Compact Galois Field Multiplier

Galois field multipliers which multiply two numbers in a Galois field are used in error correction encoding and decoding hardware, such as Reed-Solomon encoders or decoders. Such encoders and decoders include many Galois field multipliers, although such multipliers necessarily include very complex hardware. Some well-known Galois field multipliers are described in Berlekamp, Algebraic Coding Theory, Academic Press, 1968, at pages 47-48. Using straightforward methods of implementation, the complexity and cost of such multipliers increase very rapidly with the number of bits per byte. For example, in GF512 (GS2.sup.9), multiplication of any two of nine-bit bytes requires implementation of the multiplication table among the 512 elements of GF512. Assuming this is done using a pair of programmable read only memories, each programmable read only memory (PROM) would receive all nine bits of the multiplicand, one of the PROMs receiving five bits of the multiplier, and the other PROM receiving the remaining four bits of the multiplier, each PROM storing the requisite multiplication table. The output of the two PROMs is added (in an exclusion OR gate) and the result is the desired product. The complexity and cost of the two PROMs makes such an implementation too ponderous or costly for many applications and therefore unsuitable.

The problem is how to make a Galois field multiplier which, for large m (number of bits per byte) does not have the complexity of currently available Galois field multipliers.

Multiplication of a pair of large (mq-bit) bytes in a large Galois field GF2.sup.mq (e.g. of nine-bit bytes in GF512) is reduced to the simpler problem of multiplication among two sets of q small (m-bit) sub-bytes in a small Galois field GF2.sup.m (e.g. three-bit bytes in GF8) by first partitioning each mq-bit byte into q m-bit sub-bytes.

Reduction to multiplication in the larger Galois field to the smaller Galois field requires computation of a plurality of different sub-products among the two sets of sub-bytes. It is a discovery of the invention that arranging the sub-bytes into q groups having sub-products in common, and distributing the q groups among at least q and as many as q.sup.2 GF2.sup.m multipliers which produce the sub-products, minimizes the hardware. Moreover, arranging the resulting sub-products into q groups which are combined respectively in q (or more) GF2.sup.m adders produces at each of q adder outputs a respective one of the q m-bit sub-bytes of the final mq-bit product. The multiplication algorithm performed by the combination of multipliers and adders is defined by the reduction modulus an irreducible polynomial of degree q in GF2.sup.m of the product of two polynomials whose coefficients are the two sets of sub-bytes, respectively .

The invention may be understood by reference to the accompanying drawings of which:

FIG. 1 is a block diagram illustrating the invention applied to a tutorial example in which multiplication in GF16 is reduced to multiplication in GF4;

FIG. 2 illustrates the invention in a practical example in which multiplication in a very large field (GF512) is reduced to multiplication in a simpler field (GF8); and

FIG. 3 illustrates the distribution of the GF8 sub-byte computation among the multipliers PROM 0, PROM 1, PROM 2 in FIG. 2.

In order to perform multiplication between two bytes each comprising a large number (mq) of bits per byte, the invention partitions the multiplicand A and the multiplier B each into q m-bit sub-bytes beginning with the least significant bit and ending with the most significant bit. The q m-bit sub-bytes into which the multiplicand A is partitioned are labeled (beginning with the least significant byte and ending with the most significant byte) a.sub.0, a.sub.1, . . . , a.sub.q-1. The q m-bit sub-bytes into which the multiplier B is partitioned are labeled in the same order b.sub.0, b.sub.1, . . . , b.sub.q-1. The q sub-bytes of A (a.sub.0 through a.sub.q-1) are multiplied by the q sub-bytes of B (b.sub.0 through b.sub.q-1) to generate q.sup.2 product terms, and then simplified by reducing the multiplication operation modulus a selected polynomial F(z) of degree q which is "irreducible" (i.e., cannot be factored) in GF2.sup.m. For this purpose, the mq-bit multiplicand and multiplier A and B are each viewed as polynomials in powers of Z whose coefficients are the q m-bit sub-bytes into which they were partitioned:

The multiplication operation is simplified by reducing the product A(z)B(z) modulus F(z), where F(z) is an irreducible polynomial of GF2.sup.m of degree q.

This reduction is performed by simply dividing A(z)B(z) by F(z) and discarding all of the results except for a remainder, which is itself a polynomial in z. The remainder polynomial thus obtained has q coefficients c.sub.0 through c.sub.q-1 which are m-bit bytes (i.e. elements in GF2.sup.m) and comprise the q m-bit sub-bytes of the product A.times.B, from least significant byte to most significant byte. The least significant sub-byte, c.sub.0, is the coefficient of z.sup.0 in the remainder polynomial. The next least significant sub-byte, c.sub.1, is the coefficient of z.sup.1 in the remainder polynomial. Finally, the most significant sub-byte, c.sub.q-1 is the coefficient of z.sup.q-1 in the remainder polynomial.

Thus, the product C=AB is a mq-bit byte comprising the q m-bit sub-bytes c.sub.0, c.sub.1, . . . , c.sub.q-1.

The key to the invention is that the computation of the q product sub-bytes c.sub.0, c.sub.1, . . . , c.sub.q-1 involve different multiplications among common ones of the coefficients of the multiplicand A (i.e., a.sub.0, a.sub.1, . . . , a.sub.q-1) and of the multiplier B (i.e., b.sub.0, b.sub.1, . . . , b.sub.q-1). Computation of the q product sub-bytes c.sub.0 . . . c.sub.q-1 is performed in at least q and as many as q.sup.2 multipliers and q or more adders in such a manner as to exploit the commonality of coefficients in the overall multiplication algorithm to the fullest, thereby simplifying the hardware.

In the following tutorial example (FIG. 1), multiplication among four-bit bytes (in GF2.sup.4) is carried out as multiplication of among two-bit sub-bytes in GF2.sup.2.

Referring to FIG. 1, the invention requires use of two simple PROMs. The GF16 (i.e. four-bit byte) multiplicand A and multiplier B are each divided into a pair of two-bit sub-bytes, a.sub.1, a.sub.0, and b.sub.1, b.sub.0, respectively. In order to define the GF2.sup.4 multiplication algorithm involving the four two-bit sub-bytes a.sub.1, a.sub.0, b.sub.1, b.sub.0, an irreducible polynomial of GF4 must first be chosen. In this example, the following irreducible polynomial of GF4 is chosen:

The GF4 element .xi. is the two-bit byte 10 of GF4. (Various other irreducible polynomials of degree 2 in GF4 are shown as factors of a polynomial on p. 107 of the above-referenced text by Berlekamp.)

Next, the product AB is expressed in a polynomial in z wherein each of the sub-bytes a.sub.0, a.sub.1, b.sub.0, b.sub.1 is a coefficient, as follows: ##EQU1##

Therefore A.times.B=a.sub.0 b.sub.0 +(a.sub.0 b.sub.1 +a.sub.1 b.sub.0)z+a.sub.1 b.sub.1 z.sup.2.

This latter polynomial is the product polynomial which must now be reduced modulus the irreducible polynomial of GF4 which we have chosen, namely z.sup.2 +z+.xi.. This is done by dividing the product polynomial, a.sub.0 b.sub.0 +(a.sub.0 b.sub.1 +a.sub.1 b.sub.0)z+a.sub.1 b.sub.1 z.sup.2) by the irreducible polynomial, z.sup.2 +z+.xi.,

and then disregarding all of the resultant polynomial quotient and keeping only the remainder polynomial. The reader is invited to perform this polynomial division long-handed and obtain a.sub.1 b.sub.1 as the quotient (which is disgarded) and the following remainder:

In this remainder polynomial, the coefficient of z.sup.1 (i.e. a.sub.0 b.sub.1 +a.sub.1 b.sub.0 -a.sub.1 b.sub.1) is the product coefficient c.sub.1. The coefficient of z.sup.0 (i.e. a.sub.0 b.sub.0 -a.sub.1 b.sub.1 .xi.) is the product coefficient c.sub.0. c.sub.1 and C.sub.0 are the two two-bit sub-bytes which, when combined together as most significant and least significant bytes, respectively, comprise the four-bit byte product C=A.times.B in GF16. Summarizing our results:

FIG. 1 shows how the products among the various coefficients (a.sub.0, a.sub.1, b.sub.0, b.sub.1) of c.sub.0 and c.sub.1 are computed in PROM 0 and PROM 1. PROM 0 receives the three two-bit bytes b.sub.0, a.sub.1, a.sub.0 while PROM 1 receives the three two-bit bytes b.sub.1, a.sub.1, a.sub.0. PROM 0 generates two outputs, namely the two-bit byte product a.sub.0 b.sub.0 and the two-bit byte product a.sub.1 b.sub.0. PROM 1 generates the following two-bit byte products: a.sub.0 b.sub.1 +a.sub.1 b.sub.1 and .xi.a.sub.1 b.sub.1. Thus, the products are computed in two groups by the two multipliers (PROM's) from two respective sets of input coefficients common to each respective group of products. For example, PROM 1 computes the two groups of results a.sub.0 b.sub.1 +a.sub.1 b.sub.1 and .xi.a.sub.1 b.sub.1 from the group of three coefficients b.sub.1, a.sub.1, a.sub.0 which are common to the three products.

Adder 0 computes the product coefficient c.sub.0 (the least significant two-bit byte of the product) by adding together two of the products from PROM 0 and PROM 1, a.sub.0 b.sub.0 +.xi.a.sub.1 b.sub.1, respectively. Adder 1 computes the product coefficient c.sub.1 by adding together the products from PROM 0 (i.e. a.sub.1 b.sub.0) and PROM 1 (i.e. a.sub.0 b.sub.1 +a.sub.1 b.sub.1). FIG. 1 illustrates that when c.sub.1 and c.sub.0 are combined together as the most significant sub-byte and the least significant sub-byte respectively, the result is the four-bit byte C=A.times.B in GF16.

The reduction of multiplication in GF16 to multiplication in GF4, while affording some reduction in hardware complexity and cost, does not afford the most dramatic reduction. Accordingly, the main advantage of the example of FIG. 1 is its tutorial clarity, and is not necessarily the preferred embodiment of the invention.

A very dramatic reduction in hardware complexity and cost is achieved when the invention is applied to the problem of multiplying together two large bytes in GF512 (i.e. GF2.sup.9) in which all bytes are nine-bit bytes. As mentioned previously, using two PROMs, each of which receives all bytes of the multiplier and respective sub-bytes of the multiplicand, would be too costly and complex.

In the embodiment of FIG. 2, multiplication in GF512 is reduced to multiplication in GF8. The two nine-bit bytes to be multiplied together are each partitioned into three three-bit sub-bytes before multiplication is carried out.

First, an irreducible polynomial of GF8 must be chosen. In this example, the preferred irreducible polynomial of GF8 is:

where .beta. is the following three-bit byte element of GF8: 111. In this example, q=3 (the ratio of the number of bits in GF512 and GF8) and so the degree of F(z) must be 3. There are a number of irreducible polynomials of degree 3 in GF8. However, this particular choice of F(z) was made because it has the least number of non-zero coefficients.

Next, we must compute the product polynomial of A.times.B, where:

Multiplying A(z) by B(z),

Dividing this polynomial product by the chosen primitive polynomial F(z) (namely .beta.+.beta.z+z.sup.3) and disgarding all but the residual remainder polynomial left over from the polynomial division operation, the following result is obtained:

The product A(z)B(z) mod F(z) is the desired result of the multiplication in GF512 reduced to GF8. c.sub.0 is the least significant three-bit sub-byte of the 9-bit product C=AB. c.sub.1 is the next significant three-bit sub-byte. c.sub.2 is the most significant three-bit sub-byte in the 9-bit product byte C=AB. Thus, the three three-bit sub-bytes or coefficients c.sub.0, c.sub.1, c.sub.2 together comprise the nine-bit byte product C=AB in GF512. Each of the coefficients c.sub.0, c.sub.1, c.sub.2 is computed from the coefficients (or sub-bytes) a.sub.0, a.sub.1, a.sub.2, b.sub.0, b.sub.1, b.sub.2 in accordance with the foregoing definitions of c.sub.0, c.sub.1, c.sub.2 (equations (1), (2) and (3)).

FIG. 2 shows just how this is done in accordance with the invention with a minimum complexity of hardware. In FIG. 2, the nine bits of the multiplicand A is partitioned into three three-bit sub-bytes, namely a.sub.0, a.sub.1, a.sub.2, and the nine bits of the multiplier B are partitioned into three three-bit sub-bytes, namely b.sub.0, b.sub.1 and b.sub.2, from the least significant bit to the most significant bit respectively. Inspecting the definitions above (equations (1)-(3)) for the coefficients c.sub.0, c.sub.1 and c.sub.2 (see FIG. 3), it is readily apparent that there are q (i.e. 3) groups of the required sub-products (e.g. a.sub.2 b.sub.1 +b.sub.1 a.sub.2 being one of the sub-products) having various ones of the coefficients a.sub.1, a.sub.2, a.sub.3, b.sub.1, b.sub.2, b.sub.3 in common. Relegating to each multiplier or PROM the computation of one of the groups of sub-products greatly simplifies the hardware implementation. The greatest simplification is achieved in FIG. 2 using three programmable read only memories (PROM's) namely PROM 0, PROM 1 and PROM 2. PROM 0 receives the following three-bit bytes: a.sub.0, a.sub.1, b.sub.0, b.sub.1, beginning with the least significant byte and ending with the most significant byte, respectively. PROM 1 receives the following three-bit bytes: a.sub.1, a.sub.2, b.sub.1, b.sub.2, beginning with the least significant byte and ending with the most significant byte, respectively. PROM 2 receives the following three-bit bytes: a.sub.0, a.sub.2, b.sub.0, b.sub.2, beginning with the least significant byte and ending with the most significant byte, respectively. Each of the PROM's (namely PROM 0, PROM 1, PROM 2) is programmed with the GF8 multiplication table which is as follows:

Using the foregoing multiplication table, PROM 0 computes the following three-bit byte sub-products in GF(8) from the four three-bit byte inputs it receives: a.sub.0 b.sub.0 ; a.sub.1 b.sub.0 +a.sub.0 b.sub.1 ; and, the two least significant bits of a.sub.1 b.sub.1. PROM 1 computes the following three-bit byte sub-products from various ones of its four three-bit byte inputs: a.sub.1 b.sub.2 +a.sub.2 b.sub.1 (which PROM 1 multiplies by .beta., .beta. being the three-bit byte 111); a.sub.1 b.sub.2 +a.sub.2 b.sub.1 +a.sub.2 b.sub.2 (which PROM 1 multiplies by .beta.); and, the most significant bit of the three-bit byte product a.sub.1 b.sub.1. PROM 2 computes the following three-bit byte sub-product from its four three-bit byte inputs: a.sub.0 b.sub.2 +a.sub.2 b.sub.0 +.beta.a.sub.2 b.sub.2.

This distribution of the three groups of sub-products among the three PROMs is illustrated in FIG. 3 in accordance with the definition of the coefficients (sub-bytes) c.sub.0, c.sub.1, c.sub.2 of equations (1)-(3). The three groups of sub-products are outlined in dashed line in FIG. 3, each group sharing its own unique set of four of the coefficients (sub-bytes) a.sub.0, a.sub.1, a.sub.2, b.sub.0, b.sub.1, b.sub.2.

Various ones of the products computed by the three PROMs (PROM 0, PROM 1, PROM 2) are combined in various ones of three adders (namely adder 0, adder 1, adder 2) in accordance with the definitions of FIG. 3. The three adders each take the form of three-bit exclusive OR gates (six bit input, three bit output) in accordance with well-known techniques for adding plural Galois field elements together to form a Galois field sum.

Adder 0 combines the product a.sub.0 b.sub.0 (from PROM 0) with the product .beta.(a.sub.1 b.sub.2 +a.sub.2 b.sub.1) (from PROM 1), the resulting sum being c.sub.0. Adder 1 combines the three-bit byte product a.sub.1 b.sub.0 +a.sub.0 b.sub.1 (from one PROM 0) with the three-bit byte product .beta.(a.sub.1 b.sub.2 +a.sub.2 b.sub.1 +a.sub.2 b.sub.2) (from PROM 1), the resulting three-bit byte sum being the coefficient c.sub.1. The least significant two bits of the three-bit byte product a.sub.1 b.sub.1 (from PROM 0) are combined with the most significant bit of a.sub.1 b.sub.1 (from PROM 1)--thus forming all three bits of the three-bit byte product a.sub.1 b.sub.1 --and the resulting three-bit byte is applied to one input of adder 2. Adder 2 combines this product with the product a.sub.0 b.sub.2 +a.sub.2 b.sub.0 +.beta.a.sub.2 b.sub.2 (from PROM 2) and the resulting sum is the coefficient c.sub.2.

In general, a multiplication in an mq bit-per-byte field may be reduced to multiplications in an m-bit-per-byte field. The different multiplications of the m-bit sub-bytes are partitioned into q multiplication groups each having about q+1 or so sub-bytes in common, each of the q multiplication groups being assigned to one of at least q and as many as q.sup.2 m-bit multipliers. The outputs of the multipliers are variously combined in at least q adders.

Such partitioning is used to simplify the hardware complexity in the embodiment of FIG. 1 as well as in FIG. 2. Of course, the partitioning is dependent upon the choice of the irreducible polynomial F(z), and also is different for different values of q and m. In this description, two examples are given, namely reduction of multiplication in GF16 to GF4 (q=4, m=4) and reduction of multiplication in GF512 to GF8 (q=3, m=3). Various other embodiments are realized where multiplication occurs in a large Galois field (such as GF256, GF1024, etc.).

Accordingly, while the invention has been described in detail with reference to preferred embodiments thereof, modifications and variations thereof may be made without departing from the spirit and scope of the invention.