Finite Fields of Characteristic 2

Recent multi-application smart cards are equipped with powerful 32-bit RISC cores clocked at 33 MHz or even more. They are able to support a variety of public-key cryptosystems, including elliptic curve systems over prime fields GF(p) and binary fields GF(2 m ) of arbitrary order. This flexibility is achieved by implementing the cryptographic primitives in software and taking advantage of dedicated instruction set extensions along with special functional units for low-level arithmetic operations. In this paper, we present the design of a low-power multiply/accumulate (MAC) unit for efficient arithmetic in finite fields. The MAC unit combines integer arithmetic and polynomial arithmetic into a single functional unit which can be configured at run-time to serve both types of fields, GF(p) and GF(2 m ). Our experimental results show that a properly designed unified (dual-field) multiplier consumes significantly less power in polynomial mode than in integer mode.

An area-efficient bit-serial sequential polynomial basis finite field GF(2m) multiplier

Parallelization of scalable elliptic curve cryptosystem processors in GF(2m)

It is well-known that a class of finite fields GF(2/sup n/) using an optimal normal basis is most suitable for a hardware implementation of arithmetic in finite fields. In this paper, we introduce composite fields of some hardware-applicable properties resulting from the normal basis representation and the optimal condition. We also present a hardware architecture of the proposed composite fields including a bit-parallel multiplier.

For big data security, high-speed arithmetic units are needed. Finite field arithmetic has received much attention in error-control codes, cryptography, etc. The modular exponentiation over finite fields is an important and essential cryptographic operation. The modular exponentiation can be performed by a sequence of modular squaring and multiplication based on the binary method. In this paper, we propose a combined algorithm to concurrently perform multiplication and squaring over \(GF(2^{m})\) using the bipartite method and common operations. We expect that the architecture based on the proposed algorithm can reduce almost a half of latency compared to the existing architecture. Therefore, we expect that our algorithm can be efficiently used for various applications including big data security which demands high-speed computation.

The main topic of this thesis is related to the state of the art in designing cryptographic primitives from a hardware point of view. A special emphasis is dedicated to low-power/low-energy CMOS design. A set of solutions is proposed including an LFSR based stream cipher with self-synchronizing capabilities, a new memory-less Rijndael block cipher architecture and a public key scheme in the class of discrete logarithm. The former is based on arithmetic in large finite field, mainly Galois extension field GF(2‴). These solutions are droved using low-energy techniques, in order to decrease both the switching activity and the total delay. The fundamental motivation supporting this work, is to demonstrate that practical solutions can be obtained for implementing such complex primitives in large scaled circuits, that arc at once, high performance architectures (low-power, high-speed) and cryptographicaly strong, using the well known trade-off between area-speed or area-power. Security constraint has been duly considered, mainly by increasing the key-size. In this work, we explore the general aspects of designing the above mentioned cryptographic functions. We give an extensive survey of some cryptographic primitives from the hardware point of view and expose their security properties. The thesis favours stream cipher and public-key schemes, as currently the most promising advance to capture the notion of key generation and establishment and data bulk encryption. One contribution is the convenient notation for expressing cryptographic self-synchronizing stream ciphers SSSC schemes and our SSMG proposal, a scheme based on packet fingerprint identification, that relies on keyed cryptographic hash function to achieve the security requirements. We maintain an important distinction between hardware implementation and algorithm's security, because the security of cryptographic primitives cannot be based on mathematically strong functions only but requires an extensive cryptanalysis at different levels including the application. This causes a concern for a formalization of the security of an implemented cryptographic primitive. Nevertheless, while some schemes arc well known to be secure such as DL based public key schemes and enough cryptanalyzed such as the new standard Rijndael, some security aspects of the SSMG are discussed. A part of this work studies the specific aspects related to hardware implementation of Rijndael block cipher, the new standard designed to be a substitute for DES. An efficient architecture is developed targeting FPGA implementation, by simply avoiding memory blocks dedicated to the implementation of S-boxes and replacing them by on-chip forward computation using composite Galois field. This technique helps to reduce considerably the amount of hardware required at the cost of little increase of the switching activity. The main conclusion is that, while security constraint of cryptographic primitives increases the hardware complexity and reduces the performances, practical solutions exist for reducing such complexities while keeping or increasing the level of security. Nevertheless, major open questions remain both for a firm theoretical foundation and the proper cryptanalysis of certain solutions.

This paper presents a variant of Advance Encryption Standard (AES) cipher that is depending on the same structure of the original AES Substitution Permutation Network (SPN) and the same mathematical background represented by Galois Field (GF28). The proposed cipher encrypt and decrypt data with block size of 512-bit and with key size of 128-bit expanded into 512-bits which means encrypt block that four times larger than the block of the original cipher and provide high margin of security with key size 128-bit of key needs 2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">512</sup> possibility instead of 2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">128</sup> , since this cipher is based on two perfect techniques for the expansion and generating key reaching to 512-bit for each round. This cipher depends upon strong mathematical foundations and solid algebraic representation and introduces deeper insights in developing AES.

In this book we have been discussing polynomial equations over finite fields of characteristic two for quite some time. However, the finite field in question has almost always been \(\mathbb{G}\mathbb{F}\)(2). In cryptanalysis, this is usually the field of interest, with notable exceptions, including several ciphers: Rijndael [89] which later become the Advanced Encryption Standard (AES), which uses \(\mathbb{G}\mathbb{F}\)(256); the cryptosystem called TTM [127], over the same field; the Courtois Toy Cipher (CTC) [14] [73], can be modeled over \(\mathbb{G}\mathbb{F}\)(8) for certain settings. The stream cipher family QUAD [42] can operate over any finite field, but finite fields of characteristic two would be the natural setting (see Section 5.2 on Page 66).

The advances in quantum technologies and the fast move toward quantum computing are threatening classical cryptography and urge the deployment of post-quantum (PQ) schemes. The only isogeny-based candidate forming part of the third round of the standardization, the Supersingular Isogeny Key Encapsulation (SIKE) mechanism, is a subject of constant latency optimizations given its attractive compact key size lengths and, thus, its limited bandwidth and memory requirements. In this work, we present a new speed record of the SIKE protocol by implementing novel low-level finite field arithmetics targeting ARMv7-M architecture. We develop a handcrafted assembly code for the modular multiplication and squaring functions where we obtain 8.71% and 5.38% of speedup, respectively, compared to the last best-reported assembly implementations for p434. After deploying the finite field optimized architecture to the SIKE protocol, we observe 5.63%, 3.93%, 3.48%, and 1.61% of latency reduction for SIKE p434, p503, p610, and p751, respectively, targeting the NIST recommended STM32F407VG discovery board for our experiments.KeywordsSupersingular Isogeny Key Encapsulation (SIKE)Post-Quantum cryptography (PQC)ARM Cortex-M4

A new polynomial division algorithm in finite field GF(2/sup m/) based on the lookahead of partial-remainder (LAPR) is proposed. Since our algorithm is based on partial division on group basis and lookahead technique exploiting the linearity in finite field arithmetic, it is possible to completely eliminate polynomial multiplications leading to highly increased throughput per unit time. The inherent regularity and feedforward nature of our algorithm make it possible to be fully pipelined. When pipelined, its throughput is one quotient and one remainder per clock cycle, regardless of the degree of dividend polynomial, which is orders of magnitude faster than the conventional architecture using linear feedback shift register. An area-efficient sequential architecture based on LAPR is also presented, Although the throughput rate of sequential architecture is lower than that of the pipelined one, it is still higher than that of any division architecture ever reported. They are shown to be efficient, regular, and easily expandable, and hence, naturally suitable for very large scale integration implementation. In systems requiring modest speed, the high-speed nature of our proposed architecture can be traded for low power consumption by reducing clock rate. We verified the general validity of the division algorithm based on LAPR by mathematical manipulation and simulation. The superiority of our proposed architecture compared with other reported ones is demonstrated with regard to its throughput, latency delays, and power.

Based on the different representations of the finite field GF(256), there are different Advanced Encryption Standard (AES) implementations, which is called dual ciphers. They have the same encryption process as AES, but with parameters modified. The research of dual ciphers initially aims to find more efficient AES implementations, and later it is found that they can be used to resist side-channel attacks and for white box ciphers. In this paper, based on the rotation of columns, we propose new AES dual ciphers, which use AES directly, but with the input matrices (plaintexts and keys) and output matrix rotated. The key expansion algorithm only needs some change on the computation sequence. Because of these features, there is almost no extra cost in implementing dual ciphers and it is easy for new dual ciphers to work with other side-channel protection methods to protect AES in more dimensions.

A special-purpose hardware architecture is proposed to implement the expectation-maximization algorithm to compute, in clinically useful times, the maximum-likelihood estimate of a radionuclide distribution for a positron-emission tomogram from time-of-flight measurements. Two-dimensional convolutions required for forming the estimate are converted into a series of one-dimensional convolutions that can be evaluated in parallel. Each one-dimensional convolution is evaluated using a number-theoretic transform. All numerical calculations are performed using finite-field arithmetic. To avoid the use of large finite fields and to increase parallelism, each convolution is performed by a series of convolutions with small digits in a Galois field. The hardware architecture allows a two-dimensional convolution of dimension NxN to be formed with O(N) operations, permitting one iteration of the expectation-maximization algorithm to be formed in approximately 100 ms when N=128 and the number of view angles is 32.

Methods of finding multiplicative inverses in GF(2 8)

Congruence arithmetic algorithms for polynomial real zero determination

In this paper, we investigate the hardware circuit complexity of the class of Boolean functions recently introduced by Tang and Maitra (IEEE-TIT 64(1): 393–402, 2018). While this class of functions has very good cryptographic properties, the exact hardware requirement is an immediate concern as noted in the paper itself. In this direction, we consider different circuit architectures based on finite field arithmetic and Boolean optimization. An estimation of the circuit complexity is provided for such functions given any input size n. We study different candidate architectures for implementing these functions, all based on the finite field arithmetic. We also show different implementations for both ASIC and FPGA, providing further analysis on the practical aspects of the functions in question and the relation between these implementations and the theoretical bound. The practical results show that the Tang-Maitra functions are quite competitive in terms of area, while still maintaining an acceptable level of throughput performance for both ASIC and FPGA implementations.