KEVOS
ArticlesServicesCase studiesAboutContact
ArticlesServicesCase studiesAboutContact
← ArticlesModular Inversion and Simultaneous InversionEngineering · Engineering MathematicsLesson 723/884← PrevNext →
ArticlePublished 7 Aug 20262 min readBy Kevin Joginmodular inversesimultaneous inversionMontgomery trickbatch inversion
On this page

Ask about this page

KEVOS AIModular Inversion and Simultaneous Inversion

KEVOS knowledge first · trusted web sources when needed

Euclidean Algorithms and Congruences

Modular Inversion and Simultaneous Inversion

Computing modular inverses, and Montgomery's trick for inverting many elements at the cost of one inversion plus multiplications.

Engineering / MathematicsEuclidean Algorithms and Congruences2 min readKV-MATH-0522

Modular inversion is substantially more expensive than modular multiplication. When many inverses are needed, Montgomery's simultaneous inversion trick replaces all but one of them with multiplications — a decisive saving in elliptic curve work.

Single inversion

The inverse of a modulo N is obtained from the extended Euclidean algorithm. An alternative for prime moduli is exponentiation by p - 2, using Fermat's little theorem.

Single modular inversion methods
MethodCostApplicability
Extended EuclideanRoughly a GCDAny modulus
ExponentiationAbout log p multiplicationsPrime modulus only
Binary extendedShifts and subtractionsAny odd modulus; good without fast division

Cost

Inversion typically costs somewhere between ten and a hundred modular multiplications depending on implementation. Treating the two as comparable in an algorithm design is a mistake.

Simultaneous inversion

Montgomery's trick inverts k elements using one inversion and about 3k multiplications.

Montgomery's simultaneous inversion

  1. Accumulate prefixesCompute running products of the inputs, storing each partial product.
  2. Invert onceInvert the final total product — the only inversion performed.
  3. UnwindWalk backwards, recovering each individual inverse by multiplying the running inverse by the stored prefix, then removing that element from the running inverse.
Cost = 1 inversion + about 3k multiplicationsAgainst k inversions for the naive approach.

Key point

The break-even point is small — typically three or four elements. Beyond that the trick is essentially always worth using.

The failure mode is the point

Caution

If any input is not invertible, the accumulated product is not invertible either and the whole batch fails. In general code this is a hazard requiring a fallback. In ECM it is the intended outcome: the GCD revealed by the failure is a factor of the modulus.

Avoiding inversion entirely

Projective coordinates on elliptic curves defer inversion by carrying a denominator through the group law, requiring only one inversion at the very end. This is the standard approach where inversion is expensive — see elliptic curve arithmetic modulo N.

Source. Henri Cohen, A Course in Computational Algebraic Number Theory, Springer GTM 138 — 1.3.3. Structural reference unverified: the source file was not available during authoring; chapter and section numbers are taken from the published edition and have not been checked against a physical copy.

Related pages

  • Gaussian Elimination over Finite Fields
  • Elliptic Curve Arithmetic Modulo N
  • Solving Quadratic Congruences

Continue learning

Solving Quadratic CongruencesArticle · Engineering MathematicsNEXT LESSON →Finite Field Element RepresentationArticle · Engineering MathematicsSquare Roots Modulo a Prime: the Shanks-Tonelli AlgorithmArticle · Engineering MathematicsFinite Field Multiplication and InversionArticle · Engineering Mathematics
KEVOS · Engineering, manufacturing and project improvement
ArticlesServicesCase studiesAboutContact
© 2026 KEVOS®