{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T14:09:48Z","timestamp":1778249388681,"version":"3.51.4"},"publisher-location":"Cham","reference-count":55,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783032253354","type":"print"},{"value":"9783032253361","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-3-032-25336-1_21","type":"book-chapter","created":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T13:11:18Z","timestamp":1778245878000},"page":"598-627","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Accelerating and verifying constant-time modular inversion"],"prefix":"10.1007","author":[{"given":"Daniel J.","family":"Bernstein","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Han-Ting","family":"Chen","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"John R.","family":"Harrison","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Cesare","family":"Huang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Gregory","family":"Maxwell","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Bow-Yaw","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Pieter","family":"Wuille","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Bo-Yin","family":"Yang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2026,5,9]]},"reference":[{"key":"21_CR1","unstructured":"Oskar Abrahamsson, Magnus O. Myreen, Ramana Kumar, Thomas Sewell, Candle: A verified implementation of HOL Light, in ITP 2022 (2022), 3:1\u20133:17."},{"key":"21_CR2","doi-asserted-by":"crossref","unstructured":"Alejandro Cabrera Aldaya, Cesar Pereida Garc\u00eda, Luis Manuel Alvarez Tapia, Billy Bob Brumley, Cache-timing attacks on RSA key generation, IACR TCHES 2019.4 (2019), 213\u2013242.","DOI":"10.46586\/tches.v2019.i4.213-242"},{"key":"21_CR3","doi-asserted-by":"crossref","unstructured":"Alex M. Andrew, Another efficient algorithm for convex hulls in two dimensions, Information Processing Letters 9 (1979), 216\u2013219.","DOI":"10.1016\/0020-0190(79)90072-3"},{"key":"21_CR4","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Curve25519: new Diffie-Hellman speed records, in PKC 2006 (2006), 207\u2013228.","DOI":"10.1007\/11745853_14"},{"key":"21_CR5","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Writing high-speed software (2006).","DOI":"10.1145\/1279682.1119606"},{"key":"21_CR6","unstructured":"Daniel J. Bernstein, Robust statistics for rejection-sampling timings (2025)."},{"key":"21_CR7","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, Bo-Yin Yang, High-speed high-security signatures, Journal of Cryptographic Engineering 2 (2012), 77\u201389.","DOI":"10.1007\/s13389-012-0027-1"},{"key":"21_CR8","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Tanja Lange, Safe curves for elliptic-curve cryptography, in Dawson proceedings (2025), 124\u2013191.","DOI":"10.1007\/978-3-031-83490-5_7"},{"key":"21_CR9","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Peter Schwabe, NEON crypto, in CHES 2012 (2012), 320\u2013339.","DOI":"10.1007\/978-3-642-33027-8_19"},{"key":"21_CR10","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Bo-Yin Yang, Fast constant-time gcd computation and modular inversion, IACR TCHES 2019 (2019), 340\u2013398.","DOI":"10.46586\/tches.v2019.i3.340-398"},{"key":"21_CR11","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Bo-Yin Yang, Fast constant-time gcd computation and modular inversion: Software (2020).","DOI":"10.46586\/tches.v2019.i3.340-398"},{"key":"21_CR12","unstructured":"Marco Bodrato, Marc Glisse, Torbj\u00f6rn Granlund, Niels M\u00f6ller, GNU MP: The GNU Multiple Precision Arithmetic Library, version 6.3.0 (2023)."},{"key":"21_CR13","doi-asserted-by":"crossref","unstructured":"Jonathan M. Borwein, Jon D. Vanderwerff, Convex functions: constructions, characterizations and counterexamples, Cambridge University Press, 2010.","DOI":"10.1017\/CBO9781139087322"},{"key":"21_CR14","doi-asserted-by":"crossref","unstructured":"Joppe W. Bos, Constant time modular inversion, Journal of Cryptographic Engineering 4 (2014), 275\u2013281.","DOI":"10.1007\/s13389-014-0084-8"},{"key":"21_CR15","unstructured":"Nicolai Brown, Things that use Curve25519 (2025), accessed 2025-10-02."},{"key":"21_CR16","unstructured":"Nicolai Brown, Things that use Ed25519 (2025), accessed 2025-10-02."},{"key":"21_CR17","doi-asserted-by":"crossref","unstructured":"Henri Cohen, A course in computational algebraic number theory, Graduate Texts in Mathematics, 138, Springer, Berlin, 1993.","DOI":"10.1007\/978-3-662-02945-9"},{"key":"21_CR18","doi-asserted-by":"crossref","unstructured":"Richard A. DeMillo, Richard J. Lipton, Frederick G. Sayward, Hints on test data selection: help for the practicing programmer, Computer 11 (1978), 34\u201341.","DOI":"10.1109\/C-M.1978.218136"},{"key":"21_CR19","unstructured":"Peter Dettman, Pieter Wuille, This file implements modular inversion (2021)."},{"key":"21_CR20","doi-asserted-by":"crossref","unstructured":"Robert Dockins, Adam Foltzer, Joe Hendrix, Brian Huffman, Dylan McNamee, Aaron Tomb, Constructing semantic models of programs with the Software Analysis Workbench, in VSTTE 2016 (2016), 56\u201372.","DOI":"10.1007\/978-3-319-48869-1_5"},{"key":"21_CR21","doi-asserted-by":"crossref","unstructured":"Alan Edelman, The mathematics of the Pentium division bug, SIAM Review 39 (1997), 54\u201367.","DOI":"10.1137\/S0036144595293959"},{"key":"21_CR22","unstructured":"Euclid, Elements, about 300 B.C."},{"key":"21_CR23","doi-asserted-by":"crossref","unstructured":"Robert W. Floyd, Assigning meanings to programs, in PSAM 19 (1967), 19\u201332.","DOI":"10.1090\/psapm\/019\/0235771"},{"key":"21_CR24","unstructured":"Agner Fog, The microarchitecture of Intel, AMD and VIA CPUs: An optimization guide for assembly programmers and compiler makers (2025)."},{"key":"21_CR25","unstructured":"Clinton Freeman, David L. Millman, Jack Snoeyink, Gift wrapping the integer hull in the plane, in EuroCG 2014 (2014)."},{"key":"21_CR26","doi-asserted-by":"crossref","unstructured":"Yu-Fu Fu, Jiaxiang Liu, Xiaomu Shi, Ming-Hsien Tsai, Bow-Yaw Wang, Bo-Yin Yang, Signed cryptographic program verification with typed CRYPTOLINE, in CCS 2019 (2019), 1591\u20131606.","DOI":"10.1145\/3319535.3354199"},{"key":"21_CR27","doi-asserted-by":"crossref","unstructured":"John Harrison, HOL Light: A tutorial introduction, in FMCAD 1996 (1996), 265\u2013269.","DOI":"10.1007\/BFb0031814"},{"key":"21_CR28","doi-asserted-by":"crossref","unstructured":"John Harrison, Towards self-verification of HOL light, in IJCAR 2006 (2006), 177\u2013191","DOI":"10.1007\/11814771_17"},{"key":"21_CR29","unstructured":"John Harrison, s2n-bignum (2021)."},{"key":"21_CR30","unstructured":"John Harrison, Invert modulo m (2021), software for 64-bit ARM."},{"key":"21_CR31","unstructured":"John Harrison, Invert modulo m (2021), software for 64-bit AMD\/Intel."},{"key":"21_CR32","doi-asserted-by":"crossref","unstructured":"C. A. R. Hoare, An axiomatic basis for computer programming, CACM 12 (1967), 576\u2013580.","DOI":"10.1145\/363235.363259"},{"key":"21_CR33","doi-asserted-by":"crossref","unstructured":"Cesare Huang, Untitled (2026).","DOI":"10.55277\/researchhub.qui0gmza"},{"key":"21_CR34","doi-asserted-by":"crossref","unstructured":"Benjamin Salling Hvass, Diego F. Aranha, Bas Spitters, High-assurance field inversion for curve-based cryptography, in CSF 2023 (2023), 552\u2013567.","DOI":"10.1109\/CSF57540.2023.00008"},{"key":"21_CR35","doi-asserted-by":"crossref","unstructured":"Vincent Hwang, Jiaxiang Liu, Gregor Seiler, Xiaomu Shi, Ming-Hsien Tsai, Bow-Yaw Wang, Bo-Yin Yang, Verified NTT multiplications for NISTPQC KEM lattice finalists: Kyber, SABER, and NTRU, IACR Transactions on Cryptographic Hardware and Embedded Systems 2022 (2022), 718\u2013750.","DOI":"10.46586\/tches.v2022.i4.718-750"},{"key":"21_CR36","doi-asserted-by":"crossref","unstructured":"Burton S. Kaliski, The Montgomery inverse and its applications, IEEE Transactions on Computers 44 (1995), 1064\u20131065.","DOI":"10.1109\/12.403725"},{"key":"21_CR37","unstructured":"Donald E. Knuth, The art of computer programming, volume 2: seminumerical algorithms, 3rd edition, Addison-Wesley, 1997."},{"key":"21_CR38","doi-asserted-by":"crossref","unstructured":"Derrick H. Lehmer, Euclid\u2019s algorithm for large numbers, American Mathematical Monthly 45 (1938), 227\u2013233.","DOI":"10.1080\/00029890.1938.11990797"},{"key":"21_CR39","doi-asserted-by":"crossref","unstructured":"Victor S. Miller, Use of elliptic curves in cryptography, in Crypto 1985 (1986), 417\u2013426.","DOI":"10.1007\/3-540-39799-X_31"},{"key":"21_CR40","doi-asserted-by":"crossref","unstructured":"Kit Murdock, David F. Oswald, Flavio D. Garcia, Jo Van Bulck, Daniel Gruss, Frank Piessens, Plundervolt: software-based fault injection attacks against Intel SGX, in IEEE S&P 2020 (2020), 1466\u20131482.","DOI":"10.1109\/SP40000.2020.00057"},{"key":"21_CR41","doi-asserted-by":"crossref","unstructured":"Magnus O. Myreen, Anthony C. J. Fox, Michael J. C. Gordon, Hoare logic for ARM machine code, in FSEN 2007 (2007), 272\u2013286.","DOI":"10.1007\/978-3-540-75698-9_18"},{"key":"21_CR42","doi-asserted-by":"crossref","unstructured":"Kaushik Nath, Palash Sarkar, Efficient arithmetic in (pseudo-)Mersenne prime order fields, Advances in Mathematics of Communications 16 (2022), 303\u2013348.","DOI":"10.3934\/amc.2020113"},{"key":"21_CR43","unstructured":"Russell O\u2019Connor, Andrew Poelstra, A formal proof of safegcd bounds (2021)."},{"key":"21_CR44","unstructured":"Russell O\u2019Connor, Andrew Poelstra, Formal verification of the Safegcd implementation (2025)."},{"key":"21_CR45","unstructured":"OpenSSL Project team, OpenSSL Release Announcement for 3.6.1, 3.5.5, 3.4.4, 3.3.6, 3.0.19, 1.1.1ze and 1.0.2zn (2026)."},{"key":"21_CR46","unstructured":"Tavis Ormandy, Zenbleed (2023)."},{"key":"21_CR47","unstructured":"Thomas Pornin, Optimized binary GCD for modular inversion (2020)."},{"key":"21_CR48","doi-asserted-by":"crossref","unstructured":"Ronald L. Rivest, Adi Shamir, Leonard M. Adleman, A method for obtaining digital signatures and public-key cryptosystems, CACM 21 (1978), 120\u2013126.","DOI":"10.1145\/359340.359342"},{"key":"21_CR49","doi-asserted-by":"crossref","unstructured":"Martin Roetteler, Michael Naehrig, Krysta M. Svore, Kristin E. Lauter, Quantum resource estimates for computing elliptic curve discrete logarithms, in ASIACRYPT 2017 (2017), 241\u2013270.","DOI":"10.1007\/978-3-319-70697-9_9"},{"key":"21_CR50","doi-asserted-by":"crossref","unstructured":"Alexey Solovyev, Thomas C. Hales, Efficient formal verification of bounds of linear programs, in MKM 2011 (2011), 123\u2013132.","DOI":"10.1007\/978-3-642-22673-1_9"},{"key":"21_CR51","doi-asserted-by":"crossref","unstructured":"Josef Stein, Computational problems associated with Racah algebra, Journal of Computational Physics 1 (1967), 397\u2013405.","DOI":"10.1016\/0021-9991(67)90047-2"},{"key":"21_CR52","doi-asserted-by":"crossref","unstructured":"Falko Strenzke, Timing attacks against the syndrome inversion in code-based cryptosystems, in PQCrypto 2013 (2013), 217\u2013230.","DOI":"10.1007\/978-3-642-38616-9_15"},{"key":"21_CR53","doi-asserted-by":"crossref","unstructured":"Ming-Hsien Tsai, Bow-Yaw Wang, Bo-Yin Yang, Certified verification of algebraic properties on low-level mathematical constructs in cryptographic programs, in CCS 2017 (2017), 1973\u20131987.","DOI":"10.1145\/3133956.3134076"},{"key":"21_CR54","doi-asserted-by":"crossref","unstructured":"Jan Wichelmann, Ahmad Moghimi, Thomas Eisenbarth, Berk Sunar, MicroWalk: a framework for finding side channels in binaries, in ACSAC 2018 (2018), 161\u2013173.","DOI":"10.1145\/3274694.3274741"},{"key":"21_CR55","unstructured":"Davey Winder, Warning: Google researcher drops Windows 10 zero-day security bomb (2019)."}],"container-title":["Lecture Notes in Computer Science","Advances in Cryptology \u2013 EUROCRYPT 2026"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-25336-1_21","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T13:12:03Z","timestamp":1778245923000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-25336-1_21"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"ISBN":["9783032253354","9783032253361"],"references-count":55,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-25336-1_21","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]},"assertion":[{"value":"9 May 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"EUROCRYPT","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Annual International Conference on the Theory and Applications of Cryptographic Techniques","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Rome","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Italy","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2026","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"10 May 2026","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"14 May 2026","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"45","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"eurocrypt2026","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/eurocrypt.iacr.org\/2026\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}