Faster Complete Addition Laws for Montgomery Curves

This paper presents an approach to solving the elliptic curve discrete logarithm problem on alternative curve models over prime fields using a quantum annealing and index calculus method. Part of the algorithm, relation searching, is transformed into the Quadratic Unconstrained Boolean Optimization (QUBO) problem and then is efficiently solved using the D-Wave computer by quantum annealing. As Faugère et al. showed, twisted Edwards curves, because of their symmetric shape, allow us to obtain solutions of relations searching step using Groebner basis faster than in the case of Weierstrass curves. Because of symmetries, a system of equations of relations searching step for twisted Edwards curves has many symmetric solutions. Using the Groebner basis and having many system solutions makes it easier to find any of them. The same is true using quantum annealing - it is easier to find any solution to the QUBO problem if many are correct. In this paper, we used this observation to find out that a properly constructed QUBO problem for the relations searching step for twisted Edwards curves allows us to find a solution faster for the same size of the base field than in the case of Weierstrass curves. Using the presented approach, we solved the discrete logarithm problem using quantum annealing and index calculus method for elliptic curve discrete logarithm problem defined on twisted Edwards curve over a field 𝔽1021 with order equal to 4 · 241. It is now the biggest field and size of the group, where the elliptic curve discrete logarithm problem was solved using quantum methods.

Wireless Sensor Networks (WSNs) pose a number of unique security challenges that demand innovation in several areas including the design of cryptographic primitives and protocols. Despite recent progress, the efficient implementation of Elliptic Curve Cryptography (ECC) for WSNs is still a very active research topic and techniques to further reduce the time and energy cost of ECC are eagerly sought. This paper presents an optimized ECC implementation that we developed from scratch to comply with the severe resource constraints of 8-bit sensor nodes such as the MICAz and IRIS motes. Our ECC software uses Optimal Prime Fields (OPFs) as underlying algebraic structure and supports two different families of elliptic curves, namely Weierstraß-form and twisted Edwards-form curves. Due to the combination of efficient field arithmetic and fast group operations, we achieve an execution time of 5.8 · 106 clock cycles for a full 158-bit scalar multiplication on an 8-bit ATmega128 micro-controller, which is 2.78 times faster than the widely-used TinyECC library. Our implementation also shows that the energy cost of scalar multiplication on a MICAz (or IRIS) mote amounts to just 19~mJ when using a twisted Edwards curve over a 160-bit OPF. This result compares fairly well with the energy figures of two recently-presented hardware designs of ECC based on twisted Edwards curves.

Montgomery curves allow efficient and side-channel resistant computation of ECDH using the Montgomery ladder. But the addition law of a Montgomery curve derived from the chord-tangent method is less efficient than other curve models such as a short Weierstrass curve and an Edwards curve. So, the usage of a Montgomery curve is strictly limited to ECDH only, such as \(\mathsf {X25519}\) and \(\mathsf {X448}\) functions in IETF RFC 7748. For other operations including fixed-base and multiple scalar multiplications, their birationally-equivalent (twisted) Edwards curves are recommended for use since the conversions between Montgomery curves and their Edwards equivalents are simple. This conversion enables the use of the efficient complete addition law of the Edwards curve that works for all pairs of input points with no exceptional cases. As a result, the combination allows secure and exception-free implementations, but at the expense of additional storage for the two curve parameters and for the conversion between them. However, smart devices in IoT environments that mainly operate ECDH (for example, RawPublicKey mode of IETF RFC 7250) do not need to implement such a conversion if a complete addition law does exist for the Montgomery curves.

Developing a high-speed elliptic curve cryptographic (ECC) processor that performs fast point multiplication with low hardware utilization is a crucial demand in the fields of cryptography and network security. This paper presents field-programmable gate array (FPGA) implementation of a high-speed, low-area, side-channel attacks (SCAs) resistant ECC processor over a prime field. The processor supports 256-bit point multiplication on recently recommended twisted Edwards curve, namely, Edwards25519, which is used for a high-security digital signature scheme called Edwards curve digital signature algorithm (EdDSA). The paper proposes novel hardware architectures for point addition and point doubling operations on the twisted Edwards curve, where the processor takes only 516 and 1029 clock cycles to perform each point addition and point doubling, respectively. For a 256-bit key, the proposed ECC processor performs single point multiplication in 1.48 ms, running at a maximum clock frequency of 177.7 MHz in a cycle count of 262 650 with a throughput of 173.2 kbps, utilizing only 8873 slices on the Xilinx Virtex-7 FPGA platform, where the points are represented in projective coordinates. The implemented design is time-area-efficient as it offers fast scalar multiplication with low hardware utilization without compromising the security level.

Wireless sensor networks (WSNs) pose a number of unique security challenges that demand innovation in several areas including the design of cryptographic primitives and protocols. Despite recent progress, the efficient implementation of Elliptic Curve Cryptography (ECC) for WSNs is still a very active research topic, and techniques to further reduce the time and energy cost of ECC are eagerly sought. This paper presents an optimized ECC implementation that we developed from scratch to comply with the severe resource constraints of 8‐bit sensor nodes such as the MICAz and IRIS motes. Our ECC software uses Optimal Prime Fields as underlying algebraic structure and supports two different families of elliptic curves, namely, Weierstraß‐form and twisted Edwards‐form curves. Due to the combination of efficient field arithmetic and fast group operations, we achieve an execution time of 5.3·106 clock cycles for a full 160‐bit scalar multiplication on an 8‐bit ATmega128 microcontroller, which is more than three times faster than the widely used TinyECC library. Our implementation also shows that the energy cost of scalar multiplication on a MICAz (or IRIS) mote amounts to just 17.34mJ when using a twisted Edwards curve over a 160‐bit Optimal Prime Field. This result further demonstrates the advantage of special family of elliptic curves for resource‐constrained environments. Copyright © 2015 John Wiley & Sons, Ltd.

Elliptic curves cryptography was introduced independently by Victor Miller (Miller, 1986) and Neal Koblitz (Koblitz, 1987(Koblitz, ) in 1985. .At that time elliptic curve cryptography was not actually seen as a promising cryptographic technique.As time progress and further research and intensive development done especially on the implementation side, elliptic curve cryptography is now being implemented widely.Elliptic curves cryptography offers smaller key size, bandwidth savings and faster in implementations when compared to the RSA (Rivest-Shamir-Adleman) cryptography which based its security on the integer factorization problem.The most interesting feature of the elliptic curves is the group structure of the points generated by the curves, where points on the elliptic curves form a group.The security of elliptic curves cryptography relies on the elliptic curves discrete logarithm problem.The elliptic curve discrete logarithm problem is analogous to the ordinary algebraic discrete logarithm problem, l = g x , where given the l and g, it is infeasible to compute the x.Elliptic curve discrete logarithm problem deals with solving for n the relation P = nG.Given the point P and the point G, then it is very hard to find the integer n.To implement the discrete logarithm problem in elliptic curve cryptography, the main task is to compute the order of group of the curves or in other words the number of points on the curve.Computation to find the number of points on a curve, has given rise to several point counting algorithms.The Schoof and the SEA (Schoof-Elkies-Atkin) point counting algorithms will be part of the discussion in this chapter.This chapter is organized as follows: Section 2, gives some preliminaries on elliptic curves, and in section 3, elliptic curve discrete logarithm problem is discussed.Some relevant issues on elliptic curve cryptography is discussed in section 4, in which the Diffie-Hellman key exchange scheme, ElGamal elliptic curve cryptosystem and elliptic curve digital signature scheme are discussed here accompanied with some examples.Section 5 discussed the two point counting algorithms, Schoof algorithm and the SEA (Schoof-Elkies-Atkin) algorithm.Following the discussion in section 5, section 6 summaries some similarities and the differences between these two algorithms.Section 7 gives some brief literature on these two point counting algorithms.Finally, section 8 is the concluding remarks for this chapter. Elliptic curvesElliptic curves obtained their name from their relation to elliptic integrals that arise from the computation of the arc length of ellipses (Lawrence & Wade, 2006).Elliptic curves are www.intechopen.com Cryptography and Security in Computing1 1 2 3 4 2 2 4 Fig. 1.1. 2(1 ) (1 ) yx x x   www.intechopen.com

Embedded systems are increasingly providing secure functionalities, which often rely on some dedicated hardware for symmetric and public-key cryptography. When resources are limited, elliptic curve cryptography (ECC) may be chosen instead of the more widely known RSA, which needs much longer keys for the same security level. However, ECC may be vulnerable, as any other cryptographic implementation, to side channel analysis, which may reveal secret information by analyzing collateral sources of information, such as power consumption. Countermeasures must be thus adopted at the design level, in order to ensure robust and secure operation of the device. We propose here a new scalar multiplication algorithm on an elliptic curve, based on a novel randomized window method. This design is protected against side channel attacks (Timing, Simple and Differential Power Analysis) and it is implemented over prime fields, but it can be applied to binary fields as well. In order to evaluate this countermeasure, we provide its costs, and an estimation of the additional entropy added to the computation against side channels attacks.

The demand for cybersecurity is growing to safeguard information flow and enhance data privacy. This essay suggests a novel authenticated public key elliptic curve based on a deep convolutional neural network (APK-EC-DCNN) for cybersecurity image encryption application. The public key elliptic curve discrete logarithmic problem (EC-DLP) is used for elliptic curve Diffie-Hellman key exchange (EC-DHKE) in order to generate a shared session key, which is used as the chaotic system's beginning conditions and control parameters. In addition, the authenticity and confidentiality can be archived based on ECC to share the EC parameters between two parties by using the EC-DHKE algorithm. Moreover, the 3D Quantum Chaotic Logistic Map (3D QCLM) has an extremely chaotic behavior of the bifurcation diagram and high Lyapunov exponent, which can be used in high-level security. In addition, in order to achieve the authentication property, the secure hash function uses the output sequence of the DCNN and the output sequence of the 3D QCLM in the proposed authenticated expansion diffusion matrix (AEDM). Finally, partial frequency domain encryption (PFDE) technique is achieved by using the discrete wavelet transform in order to satisfy the robustness and fast encryption process. Simulation results and security analysis demonstrate that the proposed encryption algorithm achieved the performance of the state-of-the-art techniques in terms of quality, security, and robustness against noise- and signal-processing attacks.

The elliptic curve cryptography is almost used in the literature to develop the public key cryptosystems. A new general-purpose symmetric key cryptosystem using elliptic prime curves is proposed in this paper. For a given prime number P, there are many elliptic prime curves on which each point in the quadrant (0,0) to (P-1,P-1) lays. The set of minimum number of eligible elliptic prime curves for a given prime number P constitutes a lookup table that is the secret key of the proposed cryptosystem. The sender can pick up one eligible elliptic curve for each 2n-bit plaintext block. The sender sends two integers cipher for each 2n-bit plaintext block with encryption rate = 0.8. Moreover, a small prime number can be used efficiently with high security and good robustness against brute force attack.

The additional information (side effects) in Elliptic Curve Cryptography (ECC) hardware can be used to attack cryptographic systems. Additional information related to time, power consumption and electromagnetic radiation. Side channel attacks have been done with SPA (Simple Power Analysis), DPA (Differential Power Analysis), SEMA (Simple Electromagnetic Analysis) and DEMA (Differential Electromagnetic Analysis). Some scalar multiplication algorithm can be used to countermeasure SPA attack on elliptic curve cryptography. In this study, conducted experiments side-channel attacks ECC hardware implementations use binary algorithms by observing power consumption of ECC processor on FPGA. Experimental of side-channel attack is conducted to guess the secret key for data encryption and decryption by looking at the physical differences on hardware side effects. In this study, side-channel attack experimental is successful 100% get the key by analyzing of power consumption ECC processor.

A promising direction for constructing cryptographically stable pseudo-random sequence generators is an application of transformations in a group of points of elliptic and hypereliptic curves. This will allow building evidence-stable crypto algorithms, the problem of finding the private key in which is associated with solving a theoretically complex elliptic curve discrete logarithm problem. This paper proposes a method for generating pseudo-random sequences of the maximal period using transformations on elliptic curves. This method consists in the application of recurrent transformations with sequential formation of elements of points group of elliptic curves. This allows providing the maximum period of pseudo-random sequences with the reduction of the problem of finding the private key to the solution of the theoretically complex elliptic curve discrete logarithm problem. The block diagram of the device for generating pseudo-random sequences and the scheme for generating the internal states of the generator are given. We also present the results of statistical testing of some generators, which show that the generated sequences are indistinguishable in a statistical sense from truly random ones.KeywordsPseudo-random sequencesElliptic curvesMaximum period

Verification of an ECDSA signature requires a double scalar multiplication on an elliptic curve. In this work, we study the computation of this operation on a twisted Edwards curve with an efficiently computable endomorphism, which allows reducing the number of point doublings by approximately 50 percent compared to a conventional implementation. In particular, we focus on a curve defined over the 207-bit prime field F <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">p</sub> with p = 2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">207</sup> - 5,131. We develop several optimizations to the operation and we describe two hardware architectures for computing the operation. The first architecture is a small processor implemented in 0.13 μm CMOS ASIC and is useful in resource-constrained devices for the Internet of Things (IoT) applications. The second architecture is designed for fast signature verifications by using FPGA acceleration and can be used in the server-side of these applications. Our designs offer various trade-offs and optimizations between performance and resource requirements and they are valuable for IoT applications.

Many researchers have used the properties of the popular Elliptic Curve Cryptography(ECC) to devise a stronger and faster image encryption algorithm to assure the secrecy of images during online transmission. In this paper, a robust Elliptic curve based image encryption and authentication model for both grayscale and color images has been proposed. The model uses the secure Elliptic Curve Diffie-Hellman(ECDH) key exchange to compute a shared session key along with the improved ElGamal encoding scheme. 3D and 4D Arnold Cat maps are used to effectively scramble and transform the values of plain image pixels. A well-structured digital signature is used to verify the authenticity of the encrypted image prior to decryption. The model produces good-quality cipher images with an average entropy of 7.9993 for grayscale and 7.99925 for the individual components of color images. The model has high average NPCR of 99.6%, average UACI of 33.3% and low correlation for both grayscale and color images. The model has low computational costs with minimized point multiplication operations. The proposed model is robust with high resilience against statistical, differential, chosen-plaintext(CPA), known-plaintext(KPA) and occlusion attacks.

Elliptic curve cryptography (ECC) can ensure an equivalent security with much smaller key sizes. Elliptic curve scalar multiplication (ECSM) is a fundamental computation used in ECC. This paper focuses on ECSM resisting simple power attack and safe error attack of side-channel attack specifically. Elliptic curve complete addition (CA) formulae can achieve secure ECSM algorithms but are inefficient from memory and computational cost perspectives. Another secure ECSM, which uses (extended) affine, is more efficient for both memory and computational costs. However, it scans input scalars from right to left. In this paper, our developed scalar multiplication algorithms also use their extended affine, but scan from left to right (LR). We also prove the security of our LR ECSM algorithms and analyze them both theoretically and experimentally. Our new LR ECSM algorithms can reduce the amount of memory by \(37.5\%\) and reduce the computational time by more than \(40\%\) compared to Joye’s regular 2-ary LR algorithm with CA formulae.

CSIDH is an isogeny-based key exchange protocol proposed by Castryck, Lange, Martindale, Panny, and Renes in 2018. CSIDH is based on the ideal class group action on \(\mathbb {F}_p\)-isomorphism classes of Montgomery curves. In order to calculate the class group action, we need to take points defined over \(\mathbb {F}_{p^2}\). The original CSIDH algorithm requires a calculation over \(\mathbb {F}_p\) by representing points as x-coordinate over Montgomery curves. Meyer and Reith proposed a faster CSIDH algorithm in 2018 which calculates isogenies on Edwards curves by using a birational map between a Montgomery curve and an Edwards curve. There is a special coordinate on Edwards curves (the w-coordinate) to calculate group operations and isogenies. If we try to calculate the class group action on Edwards curves by using the w-coordinate in a similar way on Montgomery curves, we have to consider points defined over \(\mathbb {F}_{p^4}\). Therefore, it is not a trivial task to calculate the class group action on Edwards curves with w-coordinates over only \(\mathbb {F}_p\).