Short-Iteration Constant-Time GCD and Modular Inversion

Abstract

Even theoretically secure cryptosystems, digital signatures, etc. may not be secure after being implemented on the Internet of Things (IoT) devices and PCs because of Side-Channel Attack ($\text{ SCA }$). Since RSA key generation and ECDSA need $\text{ GCD }$ computations or modular inversions, which are often computed by Binary Euclidean Algorithm ($\text{ BEA }$) or Binary Extended Euclidean Algorithm ($\text{ BEEA }$), the $\text{ SCA }$ weakness of $\text{ BEA }$ and $\text{ BEEA }$ becomes serious. For countermeasures, the Constant-Time GCD (CT-$\text{ GCD }$) and Constant-Time Modular Inversion ($\text{ CTMI }$) algorithms are good choices. Modular inversion based on Fermat’s Little Theorem ($\text{ FLT }$) can work in constant time but it is not efficient for general inputs. Two $\text{ CTMI }$ algorithms, named $\text{ BOS }$ and $\text{ BY }$ in this paper, are proposed by Joppe W. Bos and Bernstein, Yang respectively, which are based on the idea of $\text{ BEA }$. However, $\text{ BOS }$ has complicated computations during one iteration and $\text{ BY }$ uses more iterations. Small number of iterations and simple computations during one iteration are good characteristics of a constant-time algorithm. Based on this view, this paper proposes new short-iteration CT-$\text{ GCD }$ and $\text{ CTMI }$ algorithms over ${\mathbb F}_{p}$ borrowing a simple idea of $\text{ BEA }$. Our algorithms are evaluated from the theoretical point of view. Compared with $\text{ BOS }$, $\text{ BY }$ and the improved version of $\text{ BY }$, our short-iteration algorithms are experimentally demonstrated to be faster than theirs.