Is there a benefit in cryptography to return 0 in square and mutliply algorithm when a modulo is 0?

Question

When a modulo is 0, the result of squaring or multiplying modulo will always be 0 as well. Therefore the loop could break and return 0. It can be a mean to compute faster the result of square and multiply modular exponentiation at a negligible cost of comparing the modulo to 0. Perhaps, using large prime numbers like for RSA keys, there is no chance to have a modulo equal to 0?

Answer 1

TL;DR The modulus size defines the key size the key pair generator would be faulty if the modulus would be even a bit lower than that.

For RSA the modulus is $n = p \cdot q$. $p$ and $q$ should be random primes of about half the size of the modulus. Generally those primes are found by drawing a random value of about half the size and then find a prime near to that value, as the percentage of primes doesn't go down as fast as with the modulus size.

Now choosing a random that is about half the size of the modulus is best easily performed by simply setting the most significant bit of the prime to 1 (e.g. bit 2048 for a key size / modulus size, i.e. choosing a random between 2^2048 and 2^2049 exclusive) and randomizing the other bits, then choosing a range of integers starting from that value to test for primality (in the unlikely event that this fails restart). That way it is certain that the 4096th bit will be set, and there is still 4096 bits of randomness utilized.

However, as you can see, neither of these methods will ever generate an $n$ of zero, so the chance of that happening is also zero.

Answer 2

Is there a benefit ...

Only if the divisor is part of parameter, rather than ciphergram (i.e. key, plain/cipher-text).

Division is a difficult to optimize operation, and pretty much all post-quantum cryptosystems avoid it when processing data. For ML-DSA/Dilithium and ML-KEM/Kyber, the only division operations are when computing remainder of a coefficient modulo the parameters of the cryptosystem, and this parameter is public and shared across all instances of the keypair.