14th IEEE Symposium on Computer Arithmetic (ARITH 14), Adelaide, Australia, April 1999
1
Efficient VLSI Implementation of Modulo
(
2
n
1
)
Addition and Multiplication
Reto Zimmermann
Swiss Federal Institute of Technology (ETH)
Integrated Systems Laboratory
CH-8092 Z
¨
urich, Switzerland
zimmermann@iis.ee.ethz.ch
Abstract
New VLSI circuit architectures for addition and multi-
plication modulo
(
2
n
?
1
)
and
(
2
n
+
1
)
are proposed that
allow the implementation of highly efficient combinational
and pipelined circuits for modular arithmetic. It is shown
that the parallel-prefix adder architecture is well suited to
realize fast end-around-carry adders used for modulo addi-
tion. Existing modulo multiplier architectures are improved
for higher speed and regularity. These allow the use of
common multiplier speed-up techniques like Wallace-tree
addition and Booth recoding, resulting in the fastest known
modulo multipliers. Finally, a high-performance modulo
multiplier-adder for the IDEA block cipher is presented.
The resulting circuits are compared qualitatively and quan-
titatively, i.e., in a standard-cell technology, with existing
solutions and ordinary integer adders and multipliers.
1. Introduction
Arithmetic modulo
(
2
n
?
1
)
(Mersenne numbers) and
modulo
(
2
n
+
1
)
(Fermat numbers) is used in various ap-
plications, e.g., residue number systems (RNS) [11] and
cryptography [8]. Efficient and fast modulo adders and
multipliers are a prerequisite for corresponding high per-
formance integrated circuits. The main focus in this work
is on modulo
(
2
n
+
1
)
multiplication as used in the IDEA
(International Data Encryption Algorithm) block cipher [8].
As tangential results, modulo
(
2
n
+
1
)
addition and modulo
(
2
n
?
1
)
addition and multiplication are treated as well. The
algorithms for addition are described and compared with
existing solutions in Section 2, while the same is done for
multiplication in Section 3. Section 4 describes the IDEA
modulo multiplier-adder. Experimental results are given in
Section 5.
This work has been funded in part by Ascom Systec AG and in part by
Microswiss, a Microelectronics Program of the Swiss Government.
1.1. Foundations
Binary numbers with
n
bits are denoted as
A
=
a
n
?
1
a
n
?
2
a
0
in the following text, where
A
=
n
?
1
X
i
=
0
2
i
a
i
(1)
Reduction of a number
A
modulo a number
M
(“
A
mod
M
”) can be accomplished by a division (with the remain-
der as result) or by iteratively subtracting the modulus until
A < M
. For the moduli
(
2
n
?
1
)
and
(
2
n
+
1
)
, the mod-
ulo reduction of a number
A
with at most 2
n
bits can be
computed simply by an addition or subtraction. Since
2
n
mod
(
2
n
?
1
) =
2
n
?
(
2
n
?
1
) =
1 (2)
the reduction modulo
(
2
n
?
1
)
can be formulated as
A
mod
(
2
n
?
1
) = (
A
mod 2
n
+
A
div 2
n
)
mod
(
2
n
?
1
)
(3)
where the modulo operation on the right hand side is used
for final correction if the addition yields a result
2
n
?
1
(i.e., 2
n
?
1 has to be subtracted once). Thus, the modulo
(
2
n
?
1
)
reduction is computed by adding the high
n
-bit
word (
A
div 2
n
) to the low
n
-bit word (
A
mod 2
n
) and then
conditionally subtracting 2
n
?
1 [5].
Analogously, since
2
n
mod
(
2
n
+
1
) =
2
n
?
(
2
n
+
1
) =
?
1 (4)
the reduction modulo
(
2
n
+
1
)
can be computed as
A
mod
(
2
n
+
1
) = (
A
mod 2
n
?
A
div 2
n
)
mod
(
2
n
+
1
)
(5)
where the modulo operation on the right hand side is used
for final correction if the subtraction yields a negative result
(i.e., 2
n
+
1 has to be added once). Thus, the modulo
(
2
n
+
1
)
reduction is computed by subtracting the high
n
-
bit word from the low
n
-bit word and then conditionally
adding 2
n
+
1 [5, 13].