# February 10, 2015

## Swiftly Secure, Part 2 – Multiplying Huge Numbers

Posted in iPhone development, mac development tagged encryption, iOS, Mac, multi-word addition, multi-word multiplication, overflow, socialist millionaire, Swift at 12:11 am by tetontech

In my previous post I mentioned how two 64 bit numbers could be multiplied together without ever overflowing. The approach taken was a variation of the grade school multiplication algorithm. In this posting I continue my path to an implementation of the Socialist Millionaire protocol used to securely communicate between 2 or more peers. In order use socialist millionaire I will have to multiply numbers that are much too large to fit into a 64 bit integer. This means I’ll need to multiply arrays of numbers by arrays of numbers.

There are algorithms out there for doing multi-word multiplication. Warren, at hackers delight, lays out a C version of Knuth’s grade school algorithm. It works, but has a design point I was unwilling to follow. It requires the arrays being multiplied to consist of half-word numbers rather than full word numbers. I wanted to explore code using arrays of unsigned 64 bit numbers to represent the very long numbers. It seemed a waste to only use 32 bits per number.

With that in mind I sat down to figure out how to apply the multiplication algorithm used in the last post in this new situation. I wasn’t surprised when I found was easily adaptable from multiplying two Swift UInt64’s to multiplying two Swift UInt64 arrays (Please see the graphics and discussion in the previous post to understand the algorithm basics).

Part of the new algorithm implementation includes adding two UInt64’s in situations where they could readily overflow. That meant I needed to create an add method to handle this correctly. It isn’t that complicated but does require the use of bitwise operators and comparisons.

func add(leftAddend:UInt64, rightAddend:UInt64) ->(UInt64,UInt64){ var carryAmount:UInt64 = 0 let sum:UInt64 = 0 //check for overflow if ~leftAddend < rightAddend{ carryAmount = 1 sum = rightAddend - ~leftAddend - 1 } else{ sum = rightAddend + leftAddend } return (carryAmount,sum) }

This implementation of add checks to see if overflow will happen before doing the addition. If there is no danger of overflow the two addends are combined. If overflow will happen the amount of overflow is stored and the sum is set to the maximum value of a UInt64.

In either case the add function returns the sum and a number representing how much too large the real sum is if it was to fit into a UInt64. We’ll use this carry amount in the multi-word multiplication algorithm.

Another change I made from Warren’s implementation was to have the arrays of numbers be in big endian format. This didn’t add significantly to the complicatedness of the algorithm but is how people ‘normally’ think of numbers. This can make it easier for some to see how the input relates to the algorithm’s output.

If the algorithm is implemented correctly some simple multiplications and their results should match these below. All arrays of numbers are base 2^64 where each array element represents a 64 bit ‘digit’ in big endian bit order.

- multiply([UInt64.max/2 + 1],[2]) => [1,0]
- multiply([1,0,0],[1,1]) => [0,1,1,0,0]
- multiply([2,2],[UInt64.max/2 + 1]) => [1,1,0]
- multiply([UInt64.max, UInt64.max, UInt64.max], [UInt64.max, UInt64.max]) => [18446744073709551615, 18446744073709551615, 18446744073709551615, 18446744073709551615, 1]

In this implementation of the grade school algorithm discussed in the previous post the ‘bit’ size of the multiplicand and the multiplier are unknown. This means we can’t use the nice trick with the << operator and bit masks to create portions of the product we can add together. Instead we’ll collect the product portions directly into an array of UInt64’s.

If we create an array for the resultant product sized to be the sum of the sizes of the multiplicand and the multiplier it will always be large enough to hold the product. Sometimes it will be 1 digit too large but that will always be in the most significant digit location when it does happen. You can see an example of this if you look at the second bullet point of the list above. This is OK since a zero value in that place doesn’t affect the value of the number anyway.

The multi-word multiplication implementation of the algorithm looks like this.

func multiply(multiplicand:[UInt64], multiplier:[UInt64]) ->[UInt64]{ let multiplicandSize = multiplicand.count let multiplierSize = multiplier.count let productSize = multiplicandSize + multiplierSize //create an array that is large enough //to hold the product var product = [UInt64](count: productSize, repeatedValue: 0) //follow the grade school methodology //to do multiplication for index in stride(from: multiplierSize - 1, to: -1, by: -1){ let multiplierElement = multiplier[index] for subIndex in stride(from: multiplicandSize - 1, to: -1, by: -1){ let multiplicandElement = multiplicand[subIndex] //calculate the product and the carry amount let partialProduct:[UInt64] = multiplyWithOverflow(multiplicandElement, multiplierElement) //calculate the location of the product let productIndex = (subIndex + index + 1) //calculate the index of the carry amount let carryIndex = productIndex - 1 //calculate the amount to be inserted //into the product and carry locations. //Add the current calculated product to any amount that //was previously carried forward. let (carryAmount, productSum) = add(product[productIndex], partialProduct[1]) //the carrySum will never be able overflow. let (_, carrySum) = add(product[carryIndex], carryAmount + partialProduct[0]) product[carryIndex] = carrySum product[productIndex] = productSum } } return product }

In this implementation each partial product is calculated and the overflow is placed in the next higher bit location. The partial product is then added to anything that was ‘carried’ over previously into the product’s location. For both the carryAmount and the partial product the add method described above was used to ensure overflows were handled correctly. While this algorithm isn’t quite as clean as the one in the last post, It is still fairly straight forward.

Since the socialist millionaire algorithm requires a division as one of its steps, my next posting will show an algorithm for multi-word division and subtraction. At this point, it looks like there will be some very interesting ideas to point out.