Fast Endomorphisms in Integer Sub-Decomposition Method on Secp192k1

The first step in elliptic curve scalar multiplication algorithms based on scalar decompositions using efficient endomorphisms—including Gallant–Lambert–Vanstone (GLV) and Galbraith–Lin–Scott (GLS) multiplication, as well as higher-dimensional and higher-genus constructions—is to produce a short basis of a certain integer lattice involving the eigenvalues of the endomorphisms. The shorter the basis vectors, the shorter the decomposed scalar coefficients, and the faster the resulting scalar multiplication. Typically, we use the eigenvalues to write down a long basis, which we then reduce using the Euclidean algorithm, Gauss reduction, LLL, or even a more specialized algorithm. In this work, we use elementary facts about quadratic rings to immediately write down a short basis for the elliptic curve GLV, GLS, GLV+GLS, and Q \mathbb {Q} -curve constructions, and for genus 2 real multiplication constructions. We do not pretend that this represents a significant optimization in scalar multiplication, since the lattice reduction step is always an offline precomputation—but it does give a better insight into the structure of scalar decompositions. In any case, it is always more convenient to use a ready-made short basis than it is to compute a new one.

Pseudo-random scalar multiplication based on group isomorphism

We present a high-speed public-key cryptoprocessor that exploits three-level parallelism in Elliptic Curve Cryptography (ECC) over GF(2 n ). The proposed cryptoprocessor employs a Parallelized Modular Arithmetic Logic Unit (P-MALU) that exploits two types of different parallelism for accelerating modular operations. The sequence of scalar multiplications is also accelerated by exploiting Instruction-Level Parallelism (ILP) and processing multiple P-MALU instructions in parallel. The system is programmable and hence independent of the type of the elliptic curves and scalar multiplication algorithms. The synthesis results show that scalar multiplication of ECC over GF(2163) on a generic curve can be computed in 20 and 16 μs respectively for the binary NAF (Non-Adjacent Form) and the Montgomery method. The performance can be accelerated furthermore on a Koblitz curve and reach scalar multiplication of 12 μs with the TNAF (τ-adic NAF) method. This fast performance allows us to perform over 80,000 scalar multiplications per second and to enhance security in wireless mobile applications.

Elliptic curve cryptography (ECC) can ensure an equivalent security with much smaller key sizes. Elliptic curve scalar multiplication (ECSM) is a fundamental computation used in ECC. This paper focuses on ECSM resisting simple power attack and safe error attack of side-channel attack specifically. Elliptic curve complete addition (CA) formulae can achieve secure ECSM algorithms but are inefficient from memory and computational cost perspectives. Another secure ECSM, which uses (extended) affine, is more efficient for both memory and computational costs. However, it scans input scalars from right to left. In this paper, our developed scalar multiplication algorithms also use their extended affine, but scan from left to right (LR). We also prove the security of our LR ECSM algorithms and analyze them both theoretically and experimentally. Our new LR ECSM algorithms can reduce the amount of memory by \(37.5\%\) and reduce the computational time by more than \(40\%\) compared to Joye’s regular 2-ary LR algorithm with CA formulae.

In this paper we introduce scalar multiplication algorithms for several classes of elliptic and hyperelliptic curves. The methods are variations on Yao's scalar multiplication algorithm where independent group operations are shown in an explicit way. We can thusmerge several group operations and reduce the number of field operations by means of Montgomery's trick. The results are that scalar multiplication on elliptic curves in even characteristic based on point halving can be improved by at least 10% and the performance of Koblitz curves by 25% to 32%.

This work presents an evaluation of different software implementations of algorithms to compute the most demanding operation in cryptographic schemes based on Elliptic Curve Cryptography (ECC), the scalar multiplication. Five different methods were studied, including traditional and more sophisticated methods for elliptic curve cryptography defined over prime and binary fields. For evaluation, the key generation algorithm in ECC consisting on a single scalar multiplication was implemented on a P500h LG smarthphone, which includes an ARM processor running at 600MHz. Both execution time and memory usage was evaluated. It was found that in general, scalar multiplication runs 8 times faster for ECC defined over prime fields, being the NAF the best performer method. For ECC over binary fields, the best performer method was wNAF. The results presented in this work could help a designer to select the most appropriate method when implementing ECC-based cryptographic schemes such as encryption or digital signatures on mobile devices like smartphones, meeting implementation requirements in terms of execution time and memory usage.

Because of their shorter key sizes, cryptosystems based on elliptic curves are being increasingly used in practical applications. A special class of elliptic curves, namely, Koblitz curves, offers an additional but crucial advantage of considerably reduced processing time. In this article, power analysis attacks are applied to cryptosystems that use scalar multiplication on Koblitz curves. Both the simple and the differential power analysis attacks are considered and a number of countermeasures are suggested. While the proposed countermeasures against the simple power analysis attacks rely on making the power consumption for the elliptic curve scalar multiplication independent of the secret key, those for the differential power analysis attacks depend on randomizing the secret key prior to each execution of the scalar multiplication.

With the advent of Elliptic curve cryptography (ECC); it grew unusually quickly because it had a smaller key size compared with that of the RSA cryptography system. Many researches are being done nowadays to make this type of cryptography more efficient. These investigations are about improving efficiency of both algorithm and method of implementations. This paper studies and analyzes some software libraries which support elliptic curve computations. Scalar multiplication is a major operation in ECC. Therefore, this study implements some methods of scalar multiplication by two software libraries LiDIA and MIRACL and compares the results at the end.

The GLV method of Gallant, Lambert, and Vanstone (CRYPTO 2001) computes any multiple kP of a point P of prime order n lying on an elliptic curve with a low-degree endomorphism ? (called GLV curve) over $\mathbb{F}_{p}$ as $$kP = k_1P + k_2\varPhi(P) \quad\text{with } \max \bigl\{ |k_1|,|k_2| \bigr\} \leq C_1\sqrt{n} $$ for some explicit constant C 1>0. Recently, Galbraith, Lin, and Scott (EUROCRYPT 2009) extended this method to all curves over $\mathbb{F}_{p^{2}}$ which are twists of curves defined over $\mathbb{F}_{p}$ . We show in this work how to merge the two approaches in order to get, for twists of any GLV curve over $\mathbb{F}_{p^{2}}$ , a four-dimensional decomposition together with fast endomorphisms ?,? over $\mathbb{F}_{p^{2}}$ acting on the group generated by a point P of prime order n, resulting in a proven decomposition for any scalar k?[1,n] given by $$kP=k_1P+ k_2\varPhi(P)+ k_3\varPsi(P) + k_4\varPsi\varPhi(P) \quad \text{with } \max_i \bigl(|k_i| \bigr) 0. Remarkably, taking the best C 1,C 2, we obtain C 2/C 1<412, independently of the curve, ensuring in theory an almost constant relative speedup. In practice, our experiments reveal that the use of the merged GLV---GLS approach supports a scalar multiplication that runs up to 1.5 times faster than the original GLV method. We then improve this performance even further by exploiting the Twisted Edwards model and show that curves originally slower may become extremely efficient on this model. In addition, we analyze the performance of the method on a multicore setting and describe how to efficiently protect GLV-based scalar multiplication against several side-channel attacks. Our implementations improve the state-of-the-art performance of scalar multiplication on elliptic curves over large prime characteristic fields for a variety of scenarios including side-channel protected and unprotected cases with sequential and multicore execution.

The idea of the GLV method of Gallant, Lambert and Vanstone (Crypto 2001) is considered a foundation stone to build a new procedure to compute the elliptic curve scalar multiplication. This procedure, that is integer sub-decomposition (ISD), will compute any multiple kP of elliptic curve point P which has a large prime order n with two low-degrees endomorphisms ψ1 and ψ2 of elliptic curve E over prime field Fp. The sub-decomposition of values k1 and k2, not bounded by ±Cn, gives us new integers k11, k12, k21 and k22 which are bounded by ±Cn and can be computed through solving the closest vector problem in lattice. The percentage of a successful computation for the scalar multiplication increases by ISD method, which improved the computational efficiency in comparison with the general method for computing scalar multiplication in elliptic curves over the prime fields. This paper will present the mechanism of ISD method and will shed light mainly on the computation complexity of the ISD approach that will be determined by computing the cost of operations. These operations include elliptic curve operations and finite field operations.

Attribute-based blind signature is used to realize the blind signature of messages by multiple people, and it is suitable for electronic payment services in the cloud. Most existing attribute-based blind signature schemes have complex bilinear pairing operations in the process of signature and verification, which leads to low algorithm efficiency. To solve this problem, in this study, an efficient pairing-free attribute-based blind signature scheme based on ordered binary decision diagram is proposed, and the security analysis of the new scheme is given under the difficulty of the elliptic curve discrete logarithm problem (ECDLP). The proposed scheme is based on elliptic curve cryptography (ECC). In this scheme, scalar multiplication on the elliptic curve, which is relatively lightweight, is used to replace bilinear pairing with a large computational cost in traditional attribute-based blind signature schemes. The computational overhead in the signature and verification processes is reduced, making the solution more suitable for resource-constrained cloud terminal user scenarios. On the other hand, in order to improve the computational efficiency of the attribute-based blind signature scheme, a more expressive and computationally efficient ordered binary decision diagram (OBDD) structure is used to construct the access structure of the signer. The OBDD access structure can simultaneously support the positive and negative values of attributes in the access structure at the same time. Compared with existing attribute-based blind signature schemes, the proposed scheme has better performance and storage, and meets the needs of resource-constrained cloud end users.

We introduce Four $$\mathbb {Q}$$ , a high-security, high-performance elliptic curve that targets the 128-bit security level. At the highest arithmetic level, cryptographic scalar multiplications on Four $$\mathbb {Q}$$ can use a four-dimensional Gallant-Lambert-Vanstone decomposition to minimize the total number of elliptic curve group operations. At the group arithmetic level, Four $$\mathbb {Q}$$ admits the use of extended twisted Edwards coordinates and can therefore exploit the fastest known elliptic curve addition formulas over large prime characteristic fields. Finally, at the finite field level, arithmetic is performed modulo the extremely fast Mersenne prime $$p=2^{127}-1$$ . We show that this powerful combination facilitates scalar multiplications that are significantly faster than all prior works. On Intel’s Haswell, Ivy Bridge and Sandy Bridge architectures, our software computes a variable-base scalar multiplication in 59,000, 71,000 cycles and 74,000 cycles, respectively; and, on the same platforms, our software computes a Diffie-Hellman shared secret in 92,000, 110,000 cycles and 116,000 cycles, respectively.

We propose to represent a scalar in the form of d (1/2)(superscript a)3(superscript b), where a and b are integers and d is an odd integer belonging to a given set. This representation is a combination of the extended double-base number system (DBNS) and the double-base chain representation using powers of 1/2 and 3. Experimental results show that our approach leads to a shorter DBNS expansion and a lower complexity in elliptic curve scalar multiplication, with the cost of only a few pre-computations and storages. This contributes to the efficient implementation of elliptic curve cryptography (ECC).

This paper presents a new approach to precompute points [3]P, [5]P, ..., [2k-1]P, for some k ≥ 2 on an elliptic curve over $\mathbb{F}_p$. Those points are required for the efficient evaluation of a scalar multiplication, the most important operation in elliptic curve cryptography. The proposed method precomputes the points in affine coordinates and needs only one single field inversion for the computation. The new method is superior to all known methods that also use one field inversion, if the required memory is taken into consideration. Compared to methods that require several field inversions for the precomputation, the proposed method is faster for a broad range of ratios of field inversions and field multiplications. The proposed method benefits especially from ratios as they occur on smart cards.

In this work, a new graph has been defined as a main point to design a new version of an asymmetric encryption scheme. This graph is formed based on the scalar multiplication operation on elliptic curve defined over a prime field, which is called an elliptic scalar multiplication (ESM) graph. Some mathematical facts to show the ESM graph is a complete graph are proved theoretically. On the complete elliptic scalar multiplication (CESM) graph, an asymmetric encryption algorithm has been implemented. Fast computations on the proposed algorithm are Z obtained through the matrices representation and determination of the minimum spanning tree (MST) to compute the ciphertext. More secure computations with the CESM graphic encryption algorithm in comparison with the previous asymmetric encryption algorithms. So, the CESM graphic asymmetric encryption algorithm is considered as a new sight for elliptic curve cryptographic usages.