52 Things: Number 21: How does the CRT method improve performance of RSA?

52 Things: Number 21: How does the CRT method improve performance of RSA?

52件事：第21件：CRT方法如何提高RSA的性能？

 

This is the latest in a series of blog posts to address the list of '52 Things Every PhD Student Should Know' to do Cryptography: a set of questions compiled to give PhD candidates a sense of what they should know by the end of their first year.
这是一系列博客文章中的最新一篇，旨在解决“每个博士生都应该知道的52件事”做密码学：这是一组问题，旨在让博士生在第一年结束时了解他们应该知道什么。

The Chinese Remainder Theorem (CRT) states that if we have two equations:
中国余数定理（CRT）指出，如果我们有两个方程：

x=a(modN) and x=b(modM), then there is a unique solution modulo MN iff gcd(N,M)=1.   
x=a(modN) 和 x=b(modM) ，则存在模MN-iff gcd(N,M)=1 的唯一解。

 

In RSA we must perform a modular exponentiation with respect to a modulus of a thousand or more bits [1]. As a generic remark we could say that public key algorithms are slower compared to symmetric schemes. This characteristic might result to slow web servers-networks and improving efficiency during implementation (software algorithms) plays a crucial role in order to avoid performance problems.
在RSA中，我们必须对一千或更多比特的模进行模幂运算[1]。一般来说，我们可以说公钥算法比对称方案慢。这种特性可能会导致web服务器网络变慢，并且在实现过程中提高效率（软件算法）对于避免性能问题起着至关重要的作用。

 

We denote that the main operation in RSA scheme is the modular exponentiation M=Cd(modN). A modular exponentiation, at an improved state, can be performed using (h - 1) multiplications and (t - 1) squarings (t is the bit length of the exponent and h is the Hamming weight). The number of multiplications and squarings on average is t+t/2−1. 
我们指出RSA方案中的主要运算是模幂 M=Cd(modN) 。在改进的状态下，可以使用（h-1）乘法和（t-1）平方（t是指数的比特长度，h是汉明权重）来执行模幂运算。乘法和平方运算的平均次数为 t+t/2−1 。

 

Further performance improvements can be achieved using binary exponentiation algorithms (e.g. right-to-left exponentiation) or window methods. For the latter we process w bits of the exponent at a time. For this method we still need t squarings but the number of multiplications reduces to t/w on average. Further improvements can be obtained by adopting sliding window methods [t/(w + 1) multiplications on average].  
可以使用二进制取幂算法（例如，从右到左取幂）或窗口方法来实现进一步的性能改进。对于后者，我们一次处理w个指数位。对于这种方法，我们仍然需要t平方，但乘法的数量平均减少到t/w。可以通过采用滑动窗口方法[t/（w+1）次平均乘法]来获得进一步的改进。

 

To make the RSA exponentiation even faster we can perform some additional tricks depending on whether we are performing an encryption operation with the public key or a decryption operation with the private key. The CRT is used in the case of RSA decryption. Thus, we are considering a private key operation which means that we have access to the private key and hence the factorization of the modulus, N=pq. If we suppose we want to decrypt a message, then our goal is to calculate M=Cd(modN).
为了使RSA幂运算更快，我们可以执行一些额外的技巧，这取决于我们是使用公钥执行加密操作还是使用私钥执行解密操作。CRT用于RSA解密的情况。因此，我们正在考虑私钥操作，这意味着我们可以访问私钥，因此可以对模数 N=pq 进行因子分解。如果我们假设要解密消息，那么我们的目标是计算 M=Cd(modN) 。

 

First we will compute M modulo p and M modulo q as follows:
首先，我们将计算M模p和M模q，如下所示：

 

Mp=Cd(modp)=Cd(modp−1)(modp)

Mq=Cd(modq)=Cd(modq−1)(modq)

 

This calculation requires two exponentiations modulo 512-bit moduli and 512-bit exponents because p and q are 512-bit numbers. This is faster than a single exponentiation modulo a 1024-bit number with a 1024-bit exponent.
由于 p 和 q 是512比特数，因此该计算需要模512比特模和512比特指数的两个幂。这比用1024位指数模化1024位数字的单个幂运算更快。

 

Using the CRT we recover M from Mp and Mq as follows: 
使用CRT，我们从 Mp 和 Mq 恢复 M ，如下所示：

 

Compute T=p−1(modq), store it with the private key.
计算 T=p−1(modq) ，用私钥存储。

 

M (the message) can be recovered from Mp and Mq as follows:
M（消息）可以从 Mp 和 Mq 恢复如下：

 

U=(Mq–Mp)T(modq),

M=Mp+up.