Fast Continuous Scalar Multiplication Algorithms on Twisted Edwards Elliptic Curve

This paper presents a new efficient implementation approach of elliptic curve cryptosystem based on a novel finite field multiplication and a high performance scalar multiplication algorithm for wireless network authentication. In this new finite field multiplication, CLNZ sliding window method is used on the signed-digit multiplier in order to reduce the multiplication steps. In addition, in scalar multiplication algorithm of proposed implementation approach, point addition and point doubling operation compute in parallel. Also window technique and signed-digit representation are used in order to reduce the number of point operation. So the multiplication cost in the proposed implementation approach reduced considerably. Using this new implementation approach, the security of the elliptic curve cryptosystem increased considerably. The results show that the proposed finite field multiplication reduces the number of multiplication steps at about 40%–82.4% for d=2–10 in compare with Montgomery modular multiplication algorithm. In addition, the efficiency of the proposed implementation approach of elliptic curve cryptosystem enhances about 88%-97% in compare with the implementation approach of traditional window NAF elliptic curve scalar multiplication algorithm and enhances about 77% in compare with the implementation approach of window NAF elliptic curve scalar multiplication algorithm (based on interleaving) where w=4 and 8, and d=8.

Elliptic curve cryptosystems (ECCs) are becoming more popular because of the reduced number of key bits required in comparison to other cryptosystems (e.g. a 160 bit ECC has roughly the same security as 1024 bit RSA). ECCs are especially suited to smart cards because of the limited memory and computational power available on these devices. However, the side-channel attacks which have recently been proposed can obtain information about the cryptosystem by measuring side-channel information such as power consumption and processing time. This information may be used to break implementations that have not incorporated defences against these attacks. This paper presents a new defence against Simple Power Analysis (SPA). This new defence is based on the NAF (non-adjacent form) representation of a scalar and requires 44% fewer additions and 11% extra doublings than the commonly recommended defence of performing a point addition in every loop of the binary scalar multiplication algorithm.

We propose to represent a scalar in the form of d (1/2)(superscript a)3(superscript b), where a and b are integers and d is an odd integer belonging to a given set. This representation is a combination of the extended double-base number system (DBNS) and the double-base chain representation using powers of 1/2 and 3. Experimental results show that our approach leads to a shorter DBNS expansion and a lower complexity in elliptic curve scalar multiplication, with the cost of only a few pre-computations and storages. This contributes to the efficient implementation of elliptic curve cryptography (ECC).

We present a high-speed public-key cryptoprocessor that exploits three-level parallelism in Elliptic Curve Cryptography (ECC) over GF(2 n ). The proposed cryptoprocessor employs a Parallelized Modular Arithmetic Logic Unit (P-MALU) that exploits two types of different parallelism for accelerating modular operations. The sequence of scalar multiplications is also accelerated by exploiting Instruction-Level Parallelism (ILP) and processing multiple P-MALU instructions in parallel. The system is programmable and hence independent of the type of the elliptic curves and scalar multiplication algorithms. The synthesis results show that scalar multiplication of ECC over GF(2163) on a generic curve can be computed in 20 and 16 μs respectively for the binary NAF (Non-Adjacent Form) and the Montgomery method. The performance can be accelerated furthermore on a Koblitz curve and reach scalar multiplication of 12 μs with the TNAF (τ-adic NAF) method. This fast performance allows us to perform over 80,000 scalar multiplications per second and to enhance security in wireless mobile applications.

This paper presents a novel diversity controlled (DC) genetic algorithm (GA) for the optimization of frequency-response masking (FRM) FIR digital filters over the double base number system (DBNS) multiplier coefficient space. The use of DBNS multiplier coefficients reduces the complexity and power consumption in the hardware implementation of the resulting FRM FIR digital filters. A direct application of GAs to the design of FRM FIR digital filters may result in chromosomes which do not conform to the DBNS format due to the underlying crossover and mutation operations. The proposed algorithm uses a DBNS based indexed look-up table (LUT) to ensure generation of valid DBNS multiplier coefficients through out the course of genetic optimization. An application example is given for the design of an FRM FIR lowpass digital filter. The resulting FIR digital filter outperforms a corresponding infinite-precision digital filter obtained by using the Parks-McClellan technique.

This work presents an evaluation of different software implementations of algorithms to compute the most demanding operation in cryptographic schemes based on Elliptic Curve Cryptography (ECC), the scalar multiplication. Five different methods were studied, including traditional and more sophisticated methods for elliptic curve cryptography defined over prime and binary fields. For evaluation, the key generation algorithm in ECC consisting on a single scalar multiplication was implemented on a P500h LG smarthphone, which includes an ARM processor running at 600MHz. Both execution time and memory usage was evaluated. It was found that in general, scalar multiplication runs 8 times faster for ECC defined over prime fields, being the NAF the best performer method. For ECC over binary fields, the best performer method was wNAF. The results presented in this work could help a designer to select the most appropriate method when implementing ECC-based cryptographic schemes such as encryption or digital signatures on mobile devices like smartphones, meeting implementation requirements in terms of execution time and memory usage.

The first step in elliptic curve scalar multiplication algorithms based on scalar decompositions using efficient endomorphisms—including Gallant–Lambert–Vanstone (GLV) and Galbraith–Lin–Scott (GLS) multiplication, as well as higher-dimensional and higher-genus constructions—is to produce a short basis of a certain integer lattice involving the eigenvalues of the endomorphisms. The shorter the basis vectors, the shorter the decomposed scalar coefficients, and the faster the resulting scalar multiplication. Typically, we use the eigenvalues to write down a long basis, which we then reduce using the Euclidean algorithm, Gauss reduction, LLL, or even a more specialized algorithm. In this work, we use elementary facts about quadratic rings to immediately write down a short basis for the elliptic curve GLV, GLS, GLV+GLS, and Q \mathbb {Q} -curve constructions, and for genus 2 real multiplication constructions. We do not pretend that this represents a significant optimization in scalar multiplication, since the lattice reduction step is always an offline precomputation—but it does give a better insight into the structure of scalar decompositions. In any case, it is always more convenient to use a ready-made short basis than it is to compute a new one.

In this paper we introduce scalar multiplication algorithms for several classes of elliptic and hyperelliptic curves. The methods are variations on Yao's scalar multiplication algorithm where independent group operations are shown in an explicit way. We can thusmerge several group operations and reduce the number of field operations by means of Montgomery's trick. The results are that scalar multiplication on elliptic curves in even characteristic based on point halving can be improved by at least 10% and the performance of Koblitz curves by 25% to 32%.

Elliptic Curve Cryptography operations rely heavily on the strong security of scalar multiplication. However, this operation is vulnerable to side channel (SCA) and fault injection (FA) attacks. The use of alternative arithmetic systems like Residue Number System (RNS) for all scalar multiplication underline operations has been proposed as an efficient countermeasure approach for the above attacks. In RNS, a number is represented as a set of smaller numbers, where each one is the result of the modular reduction with a given moduli basis. Under certain requirements, a number can be uniquely transformed from the integers to the RNS domain (and vice versa) and all arithmetic operations can be performed in RNS. This representation provides an inherent SCA and FA resistance to many attacks and can be further enhanced by additional RNS arithmetic manipulations or more traditional algorithmic countermeasures. In this paper, extending our previous work, we explore the potentials of RNS as an SCA and FA countermeasure. A description of RNS based SCA and FA resistance means is provided through appropriate scalar multiplication algorithmic variations, traces of the proposed algorithm are collected and the results are analyzed regarding the RNS countermeasure strength. More specifically, in this paper, a secure RNS based Montgomery Power Ladder based scalar multiplication algorithm is provided and is implemented on an ARM Cortex A7 processor. The implementation SCA-FA resistance is evaluated by collecting preliminary leakage trace results that validate our initial assumptions.

We present normal forms for elliptic curves over a field of characteristic 2 analogous to Edwards normal form, and determine bases of addition laws, which provide strikingly simple expressions for the group law. We deduce efficient algorithms for point addition and scalar multiplication on these forms. The resulting algorithms apply to any elliptic curve over a field of characteristic 2 with a 4-torsion point, via an isomorphism with one of the normal forms. We deduce algorithms for duplication in time 2M + 5S + 2m c and for addition of points in time 7M + 2S, where M is the cost of multiplication, S the cost of squaring, and m c the cost of multiplication by a constant. By a study of the Kummer curves \(\mathcal{K}\) = E/{[±1]}, we develop an algorithm for scalar multiplication with point recovery which computes the multiple of a point P with 4M + 4S + 2m c + m t per bit where m t is multiplication by a constant that depends on P.

By applying interleaving to Window TNAF Algorithm, this paper advances a new scalar multiplication algorithm. The algorithm has no precomputation, just exerts interleaving at the evaluation stage. Because of high performance of Frobenius map, additionally making use of interleaving, efficiency of the new algorithm is higher than traditional window algorithm.

Mixed coordinates strategy is known as a useful technique for efficient scalar multiplications in the elliptic curve cryptography. It splits a scalar multiplication algorithm into a few parts, and performs each part in the best coordinate system. Direct computation is also known as a useful technique for efficient scalar multiplications. This technique directly computes points of the form 2/sup k/P or 2P + Q from points P and Q of an elliptic curve. This paper applies the mixed coordinates strategy to direct computations and gives an efficient scalar multiplication algorithm. More concretely, we find an optimal combination of coordinate systems for direct computations.

The Montgomery Ladder is widely used for implementing the scalar multiplication in elliptic curve cryptographic designs. This algorithm is efficient and provides a natural robustness against (simple) side-channel attacks. Previous works however showed that implementations of the Montgomery Ladder using Lopez-Dahab projective coordinates easily leak the value of the most significant bits of the secret scalar, which led to a full key recovery in an attack known as LadderLeak [3]. In light of such leakage, we analyse further popular methods for implementing the Montgomery Ladder. We first consider open source software implementations of the X25519 protocol which implement the Montgomery Ladder based on the ladderstep algorithm from Düll et al. [15]. We confirm via power measurements that these implementations also easily leak the most significant scalar bits, even when implementing Z-coordinate randomisations. We thus propose simple modifications of the algorithm and its handling of the most significant bits and show the effectiveness of our modifications via experimental results. Particularly, our re-designs of the algorithm do not incurring significant efficiency penalties. As a second case study, we consider open source hardware implementations of the Montgomery Ladder based on the complete addition formulas for prime order elliptic curves, where we observe the exact same leakage. As we explain, the most significant bits in implementations of the complete addition formulas can be protected in an analogous way as we do for Curve25519 in our first case study.KeywordsECCMontgomery LadderCurve25519Complete addition formulasSide-channel analysis

Wireless Sensor Networks (WSN's) are resource constrained networks, demanding energy efficient cryptographic algorithms in order to extend security to them. When compared with the popular RSA algorithm, Elliptic Curve Cryptography (ECC) offers similar level of security with smaller key size requirements. An efficient implementation of ECC heavily relies on the scalar multiplication operation. An efficient method for the elliptic curve point multiplication operation is proposed and its resource requirements are compared with binary and non-adjacent form (NAF) techniques. While comparing these, addition and doubling operations are considered. The proposed scalar multiplication technique makes use of both affine and projective coordinate systems while carrying out addition and doubling operations. The number of computations required to perform these operations is compared and an appropriate coordinate system is chosen for each of the operations.

We present new algorithms computing 3P and $$2P+Q$$2P+Q by removing the same part of numerators and denominators of their formulas, given two points P and Q on elliptic curves defined over prime fields and binary fields in affine coordinates. Our algorithms save one or two field multiplications compared with ones presented by Ciet, Joye, Lauter, and Montgomery. Since $$2P+Q$$2P+Q takes $$\frac{1}{3}$$13 proportion, 28.5i¾?% proportion, and 25.8i¾?% proportion of all point operations by non-adjacent form, binary/ternary approach and tree approach to compute scalar multiplications respectively, 3P occupies 42.9i¾?% proportion and 33.4i¾?% proportion of all point operations by binary/ternary approach and tree approach to compute scalar multiplications respectively, utilizing our new formulas of $$2P+Q$$2P+Q and 3P, scalar multiplications by using non-adjacent form, binary/ternary approach and tree approach are improved.