    – fgrieu
    Mar 15, 2013 at 7:37

4 Answers 4


Well, the multiplicative inverse of $a$ is defined to be that value $b$ for which $a \times b = 1$, where $\times$ is the multiplication operation in the field/ring/group in question.

Because we're talking about the group of multiplication modulo 65537, that means that the problem is, given $a$, find $b$ such that $ab \bmod 65537 = 1$.

Now, the % operator is C doesn't do it. The classical way is to use the Extended Euclidean algorithm, where the two inputs to the algorithm is $a$ and $65537$; and have it find a solution to the equation $ax + 65537y = GCD(a, 65537) = 1$; the value $x$ is the multiplicative inverse you're looking for.

Of course, since there are only 65536 possible inverses, another possibility is simply have a table of the 65536 possible inverses, and just do a lookup. In that case, you can use the Extended Euclidean algorithm to build the table.

Oh, and as a reminder; idea interprets the 0000 bit pattern as the value 65536 as far as multiplication is concerned (as the value 0 doesn't have an inverse).

  • $\begingroup$ I can't understand how can I get the value of "9194" in Extended Euclidean Algorithm... $\endgroup$
    – goldroger
    Mar 14, 2013 at 18:55
  • $\begingroup$ @goldroger: if you run the EEA exactly as given on the wiki page, you come up with a value $x=-28269$. If we take this value modulo 65537 (e.g. add 65537 to it), we find it is equivalent to 37268, which is exactly the value you're looking for. $\endgroup$
    – poncho
    Mar 14, 2013 at 19:50

One way to do it is to exponentiate the value you want to invert by $65537-2$. You can do this quickly using the shortest addition chain for powering $65535$ modulo $65537$:

$$ \begin{eqnarray} a_0 &=& {\tt\text{0xcf80}} \\ a_1 &=& a_0 \cdot a_0 \\ a_2 &=& a_1 \cdot a_0 \\ a_3 &=& a_2 \cdot a_2 \\ a_4 &=& a_3 \cdot a_3 \\ a_5 &=& a_4 \cdot a_2 \\ a_6 &=& a_5 \cdot a_5 \\ a_7 &=& a_6 \cdot a_6 \\ a_8 &=& a_7 \cdot a_7 \\ a_9 &=& a_8 \cdot a_8 \\ a_{10} &=& a_9 \cdot a_5 \\ a_{11} &=& a_{10} \cdot a_{10} \\ a_{12} &=& a_{11} \cdot a_{11} \\ a_{13} &=& a_{12} \cdot a_{12} \\ a_{14} &=& a_{13} \cdot a_{13} \\ a_{15} &=& a_{14} \cdot a_{14} \\ a_{16} &=& a_{15} \cdot a_{15} \\ a_{17} &=& a_{16} \cdot a_{16} \\ a_{18} &=& a_{17} \cdot a_{17} \\ a_{19} &=& a_{18} \cdot a_{10} \\ inv &=& {\tt\text{0x9194}} = a_{19}. \end{eqnarray} $$

Beware that depending on how you perform the modular multiplications in IDEA, you may be susceptible to some timing attacks.

  • 2
    $\begingroup$ That solution uses that for $p$ prime and $x\not=0\bmod p$, we can compute $x^{-1}\bmod p$ as $x^{p-2}\bmod p$; and builds the 65535th power by a (non-obvious) addition chain. Of course, operator $⋅$ is multiplication $\pmod{65537}$ (with $65536$ mapped to the 16-bit value 0x0000), as used elsewhere in IDEA. This is useful in the context of preparing a key for decryption in IDEA, for it gives the right result without any test, thus no timing dependency beyond that of $⋅$, which would leak information about the key. $\endgroup$
    – fgrieu
    Mar 15, 2013 at 6:58

You don't need to compute a multiplicative inverse to encrypt or decrypt, in IDEA. All you need is the ability to multiply modulo $2^{16}+1$. See How can I implement the "Multiplication Modulo" and "Addition Modulo" operations in IDEA?

Key generation involves computing a multiplicative inverse. One way to compute the multiplicative inverse is using the extended Euclidean algorithm. Another way is to raise to the power $2^{16}-1$. Either way works.


Below is a small ruby program which calculates the inverse with respect to the IDEA multiplication. The IDEA multiplication is defined on [0..65535] by identifying 0 with 65536 and multiplying mod 65537 (the 4-th Fermat prime). The IDEA-multiplication can be calculated with data-independent timing as you can see below in mult. The addition chain used by Samuel Neves for the exponentiation can be obtained by the factorization 65535 = 3*5*17*257 so that can write it in a double loop (in the outer loop "4.times do |i|" the variable i takes the values 0,1,2,3).

#!/usr/bin/env ruby

def mult(x, y)
  x, y = (x-1) & 0xffff, (y-1)& 0xffff
  z = (x+y+x*y) % 0x10001
  z = (z+1) & 0xffff

def inv(x)
  4.times do |i|
    y = mult(x, x)
    ((1<<i)-1).times do
      y = mult(y, y)
    x = mult(x, y)

puts('0x%x' % inv(0xcf80))

The output of the program is


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.