Improved Three-Way Split Formulas for Binary Polynomial Multiplication

The Galois/Counter Mode is an authenticated encryption scheme which is included in protocols such as TLS and IPSec. Its implementation requires multiplication over a binary finite field, an operation which is costly to implement in software. Recent processors have included instructions aimed to speed up binary polynomial multiplication, an operation which can be used to implement binary field multiplication. Some processors of the ARM architecture, which was reported in 2014 to be present in 95 % of smartphones, include such instructions. In particular, recent devices such as the iPhone 5 s and Galaxy Note 4 have ARMv8 processors, which provide instructions able to multiply two 64-bit binary polynomials and to encrypt using the AES cipher. In this work we present an optimized and timing-resistant implementation of GCM over AES-128 using these instructions. We have obtained timings of 1.71 cycles per byte for GCM authenticated encryption (9 times faster than the timing on ARMv7), 0.51 cycles per byte for GCM authentication only (11 times faster) and 1.21 cycles per byte for AES-128 encryption (8 times faster).

Binary extension (or Galois) fields GF(2^m) have been widely studied due to their use in several important applications, such as cryptography, error control codes and digital signal processing. These applications require efficient hardware implementations of GF(2^m) arithmetic operations, particularly multiplication, which is considered the most important and complex one. The complexity of GF(2^m) multiplication depends on the representation basis and on the defining irreducible polynomial f(y) selected for the finite field. For efficient hardware implementations, polynomial basis and irreducible trinomials or pentanomials are normally used. Any element A ∊ GF(2^m) can be represented in the polynomial basis {1,x,...,x^m-1} as A = Σm-1/i-0, a_i x^i with a_i Σ GF(2), where x is a root of the irreducible polynomial f(y) = Σ^m/_i=0^f_i y^i. Polynomial basis multiplication C = A ⋅ B requires a polynomial multiplication followed by a reduction modulo an irreducible polynomial. Mastrovito [1] proposed an efficient bit-parallel polynomial basis multiplier in which a product matrix was introduced to combine the above two steps together. A new polynomial basis multiplication method applied to irreducible trinomials was proposed in [2], where the functions S_i and T_i given by the addition of terms x_k = (a_k b_k) and z_i^j = (a_i b_j + a_j b_i), with a_i, b_i ∊ GF(2), were obtained from the decomposition of a product matrix. The addition of these functions is used for the computation of the product of two GF(2^m) elements. In [3], the above method was applied to type II irreducible pentanomials and the functions S_i and T_i were split in the form S_i = s^i_k S_i^k + ... + s^i_0 S_i^0 and T_i = t^i_k T_i^k + ... + t^i_0 T_i^0, with s^i_j, t^i_j ∊ GF(2) and k = log_2m. The terms S_i^j and T_i^j represent the sum of 2^j products a_kb_l and therefore can be implemented as a j-level complete binary tree of XOR gates. The addition in pairs of binary trees with the same depth leads to a reduction of the multiplication delay. However, splitting method imposes hard restrictions (given by the use of parenthesis in the expressions of the coordinates) for the addition of S_i^j and T_i^j terms in order to reduce the number of XOR levels. These restrictions could not be efficient for a synthesis tool in order to map that expressions into FPGA's logic blocks. If parenthesized restrictions are removed, more freedom could be given for the synthesizer to find an optimized implementation of the multiplier. In this work, efficient Xilinx FPGA implementations of GF(2^m) bit-parallel polynomial basis multipliers for irreducible trinomials are presented. Based on [2], a new general algorithm for multiplication over irreducible trinomials f(y) = y^m + y^n +1, with 1 ≤ n ≤ (m+1)/2, is proposed and the splitting method given in [3] is applied to these irreducible polynomials. Furthermore, in order to optimize the synthesis of the multipliers, a new approach for the computation of the product is used where the splitting of S_i and T_i terms is performed, but the restriction given by the addition in pairs of binary trees with the same depth has been removed. In this way, Xilinx tools are free to optimize the synthesis of the multiplier. Several GF(2^m) multipliers for different binary fields have been described in VHDL and their post-place and route implementation results in Xilinx Artix-7 have been reported. Experimental results show that the multiplier here proposed exhibits the best delay and Area×Time complexities when it is compared with similar multipliers found in the literature. Moreover, the new approach also achieves the lowest number of slices in most of the implemented multipliers.

Abstract. Let $E/F$ be a quadratic extension of number fields. In this paper, we show that the genus formula for Hilbert kernels, proved by M. Kolster and A. Movahhedi, gives the 2-rank of the Hilbert kernel of $E$ provided that the 2-primary Hilbert kernel of $F$ is trivial. However, since the original genus formula is not explicit enough in a very particular case, we first develop a refinement of this formula in order to employ it in the calculation of the 2-rank of $E$ whenever $F$ is totally real with trivial 2-primary Hilbert kernel. Finally, we apply our results to quadratic, bi-quadratic, and tri-quadratic fields which include a complete 2-rank formula for the family of fields $\mathbb{Q}(\sqrt{2},\sqrt{\delta )}$ where $\delta $ is a squarefree integer.

In this paper, we propose a temporal decimal multiplier design that reduces the area and pin count compared to an equivalent binary multiplier. In this design, we have efficiently embedded time-to-decimal conversion inside the logic, which mitigates the need for external conversion circuits. Also, our design mitigates a drawback of temporal logic that typically requires ‘n’ time delays to represent ‘n’ numerical values, which results in longer latency for large values of ‘n’. By representing numbers as parallel temporal values where each value represents a different digit (0–9) of the number, we reduce the maximum delay needed to represent the product to only 9 delay (clock) cycles for any multiplication outcome. We show performance and area benefits for different temporal multiplier designs with fully-laid out, tapeout-ready design implemented in MITLL's SFQ5ee process. Compared to a 4-bit binary multiplier, our temporal decimal multiplier reduces the pin count by approximately 3× and the area by 40%. Finally, we evaluate our proposed temporal multiplier against conventional binary multipliers when configured for DSP and machine learning algorithms.

A method for polynomial multiplication over finite fields using field extensions and polynomial interpolation is introduced. The proposed method uses polynomial interpolation as Toom-Cook method together with field extensions. Furthermore, the proposed method can be used when Toom-Cook method cannot be applied directly. Explicit formulae improving the previous results in many cases are obtained.

Asymptotic goodness-of-fit tests based on large sample theory have been shown to be unreliable in small sample designs and sparse data structures. In these situations, it is widely believed that exact version tests are dependable. However, exact goodness-of-fit tests that are based on discrete probabilities are conservative and the calculation of the exact distribution may be computationally intractable. In this article, we present a method, which is based on recursive polynomial multiplication, for performing exact analysis of goodness-of-fit tests. This method has been shown to be more efficient and accurate than an existing fast Fourier transform method. To overcome the conservativeness problem, we suggest the use of mid–P version goodness–of–fit tests. The small sample properties of the asymptotic, the exact, and the mid–P version goodness–of–fit tests are examined via the recursive polynomial multiplication method. Four commonly used power divergence statistics and six null hypotheses ranging from the equiprobable to the extremely skew are considered. The actual significance level behaviors under various null hypotheses suggest that as an anti–conservative test, the mid–P version tests behave fairly well. Nevertheless, it is not the case for the asymptotic and the exact tests. Among the four statistics considered, the exact power comparisons under a specific alternative to various null hypotheses show that the power divergence statistic with λ= 2/3 and the Pearson’s chi–squared statistic (λ = 1) are generally the most preferable.

A signal processing system employing digital arithmetic can be made equivalent to a set of interconnected subsystems each using finite field operations to alleviate effects of round-off noise, particularly in recursive structures. The realization of the subsystems involves the multiplication of polynomials over a finite field. Cyclic convolutions may be represented as polynomial multiplications, in a residue class ring modulo the polynomial (x <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</sup> -1). Fast algorithms arise when the ring is decomposed into a direct product using its minimal ideals, the orthogonality relationships between the idempotents of the minimal ideals resembling the decomposition properties of the Chinese remainder theorem for real polynomials. The resulting component polynomial multiplications involve elements with smaller degrees. A transform domain, based upon an n <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">th</sup> root of unity in an extension field, offers an alternative domain for performing the component operations. Polynomial multiplications are equivalent to the vector inner product of the corresponding transform coefficients. The minimal ideal components, when mapped into the transform domain, have nonzero coefficients only in predetermined subsets, the cyclotomic subsets, which permits one coefficient to generate all others by successively forming its powers.

Efficient binary polynomial multiplication (BPM) implementations are crucial for the practical deployment of bit flipping key encapsulation (BIKE) postquantum cryptography (PQC) due to its computation-intensive nature. To speed up BPM, this brief proposes a scalable and efficient architecture. The proposed architecture employs a novel blockwise sparsity algorithm, which segments sparse polynomials into blocks and leverages interblock and inner block sparsity to eliminate invalid computations, thereby significantly reducing computational operations. Moreover, a scalable block-by-block pipeline structure, along with a multibank random access memory (RAM) for sparse polynomials, is designed to effectively process blocks, resulting in substantial enhancement in performance. Experimental results on Xilinx Artix-7 Field-Programmable Gate Arrays (FPGAs) demonstrate significant performance superiority on the proposed architecture, compared with existing approaches. Across different bandwidth settings of 16, 32, 64, or 128, our design can achieve <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$4.5\times \sim 35.1\times $ </tex-math></inline-formula>, <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$4.9\times \sim 78.8\times $ </tex-math></inline-formula>, <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$2.5\times \sim 112.7\times $ </tex-math></inline-formula>, and <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$0.5\times \sim 164.2\times $ </tex-math></inline-formula> speedup, respectively. Compared with state-of-the-art works, our design achieves <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$2.8\times \sim 152.0\times $ </tex-math></inline-formula> improvements in area efficiency.

In this chapter we shall analyze arbitrary extension fields of a field Φ. A study of finite dimensional extension fields and a partial study of algebraic extensions has been made in Chapter I. In this chapter our primary concern will be with infinite dimensional extensions and we shall begin again with the algebraic ones. We define algebraically closed fields and prove the existence of an algebraic closure of any field. We shall extend the classical Galois theory to apply to infinite dimensional normal and separable extensions. After this we shall consider arbitrary extension fields and we shall show that these can be built up in two stages: first a purely transcendental one and then on top of this an algebraic extension. The invariant of this mode of generating a field is the transcendency degree which is the cardinal number of a transcendency basis. We shall obtain conditions for the existence of a transcendency basis such that the extension is separable algebraic over the purely transcendental extension determined by the basis. We shall also give a definition of separability of an extension field that generalizes the notion of algebraic separability. The notion of a derivation plays an important role in these considerations.KeywordsPrime IdealStructure TheoryGalois GroupHigh DerivationAlgebraic ClosureThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The RSA public key cryptosystem is based on a single modular equation in one variable. A natural generalization of this approach is to consider systems of several modular equations in several variables. In this paper we consider Patarin’s Hidden Field Equations (HFE) scheme, which is believed to be one of the strongest schemes of this type. We represent the published system of multivariate polynomials by a single univariate polynomial of a special form over an extension field, and use it to reduce the cryptanalytic problem to a system of ∈m 2 quadratic equations in m variables over the extension field. Finally, we develop a new relinearization method for solving such systems for any constant ∈ > 0 in expected polynomial time. The new type of attack is quite general, and in a companion paper we use it to attack other multivariate algebraic schemes, such as the Dragon encryption and signature schemes. However, we would like to emphasize that the polynomial time complexities may be infeasibly large for some choices of the parameters, and thus some variants of these schemes may remain practically unbroken in spite of the new attack.KeywordsQuadratic EquationSignature SchemeUnivariate PolynomialMultivariate PolynomialMultivariate Signature SchemeThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

This paper revisits Virgo, a well-known transparent zero-knowledge proof system that has been used in many subsequent studies. Through our analysis, we uncover previously overlooked limitations and several exploitable security vulnerabilities within Virgo’s zkVPD protocol design and implementation. We subsequently address these issues and improve Virgo’s zkVPD protocol. Our improvements feature simplified but more efficient VPD and zkVPD algorithms, offering enhanced support for computations over binary fields and their extension fields.

Arithmetic operations over finite fields GF(2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">m</sup> ) are widely used in cryptography, error-correcting codes and signal processing. In particular, multiplication is especially relevant since other arithmetic operators, such as division or exponentiation, which they usually utilize multipliers as building blocks. Hardware implementation of field multiplication may provide a great speedup in procedure's performance, which easily exceeds the one observed in software platforms. In this paper we deal with an FPGA implementation of an efficient serial multiplier over the binary extension fields GF(2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">193</sup> ) and GF(2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">239</sup> ). Those extension fields are included among the ones recommended by NIST (National Institute of Standards and Technology) standards for Elliptic Curve Cryptography. Our multiplier is of type Serial/Parallel LSB-first and operates with a latency of m-clock cycles, where m is the length of the field word. We calculate the space complexity attending the number of slices used in the FPGA

In this paper, a high-speed power-efficient VLSI implementation of a finite field multiplier in GF(2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">m</sup> ) is presented. The proposed design has a serial-in parallel-out architecture and performs the multiplication operation using a reordered normal basis. The basic idea is to implement the main building block of the multiplier in domino logic to reduce the critical path delay. Reduction in dynamic power consumption is achieved by limiting the contention current between the keeper transistor and the pull-down network at the beginning of the evaluation phase by employing a new keeper control circuit. The semicustom layout of the multiplier was realized in 65-nm CMOS technology. The post place-and-route simulations showed that the multiplier can perform multiplication correctly up to a clock rate of 3.85 GHz and consumes marginally less power than the static CMOS counterpart (also implemented with custom placement and route). The size of the multiplier is currently recommended by the National Institute of Standards and Technology for binary field multiplication in elliptic curve cryptography. The proposed design methodology can also be used in the implementation of similar finite field multipliers possessing regular architectures.

This paper addresses the problem of implementing narrow-band FIR filters using FPGAs. The method uses a tunable quadrature sigma-delta modulator to re-quantise a real- or complex-valued input stream to a reduced precision, so removing the requirement for a full multiplier in the filter hardware. This makes the technique very attractive for implementation using FPGAs. The re-quantisation process preserves the dynamic range of the signal components contained in the bandwidth of the filter, while shifting the re-quantisation noise to the spectral region to be rejected by the filter. The filter architecture described and its implementation using Xilinx FPGAs is presented.KeywordsField Programmable Gate ArrayFinite Impulse ResponseFilter CoefficientFinite Impulse Response FilterFeedback PathThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Performance evaluation of highly efficient techniques for software implementation of LFSR