# Questions tagged [montgomery-multiplication]

A modular multiplication algorithm invented by Montgomery that allows modular arithmetic to be performed efficiently when the modulus is large (typically several hundred bits).

40 questions
Filter by
Sorted by
Tagged with
159 views

### Why is Montgomery Ladder fast on Montgomery Curves?

When I look at the Montgomery Ladder algorithm, I don't find anything that is specific to the Montgomery curve. We are dealing with the points all the time i.e. we are either adding two points or ...
101 views

### No Final subtraction in Word-level Montgomery Multiplication

I am trying to make an RSA module in VHDL, which in turn will be deployed to an FPGA. I am trying to implement a full Montgomery algorithm which means that I am working with the Montgomery ...
1 vote
75 views

### Is it possible to apply the El Gamal encryption/decryption technique using Edwards curve in Montgomery form

I've been trying to understand the ElGamal encryption/decryption technique. I plan to use it for sending a private message to the server. That is: Alice needs to send $Pm$ (private message encoded via ...
241 views

### Where to apply Montgomery Multiplication in GF(2^n)

I'm optimizing a Reed Solomon decoding library for several polynomials in $\operatorname{GF}(2^k)$, $k\in\{8,10,12\}$. Reading about the Montgomery Multiplication from Çetin K. Koç & Tolga Acar's ...
1 vote
56 views

### Missing Final Step in Montgomery Reduction

I'm following well with using the shifting method to try out the Montgomery reduction (1st round). However, the computed result is actually equal to: $$XYR^{-1} \bmod N$$ while the final goal is to ...
• 61
572 views

### How does Montgomery reduction work?

I want to reduce a multi-precision integer $x$ modulo a prime $p$, very fast. Performing the traditional Euclidean division for only calculating the modulo, is inefficient and modular reduction is at ...
• 898
255 views

### Montgomery Multiplication with CRT

I am attempting to understand how to use Montgomery multiplication in an RSA private key operation: $X \equiv a^{e} \pmod{n}$ where $a$ is the message, $e$ is the exponent, $n$ is the modulus. Using ...
• 123
1 vote
37 views

### Size of messages in timing attack on RSA Montgomery

I'm codin' timing attack on RSA Montgomery which compares two sets ( the first one includes those which need a reduction in contrary to the second one ). But I got troubles with the Montgomery ...
110 views

### Can someone explain the timing attack on RSA with Montgomery multiplication?

I have read several articles on the temporal attack against Montgomery multiplication to speedup RSA computations. However, I do not quite get the principle. I understood that there is a additional ...
1 vote
216 views

### Montgomery Ladder with affin/projective Coordinates

So I'm trying to understand why the montgomery arithmetic is fast and what the montgomery ladder is. With this Post i understood the basic affin arithmetic and Ladder. So this is not really faster ...
• 1,492
112 views

### Attack on Weierstrass Elliptic Curve

I have a naive question(as non specialist in this field). While reading Weierstrass Curve description,I found that it turns into 2 periodic tori on 2D complex plane. Is is it possible to create ...
1 vote
139 views

### Understanding Montgomery's parameterization of elliptic curves

I'm having a bit of trouble understanding the translation of affine coordinates to projective coordinates in Montgomery curve ECM. Would be very thankful if someone could explain it by expanding the ...
• 411
70 views

### GCD in Montgomery arithmetic

Wikipedia article on Montgomery modular multiplication contains the following statement: Many operations of interest modulo $N$ can be expressed equally well in Montgomery form. Addition, ...
179 views

### How to use Montgomery arithmetic for elliptic curves (FIAT cryptography)

Let us consider the source code for curve P-256 from BoringSSL. This source code can be found here. This source code uses the FIAT generated implementation for field arithmetic. This implementation ...
• 317
1 vote
177 views

### Question about using Montgomery form for elliptic curve operations on bls12-381

Since the prime for bls12-381 is not of a form to allow easy modular reduction , is the best approach to use the Montgomery multiplication + reduction algorithm? ...
• 85
44 views

### montgomery reduction multiplicative identity

How do you figure out the multiplicative and additive identity with respects to R? I pick some R such that gcd(R, N) = 1 where N is the size of the group. Given some field element x in the group, I ...
• 1,233
53 views

### Speeding up quotient determination in high-radix montgomery modular multiplication

In this paper Simplifying Quotient Determination in High-Radix Modular Multiplication, the authors have proposed to replace the original modulus $M$ in Montgomery Multiplication $ABR^{-1} \bmod{M}$ to ...
1 vote
127 views

### Montgomery Reduction - Conditions on R

In Montgomery Reduction, we need to compute $z = x y \text{ mod } N$ and the Montgomery Reduction of $x$ is $xR^{-1}$. Why should the choice of $R$ be $2^l$ where $l$ is the length of $N$ to the ...
• 249
763 views

### Questions about the Curve25519-donna implementation

I'm trying to understand the implementation of the following function: Please note questions in comments. ...
• 234
1k views

### Fastest known Elliptic Curve Cryptography "solution" (coordinate systems (multiple?), algorithms, precomputed values etc)?

I am writing an Elliptic Curve Cryptography SDK in pure Swift, and currently I am only using Affine Point and simple Double-and-add. I am soon about to work on a faster solution. I am asking for help ...
• 151
1 vote
212 views

### What scalars produce the wrong values with X25519's montgomery ladder?

This question is a consequence of an older one about multiplying a twisted Etwards point in Montgomery space. Turns out that this is unsafe in some circumstances. The following Montgomery ladder as ...
1k views

### RSA Timing Attack on "Extra" Montgomery Reduction

In "A practical implementation of the timing attack", the authors take advantage of a timing difference that stems from "extra reductions" that occur when multiplying numbers in the Montgomery form. ...
• 353
1 vote
498 views

### Confused about final subtraction of modulus in Montgomery Multiplication, during modular exponentiation

I'm confused about how one might supposedly bypass the final subtraction of the modulus in radix-2 montgomery modular multiplication, when used in a modular exponentiation algorithm. The following two ...
• 161
229 views

### Montgomery modular multiplication – confusion with subtraction of modulus

I'm reading the paper “COMPARISON OF SCALABLE MONTGOMERY MODULAR MULTIPLICATION IMPLEMENTATIONS EMBEDDED IN RECONFIGURABLE HARDWARE” (PDF) on hardware algorithms for montgomery multiplication for ...
• 161
3k views

I do not quite understand what the greatest advantages are of using the Montgomery ladder algorithm for scalar multiplication? Can someone help me out?
• 53
709 views

### What is a u-coordinate within Elliptic Curve Diffie-Hellman using the Montgomery ladder

I am trying to understand the below paragraph. Elliptic curve Diffie-Hellman is often calculated using the Montgomery ladder. This gives a simple and efficient calculation that is naturally ...
• 225
1 vote
576 views

### Montgomery multiplication without final subtraction

I am looking for methods to avoid the final subtraction in Montgomery multiplication. I found this paper "A Cryptographic Library for the Motorola DSP56000 " (http://goo.gl/DHePEx) In this paper they ...
• 1,215
218 views

• 1,228