SPRUJ17H March 2022 – October 2024 AM2631 , AM2631-Q1 , AM2632 , AM2632-Q1 , AM2634 , AM2634-Q1
The other main operation of the LNME unit is the Modular Montgomery Exponentiation (MMEXP).
This operation computes: Result = XB × R-1 mod N
Where:
The Montgomery parameter R is defined by the operational parameters of the LNME unit (see Table 7-106, PKA LNME Operational Parameters) and the number of bits in the modulus vector. Let nbits be the number of bits needed to represent the N vector. R can then be calculated as follows:
The MMEXP command carries out a sequence of MMM type operations, all storing their results at the Y-operand location. The first operation always squares the X-operand, while the remaining operations multiply the Y-operand with an X-operand that either equals the Y-operand (squaring) or is one of the 'odd powers' of the X-array (multiplying). The number of multiplications and the selection of the X-operand are determined by the bits in the exponent, which are read from PKA RAM between two MMM type operations. To determine whether the next operation is a square or multiply, the exponent bits are parsed bit by bit from MSB-1 down to LSB as explained in Section 7.3.4.4.1.5.3.1, PKA Exponent Re-coding.
When r > (nbits + 1), the X input operand(s) may be up to 2N in value. This restriction on r is always adhered to due to the way that r is calculated.
Figure 7-106 below shows the PKA RAM memory map for the MMEXP operation. The buffer words are needed between the entries of the 'odd powers' table when LNME0_NBASE/LNME1_NBASE[25-16] NYDIGITS + 1 is odd (to re-align the next entry at a 64 bits boundary). The most significant bit of the exponent vector need not be stored as it is by definition a '1' (therefore, the LNME0_BBASE/LNME1_BBASE[30-16] BCNTR register field must be filled with the exponent length in bits minus 2).
The result area of an MMEXP operation must not overlap with any of the input vectors in PKA RAM as it is written and read back during the operation.
When the LNME is directly controlled from the Host (that is, by not making use of Sequencer controlled operations), make sure that the LNME_DATAPATH register is loaded with zeroes (its default state).