SPRUJB6B November 2024 – May 2025 AM2612
These commands perform modulo exponentiation. MODEXP computes xd mod N as ordinary numbers, whereas MODEXP_MONT does the same calculation in Montgomery form. The value d must not be 0.
The MODEXP command performs a left-to-right scan, so it reveals (through timing and power information) the highest set bit of d. It is therefore recommended to use this command when d is public, or when its highest set bit is not interesting information (e.g., during RSA key generation).
| Slot | Name | Description | In ROM? |
|---|---|---|---|
| 0 | x | A value to be exponentiated | No |
| 2 | N | The modulus | No |
| 4 | d0 | First share of the XOR-blinded exponent | No |
| 5 | d1 | Second share of the XOR-blinded exponent | No |
The MODEXP and MODEXP_MONT commands raise an error if:
On error, these commands clear slots 0 through 5. On success, they clear slot 1.
| Slot | Name | Description | |
|---|---|---|---|
| 0 | xd | xd mod N |