Fast Tate Pairing Computation on Twisted Jacobi Intersections Curves

Faster computation of the Tate pairing

An addition law for an elliptic curve is complete if it is defined for all possible pairs of input points on the elliptic curve. In Elliptic Curve Cryptography (ECC), a complete addition law provides a natural protection against side-channel attacks which are based on Simple Power Analysis (SPA). Montgomery curves are a specific family of elliptic curves that play a crucial role in ECC because of its well-known Montgomery ladder, particularly in the Elliptic Curve Diffie-Hellman Key Exchange (ECDHKE) protocol and the Elliptic Curve factorization Method (ECM). However, the complete addition law for Montgomery curves, as stated in the literature, has a computational cost of 14M+ 2D, where M,D denote the costs of a field multiplication and a field multiplication by a constant, respectively. The lack of a competitive complete addition law has led implementers towards twisted Edwards curves, which offer a complete addition law at a lower cost of 8M+ 1D for appropriately chosen curve constants.In this paper, we introduce extended Montgomery coordinates as a novel representation for points on Montgomery curves. This coordinate system enables us to define birational multiplication-free maps between the extended twisted Edwards coordinates and extended Montgomery coordinates. Using this map, we can transfer the complete addition laws from twisted Edwards curves to Montgomery curves without incurring additional multiplications or squarings. In addition, we employ a technique known as scaling to refine the addition laws for twisted Edwards curves, which results in having i) Complete addition laws with the costs varying between 8M+1D and 9M+1D for a broader range of twisted Edwards curves, ii) Incomplete addition laws for twisted Edwards curves with the cost of 8M. Consequently, by leveraging our birational multiplication-free maps, we present complete addition laws for Montgomery curves with the cost of 8M+1D. This shows a significant improvement for complete addition law for Montgomery curves by reducing the computational cost by 6M+ 1D. This improvement makes Montgomery curves a more attractive option for applications where an efficient complete addition law is essential.

The properties of the Tate pairing are applied to various cryptographic systems. The problem is that the Tate pairing computation is expensive operation, and various methods for faster computation have been proposed. However their actual methods are not so clear. In this paper, we combined their methods and our technique for implementation to apply the program of computing Tate pairing. We evaluated the performance and compared the contribution of each method. There is a case, which yields slower computation caused by overheads of implementation. Consequently we obtained the result of 70% reduction of calculation of Tate pairing in total and showed that Tate pairing has practical applicability.

Most implementations of pairing-based cryptography are using pairing-friendly curves with an embedding degree k ≤ 12. They have security levels of up to 128 bits. In this paper, we consider a family of pairing-friendly curves with embedding degree k = 24, which have an enhanced security level of 192 bits. We also describe an efficient implementation of Tate and Ate pairings using field arithmetic in \(F_{q^{24}}\); this includes a careful selection of the parameters with small hamming weight and a novel approach to final exponentiation, which reduces the number of computations required.

A pairing over an elliptic curve E(F <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pm</sub> ) to an extension field of F <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pmk</sub> has begun to be attractive in cryptosystems, where k is called the embedding degree. The cryptosystems using a pairing are called the pairing-based cryptosystems. The embedding degree k is also an indicator of the relationship between the elliptic curve discrete logarithm problem (ECDLP) and the discrete logarithm problem (DLP), where ECDLP over E(F <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pm</sub> ) is reduced to DLP over F <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pmk</sub> . An elliptic curve is determined by j-invarient or order, however the explicit condition between these parameters and an embedding degree has been described only in some degrees. In this paper, we investigate a new condition of the existence of elliptic curves with pre-determined embedding degrees, and present some examples of the elliptic curves over 160-bit, 192-bit and 224-bit F <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pm</sub> .

The η T pairing on supersingular is one of the most efficient algorithms for computing the bilinear pairing [3]. The η T pairing defined over finite field \({\mathbb F}_{3^n}\) has embedding degree 6, so that it is particularly efficient for higher security with large extension degree n. Note that the explicit algorithm over \({\mathbb F}_{3^n}\) in [3] is designed just for \(n \equiv 1\ (\bmod \ 12)\), and it is relatively complicated to construct an explicit algorithm for \(n \not \equiv 1\ (\bmod \ 12)\). It is better that we can select many n’s to implement the η T pairing, since n corresponds to security level of the η T pairing.In this paper we construct an explicit algorithm for computing the η T pairing with arbitrary extension degree n. However, the algorithm should contain many branch conditions depending on n and the curve parameters, that is undesirable for implementers of the η T pairing. This paper then proposes the universal η T pairing (\(\widetilde{\eta_T}\) pairing), which satisfies the bilinearity of pairing (compatible with Tate pairing) without any branches in the program, and is as efficient as the original one. Therefore the proposed universal η T pairing is suitable for the implementation of various extension degrees n with higher security.KeywordsTate pairingη T pairingDuursma-Lee algorithmefficient implementation

Wireless Sensor Networks (WSNs) pose a number of unique security challenges that demand innovation in several areas including the design of cryptographic primitives and protocols. Despite recent progress, the efficient implementation of Elliptic Curve Cryptography (ECC) for WSNs is still a very active research topic and techniques to further reduce the time and energy cost of ECC are eagerly sought. This paper presents an optimized ECC implementation that we developed from scratch to comply with the severe resource constraints of 8-bit sensor nodes such as the MICAz and IRIS motes. Our ECC software uses Optimal Prime Fields (OPFs) as underlying algebraic structure and supports two different families of elliptic curves, namely Weierstraß-form and twisted Edwards-form curves. Due to the combination of efficient field arithmetic and fast group operations, we achieve an execution time of 5.8 · 106 clock cycles for a full 158-bit scalar multiplication on an 8-bit ATmega128 micro-controller, which is 2.78 times faster than the widely-used TinyECC library. Our implementation also shows that the energy cost of scalar multiplication on a MICAz (or IRIS) mote amounts to just 19~mJ when using a twisted Edwards curve over a 160-bit OPF. This result compares fairly well with the energy figures of two recently-presented hardware designs of ECC based on twisted Edwards curves.

An elliptic curve cryptosystem (ECC) is one of public key cryptosystem, whose security is based on elliptic curve discrete logarithm problem (ECDLP). An elliptic curve is uniquely determined by mathematical parameters such as j-invariant of an elliptic curve. By giving trace of elliptic curve, t, a definition field \(\mathbb F_{p}\), and discriminant D, an elliptic curve with order \(\sharp {E(\mathbb F_{p})} = n\) is determined. Therefore it is an open problem to determine explicit relations between the mathematical parameters and the embedding degrees k. Hirasawa and Miyaji presented concrete relations between the mathematical parameters and the embedding degrees. In this research, a new explicit relation between elliptic-curve parameters and embedding degrees is investigated by generalizing their research.

This paper presents an approach to solving the elliptic curve discrete logarithm problem on alternative curve models over prime fields using a quantum annealing and index calculus method. Part of the algorithm, relation searching, is transformed into the Quadratic Unconstrained Boolean Optimization (QUBO) problem and then is efficiently solved using the D-Wave computer by quantum annealing. As Faugère et al. showed, twisted Edwards curves, because of their symmetric shape, allow us to obtain solutions of relations searching step using Groebner basis faster than in the case of Weierstrass curves. Because of symmetries, a system of equations of relations searching step for twisted Edwards curves has many symmetric solutions. Using the Groebner basis and having many system solutions makes it easier to find any of them. The same is true using quantum annealing - it is easier to find any solution to the QUBO problem if many are correct. In this paper, we used this observation to find out that a properly constructed QUBO problem for the relations searching step for twisted Edwards curves allows us to find a solution faster for the same size of the base field than in the case of Weierstrass curves. Using the presented approach, we solved the discrete logarithm problem using quantum annealing and index calculus method for elliptic curve discrete logarithm problem defined on twisted Edwards curve over a field 𝔽1021 with order equal to 4 · 241. It is now the biggest field and size of the group, where the elliptic curve discrete logarithm problem was solved using quantum methods.

This paper presents new differential addition (i.e., the addition of two points with the known difference) and doubling formulas, as the core step in Montgomery scalar multiplication, for twisted Edwards curves. The formulas are provided with cost of $$5\mathbf {M}+4\mathbf {S}+1\mathbf {D}$$ , $$3\mathbf {M}+7\mathbf {S}+1\mathbf {D}$$ and $$3\mathbf {M}+6\mathbf {S}+3\mathbf {D}$$ when the given difference point is in affine form. Here, $$\mathbf {M}, \mathbf {S}, \mathbf {D}$$ denote the costs of a field multiplication, a field squaring and a field multiplication by a constant, respectively.

The Tate pairing is used to reduce the discrete logarithm (DL) problem on certain elliptic curves to the DL in the multiplicative group of finite fields.

This paper proposes the point compression techniques on twisted Edwards curves under the consideration of saving storage and bandwidth. The techniques of double point compression and triple point compression on twisted Edwards curves are presented and its correctness has been proved in this paper, and the efficiency of these techniques is also analyzed explicitly. It was shown that these techniques are very practical and result in surprisingly fast implementations in resource-restricted environment. Finally, we explore the developments of multiple point compression to draw a conclusion.

Hyperelliptic curves of small genus have the advantage of providing a group of com- parable size as that of elliptic curves, while working over a field of smaller size. Pairing-friendly hyperelliptic curves are those whose order of the Jacobian is divisible by a large prime, whose em- bedding degree is small enough for computations to be feasible, and whose minimal embedding field is large enough for the discrete logarithm problem in it to be difficult. We give a sequence of Fq-isogeny classes for a family of Jacobians of genus two curves over Fq, for q = 2 m , and their corresponding small embedding degrees. We give examples of the parameters for such curves with embedding degree k < (logq) 2 , such as k = 8,13,16,23,26,37,46,52. For secure and efficient implementation of pairing-based cryptography on genus g curves over Fq, it is desirable that the ratio = g log2 q log2 N be approximately 1, where N is the order of the subgroup with embedding degree k. We show that for our family of curves, is often near 1 and never more than 2. We also give a sequence of Fq-isogeny classes for a family of Jacobians of genus 2 curves over Fq whose minimal embedding field is much smaller than the finite field indicated by the embedding degree k. That is, the extension degrees in this example differ by a factor of m, where q = 2 m , demonstrating that the embedding degree can be a far from accurate measure of security. As a result,

Developing a high-speed elliptic curve cryptographic (ECC) processor that performs fast point multiplication with low hardware utilization is a crucial demand in the fields of cryptography and network security. This paper presents field-programmable gate array (FPGA) implementation of a high-speed, low-area, side-channel attacks (SCAs) resistant ECC processor over a prime field. The processor supports 256-bit point multiplication on recently recommended twisted Edwards curve, namely, Edwards25519, which is used for a high-security digital signature scheme called Edwards curve digital signature algorithm (EdDSA). The paper proposes novel hardware architectures for point addition and point doubling operations on the twisted Edwards curve, where the processor takes only 516 and 1029 clock cycles to perform each point addition and point doubling, respectively. For a 256-bit key, the proposed ECC processor performs single point multiplication in 1.48 ms, running at a maximum clock frequency of 177.7 MHz in a cycle count of 262 650 with a throughput of 173.2 kbps, utilizing only 8873 slices on the Xilinx Virtex-7 FPGA platform, where the points are represented in projective coordinates. The implemented design is time-area-efficient as it offers fast scalar multiplication with low hardware utilization without compromising the security level.

Wireless sensor networks (WSNs) pose a number of unique security challenges that demand innovation in several areas including the design of cryptographic primitives and protocols. Despite recent progress, the efficient implementation of Elliptic Curve Cryptography (ECC) for WSNs is still a very active research topic, and techniques to further reduce the time and energy cost of ECC are eagerly sought. This paper presents an optimized ECC implementation that we developed from scratch to comply with the severe resource constraints of 8‐bit sensor nodes such as the MICAz and IRIS motes. Our ECC software uses Optimal Prime Fields as underlying algebraic structure and supports two different families of elliptic curves, namely, Weierstraß‐form and twisted Edwards‐form curves. Due to the combination of efficient field arithmetic and fast group operations, we achieve an execution time of 5.3·106 clock cycles for a full 160‐bit scalar multiplication on an 8‐bit ATmega128 microcontroller, which is more than three times faster than the widely used TinyECC library. Our implementation also shows that the energy cost of scalar multiplication on a MICAz (or IRIS) mote amounts to just 17.34mJ when using a twisted Edwards curve over a 160‐bit Optimal Prime Field. This result further demonstrates the advantage of special family of elliptic curves for resource‐constrained environments. Copyright © 2015 John Wiley &amp; Sons, Ltd.