For traditional public key cryptography and post-quantum cryptography, such as elliptic curve cryptography and supersingular isogeny key encapsulation, modular multiplication is the most performance-critical operation among basic arithmetic of these cryptographic schemes. For this reason, the execution timing of such cryptographic schemes, which may highly determine that the service availability for low-end microprocessors (e.g., 8-bit AVR, 16-bit MSP430X, and 32-bit ARM Cortex-M), mainly relies on the efficiency of modular multiplication on target embedded processors. In this article, we present new optimal modular multiplication techniques based on the interleaved Montgomery multiplication on 16-bit MSP430X microprocessors, where the multiplication part is performed in a hardware multiplier and the reduction part is performed in a basic arithmetic logic unit (ALU) with the optimal modular multiplication routine, respectively. This two-step approach is effective for the special modulus of NIST curves, SM2 curves, and supersingular isogeny key encapsulation. We further optimized the Montgomery reduction by using techniques for “Montgomery-friendly” prime. This technique significantly reduces the number of partial products. To demonstrate the superiority of the proposed implementation of Montgomery multiplication, we applied the proposed method to the NIST P-256 curve, of which the implementation improves the previous modular multiplication operation by 23.6% on 16-bit MSP430X microprocessors and to the SM2 curve as well (first implementation on 16-bit MSP430X microcontrollers). Moreover, secure countermeasures against timing attack and simple power analysis are also applied to the scalar multiplication of NIST P-256 and SM2 curves, which achieve the 8,582,338 clock cycles (0.53 seconds@16 MHz) and 10,027,086 clock cycles (0.62 seconds@16 MHz), respectively. The proposed Montgomery multiplication is a generic method that can be applied to other cryptographic schemes and microprocessors with minor modifications.

中文翻译：

---

MSP430X 上公钥加密的蒙哥马利乘法

对于传统的公钥密码学和后量子密码学，例如椭圆曲线密码学和超奇异同源密钥封装，模乘是这些密码方案的基本算法中性能最关键的运算。因此，此类密码方案的执行时序可能高度决定低端微处理器（例如，8 位 AVR、16 位 MSP430X 和 32 位 ARM Cortex-M）的服务可用性，主要依赖于关于目标嵌入式处理器的模乘效率。在本文中，我们介绍了基于 16 位 MSP430X 微处理器上的交错蒙哥马利乘法的新的最优模乘技术，其中乘法部分在硬件乘法器中执行，减法部分分别在具有最佳模乘例程的基本算术逻辑单元（ALU）中执行。这种两步法对 NIST 曲线、SM2 曲线和超奇异同源密钥封装的特殊模量有效。我们通过使用“蒙哥马利友好”素数技术进一步优化了蒙哥马利减少。这种技术显着减少了部分产品的数量。为了证明所提出的蒙哥马利乘法实现的优越性，我们将所提出的方法应用于 NIST P-256 曲线，该实现将先前的模乘运算提高了 23。在 16 位 MSP430X 微处理器和 SM2 曲线上为 6%（在 16 位 MSP430X 微控制器上首次实现）。此外，针对时序攻击的安全对策和简单的功率分析也应用于 NIST P-256 和 SM2 曲线的标量乘法，实现了 8,582,338 个时钟周期（0.53 秒@16 MHz）和 10,027,086 个时钟周期（0.62 秒@16 MHz） ）， 分别。所提出的蒙哥马利乘法是一种通用方法，只需稍作修改即可应用于其他密码方案和微处理器。