A Hardware Efficient Elliptic Curve Accelerator for FPGA Based Cryptographic Applications

This paper presents a new efficient implementation approach of elliptic curve cryptosystem based on a novel finite field multiplication and a high performance scalar multiplication algorithm for wireless network authentication. In this new finite field multiplication, CLNZ sliding window method is used on the signed-digit multiplier in order to reduce the multiplication steps. In addition, in scalar multiplication algorithm of proposed implementation approach, point addition and point doubling operation compute in parallel. Also window technique and signed-digit representation are used in order to reduce the number of point operation. So the multiplication cost in the proposed implementation approach reduced considerably. Using this new implementation approach, the security of the elliptic curve cryptosystem increased considerably. The results show that the proposed finite field multiplication reduces the number of multiplication steps at about 40%–82.4% for d=2–10 in compare with Montgomery modular multiplication algorithm. In addition, the efficiency of the proposed implementation approach of elliptic curve cryptosystem enhances about 88%-97% in compare with the implementation approach of traditional window NAF elliptic curve scalar multiplication algorithm and enhances about 77% in compare with the implementation approach of window NAF elliptic curve scalar multiplication algorithm (based on interleaving) where w=4 and 8, and d=8.

Hardware acceleration of cryptographic algorithms is beneficial because considerable performance improvements can be attained compared to software implementations. Thus, hardware implementations can be used in critical applications requiring high encryption or decryption speeds. Parallel architecture with efficient hardware implementation of Galois field arithmetic operations is used to produce high speed computation time for the scalar multiplication operation which is the main operation in Elliptic Curve Cryptography (ECC) system. This work proposed a modification in karatsuba-ofman algorithm which is one of the best algorithms used to perform multiplication operation over Galois field. The modification contrasted on truncating karatsuba-ofman algorithm in a low level and using the classic polynomial multiplication algorithm. In addition, this work proposed architecture for implementing ECC on hardware using Montgomery algorithm in projective coordinates. The results show that the proposed architecture is able to compute GF(2^191) elliptic curve scalar multiplication operations in 72.939 μs on Xilinx Virtex-II XC2V6000 FPGA device and 100.68 μs on Xilinx VirtexE 2600. Also, the proposed architecture can be changed to be suitable for any arbitrary Galois field size with little modifications.KeywordsGalois fieldElliptic curve cryptographyKaratsuba-Ofman multiplierfield programmable gate arrayspolynomial multiplicationpolynomial inversion

This paper presents a new type of fault attacks on elliptic curves cryptosystems. At EUROCRYPT 2004, Naccache et alii showed that when the result of an elliptic curve scalar multiplication [k] P (computed using a fixed scalar multiplication algorithm, such as double-and-add) is given in projective coordinates, an attacker can recover information on k. The attack is somewhat theoretical, because elliptic curve cryptosystems implementations usually convert scalar multiplication's result back to affine coordinates before outputting [k]P. This paper explains how injecting faults in the final projective-to-affine coordinate conversion enables an attacker to retrieve the projective coordinates of [k]P, making Naccache et alii's attack also applicable to implementations that output points in affine coordinates. As a result, such faults allow the recovery of information about k.

Parallelization of scalable elliptic curve cryptosystem processors in GF(2m)

In this paper we introduce scalar multiplication algorithms for several classes of elliptic and hyperelliptic curves. The methods are variations on Yao's scalar multiplication algorithm where independent group operations are shown in an explicit way. We can thusmerge several group operations and reduce the number of field operations by means of Montgomery's trick. The results are that scalar multiplication on elliptic curves in even characteristic based on point halving can be improved by at least 10% and the performance of Koblitz curves by 25% to 32%.

Elliptic curve cryptography involves numerous scalar multiplications, incurring high operational costs. In view of this, fast endomorphism is used to represent scalar multiplications, kP on elliptic curves. In the past, techniques such as Gallant-Lambert-Vanstone (GLV) method and Integer Sub-Decomposition (ISD) method have been proposed to reduce the cost of scalar multiplication on elliptic curves by using fast endomorphism. The GLV method employs a single-layer decomposition, breaking k into k1 and k2, while the ISD method uses a bilayer decomposition. The existence of fast endomorphisms which are constructed based on the concept of isogeny increase the computational efficiency of the GLV approach and reduce the operation count on the ISD method. This paper embeds the fast endomorphisms in the scalar multiplications on one of the family of elliptic curves with j-invariant 0, E0, which is the 192-bit Koblitz curve (Secp192k1). The performance of the ISD method in computing certain scalar multiplications on Secp192k1 in conjunction with fast endomorphisms and other various techniques such as binary representation, NAF representation, w-NAF and sliding windows are computed. The results demonstrated that the ISD method together with fast endomorphism, yields the most promising outcomes. This underscores the advantages of using fast endomorphisms in the ISD method on E0. .

Pseudo-random scalar multiplication based on group isomorphism

The first step in elliptic curve scalar multiplication algorithms based on scalar decompositions using efficient endomorphisms—including Gallant–Lambert–Vanstone (GLV) and Galbraith–Lin–Scott (GLS) multiplication, as well as higher-dimensional and higher-genus constructions—is to produce a short basis of a certain integer lattice involving the eigenvalues of the endomorphisms. The shorter the basis vectors, the shorter the decomposed scalar coefficients, and the faster the resulting scalar multiplication. Typically, we use the eigenvalues to write down a long basis, which we then reduce using the Euclidean algorithm, Gauss reduction, LLL, or even a more specialized algorithm. In this work, we use elementary facts about quadratic rings to immediately write down a short basis for the elliptic curve GLV, GLS, GLV+GLS, and Q \mathbb {Q} -curve constructions, and for genus 2 real multiplication constructions. We do not pretend that this represents a significant optimization in scalar multiplication, since the lattice reduction step is always an offline precomputation—but it does give a better insight into the structure of scalar decompositions. In any case, it is always more convenient to use a ready-made short basis than it is to compute a new one.

Elliptic curve cryptosystems have gained increase attention and have become an intense area of research, mainly because of their shorter key length when compared to other public key cryptosystems such as RSA. Shorter key length brings advantages such as reduced computation effort, power consumption and storage requirements, making it possible to increase the available security for portable devices, smartcards and other power strained devices. ECC manages to cover all the significant cryptographic operations such as key exchange and agreement or digital signature with greater efficiency than previous systems. These operations rely heavily on point multiplication which is also the most time-consuming operation. This paper evaluates point operations (doubling, tripling, quadrupling, and addition) and proposes an algorithm for combining the operations in order to achieve faster scalar multiplication when compared to the standard algorithm for scalar multiplication of double and add.

Elliptic curve cryptography (ECC) can ensure an equivalent security with much smaller key sizes. Elliptic curve scalar multiplication (ECSM) is a fundamental computation used in ECC. This paper focuses on ECSM resisting simple power attack and safe error attack of side-channel attack specifically. Elliptic curve complete addition (CA) formulae can achieve secure ECSM algorithms but are inefficient from memory and computational cost perspectives. Another secure ECSM, which uses (extended) affine, is more efficient for both memory and computational costs. However, it scans input scalars from right to left. In this paper, our developed scalar multiplication algorithms also use their extended affine, but scan from left to right (LR). We also prove the security of our LR ECSM algorithms and analyze them both theoretically and experimentally. Our new LR ECSM algorithms can reduce the amount of memory by \(37.5\%\) and reduce the computational time by more than \(40\%\) compared to Joye’s regular 2-ary LR algorithm with CA formulae.

The hardware ‑ software codesign of cryptosistems, is the best solution to reach a reasonable yield in systems with resources limitation. In the last years, the cryptosistems based on elliptic curves (CEE) have acquired an increasing importance, managing at present to form a part of the industrial standards. In the underlying finite field of an CEE squaring and field multiplication is the next computational costly operations other than field inversion. This paper presents an algorithm for multiplication in binary fields GF(2^m) using a polynomial basis representation and with interleaving reduction. The finite field multiplier operates over a variety of binary fields and it is scalable.

We propose to represent a scalar in the form of d (1/2)(superscript a)3(superscript b), where a and b are integers and d is an odd integer belonging to a given set. This representation is a combination of the extended double-base number system (DBNS) and the double-base chain representation using powers of 1/2 and 3. Experimental results show that our approach leads to a shorter DBNS expansion and a lower complexity in elliptic curve scalar multiplication, with the cost of only a few pre-computations and storages. This contributes to the efficient implementation of elliptic curve cryptography (ECC).

We present normal forms for elliptic curves over a field of characteristic 2 analogous to Edwards normal form, and determine bases of addition laws, which provide strikingly simple expressions for the group law. We deduce efficient algorithms for point addition and scalar multiplication on these forms. The resulting algorithms apply to any elliptic curve over a field of characteristic 2 with a 4-torsion point, via an isomorphism with one of the normal forms. We deduce algorithms for duplication in time 2M + 5S + 2m c and for addition of points in time 7M + 2S, where M is the cost of multiplication, S the cost of squaring, and m c the cost of multiplication by a constant. By a study of the Kummer curves \(\mathcal{K}\) = E/{[±1]}, we develop an algorithm for scalar multiplication with point recovery which computes the multiple of a point P with 4M + 4S + 2m c + m t per bit where m t is multiplication by a constant that depends on P.

Overlap-free Karatsuba algorithm (OFKA) is one of the Karatsuba algorithms (KAs) which can be employed to reduce the computation complexity of fast/high-precision polynomial based multiplication (the space complexity of the product can be reduced from O(m^2) to O(m^log2^3)). Meanwhile, digit-level (DL) finite field multipliers over GF(2^m), generally can be categorized as DL parallel-in serial-out (DL-PISO) and DL serial-in parallel-out (DL-SIPO) styles, have gained substantial attentions in cryptographic related applications (such as elliptic curve cryptosystem (ECC)) recently due to their efficient performance in area-delay tradeoffs. In this paper, aim at deriving an efficient DL-PISO multiplier with sub-quadratic space complexity, we present a novel polynomial basis multiplication through a combination of three coherent interdependent efforts. First of all, a novel bivariate polynomial multiplication algorithm using two steps of reduction is presented. Then, a new DL-PISO polynomial basis multiplication algorithm using OFKA over GF(2^m) is introduced as well as its corresponding structure. Finally, the complexity and comparison are detailed given to confirm the efficiency of the proposed DL-PISO multiplier over the existing DL-PISO and DL-SIPO designs, i.e., the proposed one has lower area-delay product (ADP) when compared with the competing ones. The proposed DL-PISO multiplier is highly regular and hence can be applied in many resource-constrained environments.

The GLV method of Gallant, Lambert, and Vanstone (CRYPTO 2001) computes any multiple kP of a point P of prime order n lying on an elliptic curve with a low-degree endomorphism ? (called GLV curve) over $\mathbb{F}_{p}$ as $$kP = k_1P + k_2\varPhi(P) \quad\text{with } \max \bigl\{ |k_1|,|k_2| \bigr\} \leq C_1\sqrt{n} $$ for some explicit constant C 1>0. Recently, Galbraith, Lin, and Scott (EUROCRYPT 2009) extended this method to all curves over $\mathbb{F}_{p^{2}}$ which are twists of curves defined over $\mathbb{F}_{p}$ . We show in this work how to merge the two approaches in order to get, for twists of any GLV curve over $\mathbb{F}_{p^{2}}$ , a four-dimensional decomposition together with fast endomorphisms ?,? over $\mathbb{F}_{p^{2}}$ acting on the group generated by a point P of prime order n, resulting in a proven decomposition for any scalar k?[1,n] given by $$kP=k_1P+ k_2\varPhi(P)+ k_3\varPsi(P) + k_4\varPsi\varPhi(P) \quad \text{with } \max_i \bigl(|k_i| \bigr) 0. Remarkably, taking the best C 1,C 2, we obtain C 2/C 1<412, independently of the curve, ensuring in theory an almost constant relative speedup. In practice, our experiments reveal that the use of the merged GLV---GLS approach supports a scalar multiplication that runs up to 1.5 times faster than the original GLV method. We then improve this performance even further by exploiting the Twisted Edwards model and show that curves originally slower may become extremely efficient on this model. In addition, we analyze the performance of the method on a multicore setting and describe how to efficiently protect GLV-based scalar multiplication against several side-channel attacks. Our implementations improve the state-of-the-art performance of scalar multiplication on elliptic curves over large prime characteristic fields for a variety of scenarios including side-channel protected and unprotected cases with sequential and multicore execution.