D-5.2 Small Montgomery Reduction Algorithm: SmallMont

One problem of the FastBConv (i.e., the fast base conversion) operation is that it creates a non-negligible noise. Specifically, suppose we use FastBConv to convert the base of x ∈ ℤq (where q = q1 ⋅q2 ⋅⋯ ⋅qk moduli) into c = x + 𝑢𝑞 mod b (where b = b1 ⋅b2 ⋅⋯ ⋅bl moduli), where integer |u|≤k 2 + 1. Then, the noise generated by this conversion is between − (k 2 + 1) ⋅q mod b and (k 2 + 1) ⋅q mod b. To reduce this noise, we will explain the small Montgomery algorithm (SmallMont) which reduces the noise generated by fast base conversion from 𝑢𝑞 to u′q, such that u′ ∈{−1,0,1}. The small Montgomery algorithm is designed as follows:

⟨Summary D-5.2⟩ Fast Modulo Reduction: SmallMont

Input: c = (c1,c2,⋯,cl,cl+1) ∈ ℤb1 × ℤb2 ×⋯ × ℤbl × ℤbα ▹ bα is a prime and co-prime to b, where b = ∏ ⁡ i=1lbi

, where c = 𝖥𝖺𝗌𝗍𝖡𝖢𝗈𝗇𝗏(|bα ⋅x|q,q,bbα) = |bα ⋅x|q + 𝑢𝑞 ▹ where x ∈ ℤq and integer |u|≤k 2 + 1

Main Steps

𝖲𝗆𝖺𝗅𝗅𝖬𝗈𝗇𝗍(c,bbα,bα,q) :

1.
c′ = |c ⋅q−1|bα
2.
For each i ∈[1,l], compute ri = |(cbi −|q|bi ⋅c′) ⋅bα−1|bi

Output: r = (r1,r2,⋯,rl︷ l) ∈ ℤb1 × ℤb2 ×⋯ × ℤbl︷ l ▹without rα ∈ ℤbα

The output satisfies the relation: r = x + u′q mod b (where u′ ∈{−1,0,1})

Proof.

1.
Given c′ = |c ⋅q−1|bα, notice that c −q ⋅c′ is exactly divisible by bα as shown below:

c −q ⋅c′mod bα

= c −q ⋅|c ⋅q−1|bα mod bα ▹ substituting c′ = |c ⋅q−1|bα

= c −c mod bα ▹ by canceling out |q|bα and |q|bα−1

= 0 mod bα

Since c −q ⋅c′ = 0 mod bα, this implies that c −q ⋅c′ is a multiple of bα (i.e., c −q ⋅c′ is exactly divisible by bα). This also implies that c −q ⋅c′ bα is an integer.

2.
Given c = |bα ⋅x|q + 𝑢𝑞 mod b and c′ = |c ⋅q−1|bα, we can express c −q ⋅c′ bα mod b as follows:

|c −q ⋅c′ bα | b

= |c −q ⋅|c ⋅q−1|bα bα | b ▹ by substituting c′ = |c ⋅q−1|bα

= ||bα ⋅x|q + 𝑢𝑞 −q ⋅|||bα ⋅x|q + 𝑢𝑞|b ⋅q−1|bα bα | b ▹ by substituting c = ||bα ⋅x|q + 𝑢𝑞|b

= |bα ⋅x + 𝑣𝑞 + 𝑢𝑞 −q ⋅||bα ⋅x + 𝑣𝑞 + 𝑢𝑞|b ⋅q−1|bα bα |b ▹ by rewriting |bα ⋅x|q as bα ⋅x + 𝑣𝑞 (where v is some integer representing the q-overflows of bα ⋅x)

= |x + 𝑣𝑞 + 𝑢𝑞 −q ⋅||bα ⋅x + 𝑣𝑞 + 𝑢𝑞|b ⋅q−1|bα bα |b ▹ since x = bα ⋅x bα

= |x + q ⋅v + u −||bα ⋅x + 𝑣𝑞 + 𝑢𝑞|b ⋅q−1|bα bα |b ▹ taking out the common multiple q

The above computation result is guaranteed to be an integer (as we proved in the proof step 1). And q and bα are co-prime (by the input definition). This leads to the conclusion that

v + u −||bα ⋅x + 𝑣𝑞 + 𝑢𝑞|b ⋅q−1|bα bα is guaranteed to be an integer. Therefore, if we choose bα (i.e., a prime and co-prime to both q and b) as a sufficiently large value, then v + u −||bα ⋅x + 𝑣𝑞 + 𝑢𝑞|b ⋅q−1|bα bα will converge to {−1,0,1}. This is because as bα increases: (1) v grows slower than bα (since |bα ⋅x|q = bα ⋅x + 𝑣𝑞); (2) the magnitude of u stays smaller than k 2 + 1 (as integer |u|≤k 2 + 1); and (3) ||bα ⋅x + 𝑣𝑞 + 𝑢𝑞|b ⋅q−1|bα is guaranteed to be an integer between [−bα + 1 2 ,bα 2 −1]. In conclusion, if bα is sufficiently large, then we get the following relation:

|c −q ⋅c′ bα | b = x + u′q mod b ▹ where u′ ∈{−1,0,1}

Also, the following is true:

c −q ⋅c′ bα mod b = (c −q ⋅c′) ⋅bα−1 mod b ▹ because bα divides c −q ⋅c′ and bα is co-prime to b

3.
It is possible to express the final output x + u′q mod b as an RNS vector with the residues of the base moduli (b1,⋯,bl). For this, we convert (c −q ⋅c′) ⋅bα−1 into the RNS vector (r1,r2,⋯,rl) ∈ ℤb1 × ℤb2 ×⋯ × ℤbl by computing the following for each i ∈[1,l]:

ri = |(c −q ⋅c′) ⋅bα−1|bi

= |(cbi −|q|bi ⋅c′) ⋅bα−1|bi

□
D-5.2.1 Improving FastBConv by Using SmallMont

Notice that by using SmallMont in Summary D-5.2, the accuracy of the raw output of 𝖥𝖺𝗌𝗍𝖡𝖢𝗈𝗇𝗏(x,q,b) = |x + 𝑢𝑞|b (where integer |u|≤k 2 + 1) is improved to |x + u′q|b (where u′ ∈{−1,0,1}) as follows:

𝖲𝗆𝖺𝗅𝗅𝖬𝗈𝗇𝗍(𝖥𝖺𝗌𝗍𝖡𝖢𝗈𝗇𝗏(|bα ⋅x|q,q,bbα),bbα,bα,q)

𝖲𝗆𝖺𝗅𝗅𝖬𝗈𝗇𝗍(||bα ⋅x|q + 𝑢𝑞|bbα,bbα,bα,q)

= |x + u′q|b ▹ where u′ ∈{−1,0,1}