Using z14 fused-multiply-add instructions to accelerate elliptic curve cryptography

Due to growing commercial applications like Blockchain, the performance of large-integer arithmetic is the focus of both academic and industrial research. IBM introduced a new integer fused multiply-add instruction in z14, called VMSL, to accelerate such workloads.¹ Unlike their floating- oint counterparts, there are a variety of integer fused multiply-add instruction designs. VMSL multiplies two pairs of radix 2⁵⁶ inputs, sums the two results together with an additional 128-bit input, and stores the resulting 128-bit value in a vector register. In this paper, we will describe the unique features of VMSL, the ways in which it is inherently more efficie than alternativ e specifications in particular by enabling multiple carry strategies. We will then look at the issues we encountered implementing Montgomery Modular Multiplication for Elliptic Curve Cryptography on z14, including radix choice, mixed radices, instruction selection to trade instruction count for latency, and VMSL-specifi optimizations for Montgomery-friendly moduli. The best choices resulted in a 20%increase in throughput.