https://orcid.org/0000-0001-6490-5413
Figures
Abstract
This paper introduces a hardware architecture designed for constant-time modular inversion over prime fields, a critical function in Elliptic Curve Cryptography (ECC). We use Kaliski’s Almost Inversion Algorithm to develop an efficient FPGA-based solution. The proposed design guarantees constant-time execution, optimizing modular inverse computations for ECC applications. When synthesized on a Xilinx Kintex-7 FPGA, the accelerator reaches a frequency of 222.9 MHz, occupying 1.7k Slices without using any DSP blocks. This work focuses on improving the speed and resource usage of modular inversion units, specifically for resource-constrained digital environments.
Citation: Nguyen K, Nguyen T, Nguyen H, Tran L (2026) Constant-time hardware implementation of Modular Inversion with Kaliski’s Algorithm for ECC. PLoS One 21(7): e0354145. https://doi.org/10.1371/journal.pone.0354145
Editor: Muhammad E. S. Elrabaa, King Fahd University of Petroleum & Minerals, SAUDI ARABIA
Received: February 3, 2026; Accepted: July 5, 2026; Published: July 28, 2026
Copyright: © 2026 Nguyen et al. This is an open access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited.
Data Availability: All relevant data are within the manuscript and its Supporting Information files.
Funding: The author(s) received no specific funding for this work.
Competing interests: The authors have declared that no competing interests exist.
1. Introduction
Safeguarding digital infrastructure relies heavily on cryptography, which underlies major security protocols like TLS [1] and SSH [2]. Since its introduction by Koblitz and Miller in 1985 [3], Elliptic Curve Cryptography (ECC) has become a dominant public-key method, favored over RSA for its superior per-bit security [4]. This efficiency has established ECC as a NIST-endorsed standard for information security [5]. Within the ECC framework, modular inversion is a fundamental yet computationally expensive operation, consuming significant time and hardware resources. Consequently, developing high-performance architectures for modular inversion remains a critical research objective.
ECC operations are typically conducted over two primary Galois fields: prime fields GF(p) and binary fields GF() [3,6,7]. While both offer comparable security, GF(
) often allows for faster hardware arithmetic due to simplified carry-free operations. However, GF(
) lacks flexibility when field parameters change [8]. Modular inversion, essential for these systems, has roots in the Euclidean algorithm for finding the Greatest Common Divisor (GCD) [9]. Stein’s algorithm later improved this by replacing division with shifts and subtractions [10]. The Binary Extended Euclidean Algorithm (bEEA), an extension of Stein’s work [11], is widely used for computing inverses where
. While Fermat’s Little Theorem is another option, bEEA is generally more efficient for large numbers [12], as it avoids complex multi-precision divisions [13]. Kaliski’s method [14] further optimizes bEEA by reducing additions and subtractions, though it requires a final correction step since it computes the inverse for the Montgomery domain.
Previous research by Lee [15], Ghosh [4], and Hossain [12] has explored efficient FPGA architectures for modular inversion, often employing optimized binary inversion algorithms. Other notable FPGA implementations include works by [16–18], the scalable Montgomery-inversion design of Murat et al. [19], and the modular inversion/division architecture of Mrabet et al. [20]. Dong et al. [8] further improved binary algorithms, while Deshpande et al. [13] adopted a Fast Constant-Time GCD approach. More recent efforts have specifically targeted the trade-off between performance and side-channel resistance: Sghaier et al. [21] proposed a modified binary extended Euclidean inverter (MBEEA) resistant to simple power analysis, Li [22] introduced a high-radix (radix-8) modular inversion algorithm to reduce the iteration count, Ji et al. [23] presented constant-time integer and Montgomery inversion accelerators (CT-IMI and CT-CMMI), and constant-time inversion has been integrated into complete ECC datapaths in recent FPGA processors [24,25]. These works confirm that constant-time modular inversion remains an active research target, but they also highlight a persistent tension between throughput, area, and the guarantee of operand-independent execution.
In this paper, a constant-time modular inversion design based on Kaliski’s almost-inverse algorithm is proposed. The contributions of this work are threefold:
- We refine the constant-time Kaliski variant of Savas et al. [26] by folding the post-inversion normalization into a single comparison-and-subtraction correction stage, which removes the data-dependent second halving loop and the extra correction multiplication used in the classical two-phase Montgomery inverse, while preserving a fixed 2n + 1-iteration latency.
- We build the 256-bit datapath from two pipelined Brent-Kung parallel-prefix adders and quantify, rather than merely assert, why this network is preferable to the Kogge-Stone alternative for an area- and timing-constrained inverter.
- We provide a compact finite-state controller and a complete Kintex-7 evaluation, comparing area-time (
) product and throughput against both classical and recent (2021–2026) designs.
We concentrate on algorithm optimization and improved arithmetic architectures for ECC modular inversion on hardware.
The paper is organized as follows: Section 2 provides the mathematical foundation for ECC and modular inversion. Section 3 details our proposed hardware architecture. Experimental results and comparisons with existing literature are discussed in Section 4, followed by concluding remarks in Section 5.
2. Preliminaries
2.1. Elliptic curve cryptography
Due to its efficiency and smaller key sizes, ECC has gained widespread adoption. While usable over both and
, this study focuses on affine coordinates within prime fields
. An elliptic curve E over
is defined by Equation 1, where a,b satisfy
.
For points P(x1,y1) and Q(x2,y2) in affine coordinates, the point addition R = P + Q is governed by Equation 2 [27]. Similarly, point doubling R = 2P is described in Equation 3. Both operations heavily rely on modular inversion, making it the primary computational bottleneck.
2.2. Coordinate system
ECC points can be represented in multiple coordinate systems, with affine and projective being the most common. Affine coordinates use a pair (x, y), but group operations like addition and doubling require costly modular inversions. Projective coordinates (X, Y, Z) mitigate this by deferring inversion, yet conversion back to affine coordinates still necessitates one modular inversion per scalar multiplication [27]. Even reduced to a single occurrence, this inversion remains important for two reasons. First, it sits on the critical path of every scalar multiplication and is the single most expensive field operation, so its latency directly bounds the achievable throughput. Second, and more importantly for security, this final inversion operates on secret-dependent data; if it is implemented with a variable-time algorithm, its execution time leaks information about the scalar and is exploitable by timing and simple-power analysis. A constant-time, area-efficient inverter is therefore valuable even in a projective-coordinate processor, and is the focus of this work.
2.3 Modular Inversion
For a prime field , the modular inverse of
is the unique
satisfying
. Because p is prime, every non-zero a is automatically coprime to p, so this inverse always exists. Modular inversion is the most expensive field operation in affine-coordinate ECC, which motivates a dedicated hardware unit.
Algorithm 1 states the constant-time inverter used in this work. It operates on four n-bit registers: u and v hold the running operands (initialized to p and a), while r and s accumulate the inverse (initialized to 0 and 1). The loop counter k drives the fixed schedule through the termination predicate , and
with its complement
separate the inversion phase from the final correction. The remaining predicates
test the parity of u and v and the comparisons u vs. v and r vs. p; they are mutually exclusive, so exactly one update branch is taken each cycle. Each bracketed line
lists the register updates performed when that predicate combination holds, where
and
denote the two adder outputs.
Algorithm 1 Constant-Time Algorithm Based on Kaliski’s Method
Input: and p is prime.
Output: where
(mod p)
1: and
2:
3:
4: while do
5: is even),
and (v is even))
and
and (v is even)),
and
and
),
,
6: [ and
]:
7: [ and
]:
8: [ and
]:
9: [ and
]:
10: [ and
]:
11: [ and
]:
12:
13:
14: end while
15: if r > 0 then
16: return
17: end if
18: return:
2.3.1. Kaliski’s almost inverse and the proposed modification.
Kaliski’s algorithm [14] computes the modular inverse in two conceptual phases. Let . The first phase, the almost Montgomery inverse, repeatedly applies binary (shift-and-subtract) reductions to the working pair (u,v), accumulating the result in (r,s). It terminates with a pair (r,k) such that
The exponent k is the number of reduction steps and therefore depends on the magnitude of a. A classical second phase then performs (or, depending on the target domain,
) conditional modular halvings to strip the residual
factor and return the normalized inverse [26]. Because both the first-phase loop bound and the second-phase halving count are functions of k, a direct implementation leaks operand-dependent timing, which is exploitable through simple power or timing analysis.
To remove this leakage, Savas et al. [26] fixed the iteration count to exactly 2n and guarded every register update with a set of mutually exclusive predicates , so that the same arithmetic is executed on every cycle regardless of the operand. Our work uses this constant-time variant but modifies its normalization. Instead of appending a separate, variable-length second phase, we fold the correction into the fixed-length schedule: once v = 0 (predicate
), the two branches
and
of Algorithm 1 keep r within the field by conditionally adding the modulus, and a single closing adjustment (lines 15–18) returns either
or
to map the result into
. This eliminates the data-dependent halving loop and the additional correction multiplication of the two-phase formulation, so the unit completes in a constant 2n + 1 iterations while remaining fully constant-time. This single-comparison final stage is the optimization referred to in Algorithm 1.
As a consequence of the fixed schedule, Algorithm 1 returns
where the adjuster M is a fixed power of two fixed by the iteration count alone and is independent of a. Because M is a known constant, it is canceled by pre-scaling the input with a single Montgomery multiplication by the precomputed value (with
) on the Montgomery multiplier already present in the ECC datapath. The complete data flow is therefore
This algorithm executes in exactly 2n + 1 iterations, offering superior efficiency over the constant-time binary extended Euclidean algorithm (CBEEA), which requires a longer schedule for the same field size.
3. Hardware Implementation of Modular Inversion Over GF(p)
The overall block diagram of the Modular Inversion Unit is presented in Fig 1. To implement the inversion calculation process, we have two Brent-Kung adders in this design to calculate and
in each iteration of the inversion algorithm.
The inversion control unit wires the control signals to the two Brent-Kung adders, analogously to the multiplication control unit. On each cycle it evaluates the predicates of the active algorithm stage (Section 2.3.1) and drives the output control signals that select which register-update branch is executed. In Fig 1, the signals u_cal, v_cal, r_cal and s_cal denote the next-state (temporary) values of the registers u, v, r and s produced combinationally by the adders and multiplexers; they are written back into the corresponding registers at the next clock edge. The two adder outputs themselves are labeled and
, matching the notation of Algorithm 1.
Lines 15–18 in 1 are added as the final correction stage of the modified Kaliski algorithm. Since Kaliski’s almost inversion method produces an intermediate value rather than a directly normalized modular inverse, the output must be adjusted before it can be used in the ECC datapath. The added correction checks the final value of r and maps it back into the valid prime-field range by returning either (2p - r) or (p – r). This step ensures that the final result is represented as a positive modular value within the field. In hardware, this correction is simple to implement because it only requires a comparison and subtraction after the fixed iteration loop, avoiding any extra variable-length operation. Therefore, the added lines improve the correctness of the output while preserving the constant-time behavior of the modular inversion unit.
We use the two multiplexers for and
to selectively insert the inputs to each Brent-Kung adder in each iteration. The sel signals and start _ delta with start _ sigma is controlled by the inv _ control unit.
The finite state diagram designed for the inversion controller unit and each state condition is briefly present as in Fig 2. The state description for each state in the inversion control unit is listed respectively in the Table 1.
Fig 2 shows the finite-state machine that controls the proposed Kaliski-based modular inversion architecture, and Fig 3 gives the equivalent algorithmic flow chart of the inversion control. The operation begins in the IDLE state, where the circuit waits for the start_inv signal. Once inversion is triggered, the FSM moves to the LOAD state to initialize the operands and internal registers (,
,
,
), then enters the CHECK state to evaluate the iteration condition
. While the iteration limit has not been reached, control passes to the SPLIT state, which selects one of the processing states P1–P6 according to the mutually exclusive predicates, i.e., the parity of u and v, the comparison of u and v, and, once v = 0, the comparison of r with the modulus p. Each processing state corresponds to exactly one bracketed update line of Algorithm 1; the MERGE state then writes the updated registers back, increments k, and returns control to CHECK for the next of the 2n iterations. When the loop finishes, the FSM enters the DONE state, which applies the final correction (
or
) and asserts the done signal to indicate that the modular inverse is ready. This split/merge structure, shown in Fig 2, executes the algorithm as a repeated sequence of register updates suitable for RTL implementation.
3.1. Parallel-prefix adder selection
The modular inversion unit relies on repeated 256-bit addition and subtraction, which the FPGA fabric does not provide as a single low-latency primitive at this width. We therefore implement the two operands and
with parallel-prefix adders (PPAs), which expose a regular, pipelinable carry tree. The Kogge-Stone adder (KSA) and the Brent-Kung adder (BKA) are the two canonical PPA topologies [28]; they compute the same carries but trade logic depth against the number of prefix operators and routing. For an n-bit operand, the KSA reaches the minimum carry-tree depth of
but instantiates on the order of
prefix cells with a densely interconnected, long-wire network. The BKA uses a deeper carry tree of
levels but only about
prefix cells arranged in a regular, locally connected layout. Table 2 summarizes these properties for the general n-bit case and for the n = 256 operands used here.
For this inverter the choice is governed by area and routability rather than by the latency of a single addition. Each of the 2n + 1 iterations issues two 256-bit add/subtract operations, so the adder is replicated and exercised on every cycle; minimizing its cell count and wiring therefore has a larger impact on overall area and achievable clock frequency than shaving one or two prefix levels. The BKA’s roughly lower cell count and sparse, regular routing let us split it into a 2-stage pipeline and close timing at 222.9 MHz on the Kintex-7 without DSP blocks, whereas a 256-bit KSA’s routing congestion would inflate area and degrade the attainable frequency. This is consistent with the comparative measurements of [29], which report lower area, delay, and power for the BKA at large word lengths, and with the regular-layout argument of [28]. In short, the BKA performs n-bit addition in
time with area on the order of O(n), making it the better-matched choice for an area- and timing-constrained constant-time inverter.
The structure of the Brent-Kung adder is designed as a 2-stage pipelined PPA, which provides fast calculations of 256-bit numbers. The BKA provides a solution for our AU core as a faster and more efficient addition with an easy structure for pipelining. Fig 4 presents the structure of a n-bit BKA.
4. Result implementation
We simulate and synthesize our design on Xilinx Vivado 23.1, FPGA Platform Kintex-7. The design occupies 1.7k Slices, has no DSP usage, and runs at 222.9 MHz. Our design completed a single modular inversion in 1033 clock cycles. This clock cycle latency means that for a 256-bit prime, we use approximately 2 clocks per Kaliski’s algorithm iteration per bit and do it twice to achieve the final result. Our proposed design’s total latency for one modular inversion is calculated as in Equation 7. The throughput of our design is calculated as in Equation 8.
Table 3 compares the proposed architecture against recent related designs with a similar 256-bit structure. Because the surveyed works target different FPGA families and report their cost in different units, a common area measure is needed before they can be compared. Where a design reports look-up tables (LUTs) and flip-flops (FFs) rather than slices, we estimate its slice count using the standard Xilinx slice rule, in which one slice comprises four LUTs and eight FFs; the LUT count dominates this estimate for every surveyed inverter, so we take as the equivalent slice count. Designs that report slices directly are used as published, and the proposed design itself uses no DSP blocks.
This common slice measure enables an Area-Time () product comparison across different designs, where the area (A) is the total number of slices and the time (T) is the total inversion latency
from Equation 7. Equation 9 shows how the
product is calculated; the resulting values are reported in k-slice
s.
Fig 5 plots the product of every design and Fig 6 the corresponding throughput. The proposed inverter occupies a middle position in both rankings: it improves substantially on the constant-time GCD inverter of Deshpande et al. [13], but the compact recent designs reach a lower
and the high-frequency Virtex-7 inverters reach a higher throughput. The proposed design therefore does not claim a best-in-class
or throughput; its aim is a constant-time, DSP-free inverter whose cost remains competitive with these works, as discussed below.
A × T product comparison with related works (Lower is better).
The comparison in Table 3 spans several FPGA families and process nodes, from 65 nm Virtex-5–20 nm UltraScale, so the figures should be read as indicative rather than exact: part of the spread reflects fabric and synthesis-tool differences as much as architecture. Within this set the proposed inverter is mid-ranked. The designs that achieve a lower
are of two kinds: the recent Virtex-7 accelerators of Sghaier et al. [21] and Ji et al. [23], which reach very low latency on a comparable 28 nm-class fabric, and the small Murat et al. [19] and Mrabet et al. [20] inverters, which trade throughput for a very small footprint. The proposed design is neither the smallest nor the fastest, but it pairs a fully constant-time (operand-independent) schedule with a DSP-free datapath, obtained through the algorithmic normalization of Section 2.3.1 rather than through raw resource minimization.
A per-design comparison clarifies these trade-offs. On a comparable 28 nm-class fabric, Sghaier et al.’s MBEEA [21] is about 4.1× faster and 3.4× more area-time efficient than our design, but uses about 1.2× more slices and follows a different binary extended Euclidean formulation. The two Ji et al. accelerators [23] are likewise constant-time and more compact: CT-IMI is about 1.8× faster with a 2.9× better , and the Montgomery-domain CT-CMMI about 1.9× faster with a 4.8× better
, although both figures rest on slice counts we estimated from their reported LUTs. Hossain and Kong’s inverter [12] is about 2.0× faster with a 2.3× better
and a slightly smaller area, but it does not provide a constant-time guarantee. Among the smaller designs, the Murat et al. [19] and Mrabet et al. [20] inverters reach a 1.3–1.7× better
with much smaller footprints but at 1.7–4.8× higher latency, whereas the Deshpande et al. GCD inverter [13] is about 10× slower and 5.5× less area-time efficient. The proposed design is thus not the most compact or the fastest inverter, but it delivers a constant-time, DSP-free implementation whose area-time cost stays within a small factor of the best published designs while improving substantially on the GCD-based and older binary inverters.
5. Conclusion
We have proposed a compact and efficient FPGA implementation of a constant-time modular inversion unit based on Kaliski’s algorithm. By using a Brent-Kung adder and a lightweight control unit, our design achieves 55.3 Mbps throughput. On a Kintex-7 FPGA, it operates at 222.9 MHz using only 1.7k slices and zero DSPs. This demonstrates a viable balance of performance and area for cryptographic applications. Future work will focus on reducing latency to single-cycle operations per bit and integrating this module into larger RISC-V or NoC-based cryptographic systems.
Acknowledgments
We acknowledge Ho Chi Minh City University of Technology (HCMUT), VNU-HCM for supporting this study.
References
- 1. Turner S. Transport Layer Security. IEEE Internet Computing. 2014;18(6):60–3.
- 2.
Ylonen T. RFC 4251: The Secure Shell (SSH) Protocol Architecture. 2006.
- 3. Koblitz N, Menezes A, Vanstone S. The state of elliptic curve cryptography. Designs, Codes and Cryptography. 2000;19:173–93.
- 4. Ghosh S, Mukhopadhyay D, Roychowdhury D. Petrel: Power and Timing Attack Resistant Elliptic Curve Scalar Multiplier Based on Programmable GF(p) Arithmetic Unit. IEEE Trans Circuits Syst I. 2011;58(8):1798–812.
- 5.
Toolkit C. Updated digital signature standard approved as federal information processing standard (FIPS) 186-3. National Institute of Standards and Technology (NIST). 2009.
- 6.
Suwen Yi, Wei Li, Zibin Dai. A scalable and efficient hardware architecture for Montgomery modular division in dual field. In: 2016 10th IEEE International Conference on Anti-counterfeiting, Security, and Identification (ASID), 2016. 34–8. https://doi.org/10.1109/icasid.2016.7873892
- 7. Liu Z, Liu D, Zou X. An Efficient and Flexible Hardware Implementation of the Dual-Field Elliptic Curve Cryptographic Processor. IEEE Trans Ind Electron. 2017;64(3):2353–62.
- 8.
Dong X, Zhang L, Gao X. An Efficient FPGA Implementation of ECC Modular Inversion over F256. In: Proceedings of the 2nd International Conference on Cryptography, Security and Privacy, 2018. 29–33. https://doi.org/10.1145/3199478.3199491
- 9.
Heath T, Little. The thirteen books of Euclid’s elements. Courier Corporation. 1956.
- 10. Stein J. Computational problems associated with Racah algebra. Journal of Computational Physics. 1967;1(3):397–405.
- 11.
Knuth DE. The Art of Computer Programming. Pearson Education. 1997.
- 12.
Hossain MS, Kong Y. High-Performance FPGA Implementation of Modular Inversion over F_256 for Elliptic Curve Cryptography. In: 2015 IEEE International Conference on Data Science and Data Intensive Systems, 2015. 169–74. https://doi.org/10.1109/dsdis.2015.47
- 13.
Deshpande S, Del Pozo SM, Mateu V, Manzano M, Aaraj N, Szefer J. Modular Inverse for Integers using Fast Constant Time GCD Algorithm and its Applications. In: 2021 31st International Conference on Field-Programmable Logic and Applications (FPL), 2021. 122–9.
- 14. Kaliski BS. The Montgomery inverse and its applications. IEEE Trans Comput. 1995;44(8):1064–5.
- 15. Lee J-W, Chung S-C, Chang H-C, Lee C-Y. Efficient power-analysis-resistant dual-field elliptic curve cryptographic processor using heterogeneous dual-processing-element architecture. IEEE Transactions on Very Large Scale Integration (VLSI) Systems. 2013;22(1):49–61.
- 16.
Vliegen J, Mentens N, Genoe J, Braeken A, Kubera S, Touhafi A, et al. A compact FPGA-based architecture for elliptic curve cryptography over prime fields. In: ASAP 2010 - 21st IEEE International Conference on Application-specific Systems, Architectures and Processors, 2010. 313–6. https://doi.org/10.1109/asap.2010.5540977
- 17. McIvor CJ, McLoone M, McCanny JV. Hardware elliptic curve cryptographic processor over rm GF (p). IEEE Transactions on Circuits and Systems I: Regular Papers. 2006;53(9):1946–57.
- 18. Daly A, Marnane W, Kerins T, Popovici E. An FPGA implementation of a GF(p) ALU for encryption processors. Microprocessors and Microsystems. 2004;28(5–6):253–60.
- 19.
Murat E, Kardaş S, Savaş E. Scalable and Efficient FPGA Implementation of Montgomery Inversion. In: Proceedings of the 2011 Workshop on Lightweight Security and Privacy: Devices, Protocols, and Applications, 2011. 61–8.
- 20.
Mrabet A, El-Mrabet N, Bouallegue B, Mesnager S, Machhout M. An efficient and scalable modular inversion/division for public key cryptosystems. In: 2017 International Conference on Engineering & MIS (ICEMIS), 2017. 1–6. https://doi.org/10.1109/icemis.2017.8272995
- 21. Sghaier A, Zeghid M, Massoud C, Ahmed HY, Chehri A, Machhout M. Fast Constant-Time Modular Inversion over Fp Resistant to Simple Power Analysis Attacks for IoT Applications. Sensors (Basel). 2022;22(7):2535. pmid:35408148
- 22. Li Y. Area–Time-Efficient High-Radix Modular Inversion Algorithm and Hardware Implementation for ECC over Prime Fields. Computers. 2024;13(10):265.
- 23. Ji X, Chen C, Yang G, Zhou H, Xiong H, Ben X, et al. High-Performance Accelerator for Constant-Time Cross-Domain Integer and Montgomery Inversion on FPGA. ACM Trans Embed Comput Syst. 2026;25(1):1–26.
- 24. Wang D, Lin Y, Hu J, Zhang C, Zhong Q. FPGA Implementation for Elliptic Curve Cryptography Algorithm and Circuit with High Efficiency and Low Delay for IoT Applications. Micromachines (Basel). 2023;14(5):1037. pmid:37241660
- 25. Hossain MR, Rahman MS, Zaman KS, Fezzani WE, Bhuiyan MAS, Kang CC, et al. Low latency FPGA implementation of twisted Edward curve cryptography hardware accelerator over prime field. Sci Rep. 2025;15(1):15097. pmid:40301462
- 26. Savas E, Koç CK. The Montgomery modular inverse-revisited. IEEE Transactions on Computers. 2000;49(7):763–6.
- 27.
Hankerson M. Guide to elliptic curve cryptography. Guide to Elliptic Curve Cryptography. Vanstone. 2004.
- 28.
Rogawski M, Homsirikamol E, Gaj K. A novel modular adder for one thousand bits and more using fast carry chains of modern FPGAs. In: 2014 24th International Conference on Field Programmable Logic and Applications (FPL), 2014. 1–8. https://doi.org/10.1109/fpl.2014.6927493
- 29. Mani P. Comparative analysis of Brent-Kung & Kogge-Stone parallel-prefix adder for their area, delay & power consumption. Indian Journal of Applied Research. 2015.