D-5.7 Small Montgomery Reduction Algorithm: SmallMont

One problem of the FastBConv (i.e., the fast base conversion) operation is that it creates a non-negligible noise. Specifically, suppose we use FastBConv to convert the base of x q (where q = q1 q2 qk moduli) into c = x + 𝑢𝑞 mod b (where b = b1 b2 bl moduli), where integer |u|k 2 + 1. Then, the noise generated by this conversion is between (k 2 + 1) q mod b and (k 2 + 1) q mod b. To reduce this noise, we will explain the small Montgomery algorithm (SmallMont) which reduces the noise generated by fast base conversion from 𝑢𝑞 to uq, such that u {1,0,1}. The small Montgomery algorithm is designed as follows:

Summary D-5.7 Fast Modulo Reduction: SmallMont

Input: c = (c1,c2,,cl,cl+1) b1 × b2 × × bl × bα # bα is a prime and co-prime to b, where b = i=1lbi

, where c = 𝖥𝖺𝗌𝗍𝖡𝖢𝗈𝗇𝗏(|bα x|q,q,bbα) = |bα x|q + 𝑢𝑞 # where x q and integer |u|k 2 + 1

Main Steps

𝖲𝗆𝖺𝗅𝗅𝖬𝗈𝗇𝗍(c,bbα,bα,q) :

1.
c = |c q1|bα
2.
For each i [1,l], compute ri = |(cbi |q|bi c) bα1|bi

Output: r = (r1,r2,,rl l) b1 × b2 × × bl l # without rα bα

The output satisfies the relation: r = x + uq mod b (where u {1,0,1})

Proof.

1.
Given c = |c q1|bα, notice that c q c is exactly divisible by bα as shown below:

c q cmod bα

= c q |c q1|bα mod bα # substituting c = |c q1|bα

= c c mod bα # by canceling out |q|bα and |q|bα1

= 0 mod bα

Since c q c = 0 mod bα, this implies that c q c is a multiple of bα (i.e., c q c is exactly divisible by bα). This also implies that c q c bα is an integer.

2.
Given c = |bα x|q + 𝑢𝑞 mod b and c = |c q1|bα, we can express c q c bα mod b as follows:

|c q c bα | b

= |c q |c q1|bα bα | b # by substituting c = |c q1|bα

= ||bα x|q + 𝑢𝑞 q |||bα x|q + 𝑢𝑞|b q1|bα bα | b # by substituting c = ||bα x|q + 𝑢𝑞|b

= |bα x + 𝑣𝑞 + 𝑢𝑞 q ||bα x + 𝑣𝑞 + 𝑢𝑞|b q1|bα bα |b # by rewriting |bα x|q as bα x + 𝑣𝑞 (where v is some integer representing the q-overflows of bα x)

= |x + 𝑣𝑞 + 𝑢𝑞 q ||bα x + 𝑣𝑞 + 𝑢𝑞|b q1|bα bα |b # since x = bα x bα

= |x + q v + u ||bα x + 𝑣𝑞 + 𝑢𝑞|b q1|bα bα |b # taking out the common multiple q

The above computation result is guaranteed to be an integer (as we proved in the proof step 1). And q and bα are co-prime (by the input definition). This leads to the conclusion that

v + u ||bα +𝑣𝑞 + 𝑢𝑞|b q1|bα bα is guaranteed to be an integer. Therefore, if we choose bα (i.e., a prime and co-prime to both q and b) as a sufficiently large value, then v + u ||bα x + 𝑣𝑞 + 𝑢𝑞|b q1|bα bα will converge to {1,0,1}. This is because as bα increases: (1) v grows slower than bα (since |bα x|q = bα x + 𝑣𝑞); (2) the magnitude of u stays smaller than k 2 + 1 (as integer |u|k 2 + 1); and (3) ||bα x + 𝑣𝑞 + 𝑢𝑞|b q1|bα is guaranteed to be an integer between [bα + 1 2 ,bα 2 1]. In conclusion, if bα is sufficiently large, then we get the following relation:

|c q c bα | b = x + uq mod b # where u {1,0,1}

Also, the following is true:

c q c bα mod b = (c q c) bα1 mod b # because bα divides c q c and bα is co-prime to b

3.
It is possible to express the final output x + uq mod b as an RNS vector with the residues of the base moduli (b1,,bl). For this, we convert (c q c) bα1 into the RNS vector (r1,r2,,rl) b1 × b2 × × bl by computing the following for each i [1,l]:

ri = |(c q c) bα1|bi

= |(cbi |q|bi c) bα1|bi

D-5.7.1 Improving FastBConv by Using SmallMont

Notice that by using SmallMont in Summary D-5.7, the accuracy of the raw output of 𝖥𝖺𝗌𝗍𝖡𝖢𝗈𝗇𝗏(x,q,b) = |x + 𝑢𝑞|b (where integer |u|k 2 + 1) is improved to |x + uq|b (where u {1,0,1}) as follows:

𝖲𝗆𝖺𝗅𝗅𝖬𝗈𝗇𝗍(𝖥𝖺𝗌𝗍𝖡𝖢𝗈𝗇𝗏(|bα x|q,q,bbα),bbα,bα,q)

𝖲𝗆𝖺𝗅𝗅𝖬𝗈𝗇𝗍(||bα x|q + 𝑢𝑞|bbα,bbα,bα,q)

= |x + uq|b # where u {1,0,1}