Low Cost Hardware Design of ECC Scalar Multiplication

This work presents an evaluation of different software implementations of algorithms to compute the most demanding operation in cryptographic schemes based on Elliptic Curve Cryptography (ECC), the scalar multiplication. Five different methods were studied, including traditional and more sophisticated methods for elliptic curve cryptography defined over prime and binary fields. For evaluation, the key generation algorithm in ECC consisting on a single scalar multiplication was implemented on a P500h LG smarthphone, which includes an ARM processor running at 600MHz. Both execution time and memory usage was evaluated. It was found that in general, scalar multiplication runs 8 times faster for ECC defined over prime fields, being the NAF the best performer method. For ECC over binary fields, the best performer method was wNAF. The results presented in this work could help a designer to select the most appropriate method when implementing ECC-based cryptographic schemes such as encryption or digital signatures on mobile devices like smartphones, meeting implementation requirements in terms of execution time and memory usage.

Pseudo-random scalar multiplication based on group isomorphism

Sequential Galois field (F 2k ) arithmetic circuits take k-bit inputs and produce a k-bit result, after k-clock cycles of operation. Formal verification of sequential arithmetic circuits with large datapath size is beyond the capabilities of contemporary verification techniques. To address this problem, this paper describes a verification method based on algebraic geometry that: i) implicitly unrolls the sequential arithmetic circuit over multiple (k) clock-cycles; and ii) represents the function computed by the state-registers of the circuit, canonically, as a multi-variate word-level polynomial over F 2k . Our approach employs the Grobner basis theory over a specific elimination ideal. Moreover, an efficient implementation is described to identify the k-cycle computation performed by the circuit at word-level. We can verify up to 100-bit sequential Galois field multipliers, whereas conventional techniques fail beyond 23-bit circuits.

Modular Inversion (MI) is one of the fundamental arithmetic operations in the finite field, which plays an essential role in various cryptographic applications and requires high performance and security. Unfortunately, the simple MI algorithm is vulnerable to side-channel attacks, such as the timing attack, which can compromise the cryptographic system by analyzing the time taken to execute cryptographic algorithms. Attackers may recover the initial data since the time can differ based on the input. Besides, the low complexity and low resource consumption of hardware implementations in MI are also challenging. In this article, we propose two novel modular inversion algorithms, named Constant-Time Integer Modular Inversion (CT-IMI) and Constant-Time Complementary Montgomery Modular Inversion (CT-CMMI). They both consist of constant iteration rounds to resist the timing attack. CT-IMI processes the data in the integer field, which is designed for common scenarios. CT-CMMI is suitable for the cross-domain case, which can directly use data in the Montgomery domain and avoid the conversion steps for some specific applications, e.g., scalar multiplication in Elliptic Curve Cryptography (ECC). In software simulations, we measure the average clock cycles for a single inversion and illustrate the relationship between various bit lengths and the latency. The significant differences between constant and non-constant algorithms demonstrate the vulnerability of modular inversion to timing attacks. In addition, we design two efficient hardware architectures on FPGA. Experimental results show that our CT-IMI can finish a single inversion in 2.56 \(\mu\) s with 4.2k LUTs, 1.8k FFs, and our CT-CMMI requires 2.45 \(\mu\) s with 2.7k LUTs, 1.6k FFs. The product of area and latency of our CT-IMI and CT-CMMI can reach 10.50 and 6.62, respectively, which shows optimal performance compared with all the results in the existing literature.

Elliptic curve cryptography (ECC) can ensure an equivalent security with much smaller key sizes. Elliptic curve scalar multiplication (ECSM) is a fundamental computation used in ECC. This paper focuses on ECSM resisting simple power attack and safe error attack of side-channel attack specifically. Elliptic curve complete addition (CA) formulae can achieve secure ECSM algorithms but are inefficient from memory and computational cost perspectives. Another secure ECSM, which uses (extended) affine, is more efficient for both memory and computational costs. However, it scans input scalars from right to left. In this paper, our developed scalar multiplication algorithms also use their extended affine, but scan from left to right (LR). We also prove the security of our LR ECSM algorithms and analyze them both theoretically and experimentally. Our new LR ECSM algorithms can reduce the amount of memory by \(37.5\%\) and reduce the computational time by more than \(40\%\) compared to Joye’s regular 2-ary LR algorithm with CA formulae.

With the advent of Elliptic curve cryptography (ECC); it grew unusually quickly because it had a smaller key size compared with that of the RSA cryptography system. Many researches are being done nowadays to make this type of cryptography more efficient. These investigations are about improving efficiency of both algorithm and method of implementations. This paper studies and analyzes some software libraries which support elliptic curve computations. Scalar multiplication is a major operation in ECC. Therefore, this study implements some methods of scalar multiplication by two software libraries LiDIA and MIRACL and compares the results at the end.

To ensure secure information exchange, demand for hardware implementation of elliptic curve cryptography (ECC) is increasing rapidly in recent years. In this paper, we propose an ASIC design for ECC over SCA-256 prime field, delivering both high performance and great SPA resistance. For algorithm selection, we integrate calculation simplification into the classic algorithm, Montgomery Powering Ladder (MPL). Based on the deduction of Fast NIST Reduction, we innovatively achieve the configurable modular multiplication module and then the isochronous point addition and double units. Pipeline architecture, execution order optimization and modular design are all applied to improved performance. Evaluated by CMOS standard cell library of 0.13 \(\upmu \)m, this ECC processor costs only 208 \(\upmu \)s and 6.8 \(\upmu \)J for one scalar multiplication and runs at high frequency of 228 MHz with area of 156 k gates. Compared to related works, it is much more advantageous in not only area-time product but also SPA resistant protection.

Wireless sensor networks (WSNs) pose a number of unique security challenges that demand innovation in several areas including the design of cryptographic primitives and protocols. Despite recent progress, the efficient implementation of Elliptic Curve Cryptography (ECC) for WSNs is still a very active research topic, and techniques to further reduce the time and energy cost of ECC are eagerly sought. This paper presents an optimized ECC implementation that we developed from scratch to comply with the severe resource constraints of 8‐bit sensor nodes such as the MICAz and IRIS motes. Our ECC software uses Optimal Prime Fields as underlying algebraic structure and supports two different families of elliptic curves, namely, Weierstraß‐form and twisted Edwards‐form curves. Due to the combination of efficient field arithmetic and fast group operations, we achieve an execution time of 5.3·106 clock cycles for a full 160‐bit scalar multiplication on an 8‐bit ATmega128 microcontroller, which is more than three times faster than the widely used TinyECC library. Our implementation also shows that the energy cost of scalar multiplication on a MICAz (or IRIS) mote amounts to just 17.34mJ when using a twisted Edwards curve over a 160‐bit Optimal Prime Field. This result further demonstrates the advantage of special family of elliptic curves for resource‐constrained environments. Copyright © 2015 John Wiley & Sons, Ltd.

Wireless Sensor Networks (WSNs) pose a number of unique security challenges that demand innovation in several areas including the design of cryptographic primitives and protocols. Despite recent progress, the efficient implementation of Elliptic Curve Cryptography (ECC) for WSNs is still a very active research topic and techniques to further reduce the time and energy cost of ECC are eagerly sought. This paper presents an optimized ECC implementation that we developed from scratch to comply with the severe resource constraints of 8-bit sensor nodes such as the MICAz and IRIS motes. Our ECC software uses Optimal Prime Fields (OPFs) as underlying algebraic structure and supports two different families of elliptic curves, namely Weierstraß-form and twisted Edwards-form curves. Due to the combination of efficient field arithmetic and fast group operations, we achieve an execution time of 5.8 · 106 clock cycles for a full 158-bit scalar multiplication on an 8-bit ATmega128 micro-controller, which is 2.78 times faster than the widely-used TinyECC library. Our implementation also shows that the energy cost of scalar multiplication on a MICAz (or IRIS) mote amounts to just 19~mJ when using a twisted Edwards curve over a 160-bit OPF. This result compares fairly well with the energy figures of two recently-presented hardware designs of ECC based on twisted Edwards curves.

Elliptic curve cryptography (ECC) has shorter key length than other asymmetric cryptography algorithms such as RSA with the same security level. Existing faults in cryptographic computations can cause faulty results. If a fault occurs during encryption, false information will be sent to the destination, in which case channel error detection codes are unable to detect the fault. In this paper, we consider the error detection in elliptic curve scalar multiplication point, which is the most important operation in ECC. Our technique is based on non-linear error detection codes. We consider an algorithm for scalar multiplication point proposed by Microsoft research group. The proposed technique in our methods has less overhead for additions (36.36%) and multiplications (34.84%) in total, compared to previous works. Also, the proposed method can detect almost 100% of injected faults.

The security of Internet of Things (IoT) devices is one of the most important problems to be addressed by the cryptographers and security engineers. The processing ability of IoT devices is limited, therefore light-weight and secure cryptographic tools are necessary for security of them. This paper shows the implementation of 256-bit Elliptic Curve Cryptography (ECC) on an 8-bit microcontroller. The proposed implementation applies towering technique for extension field of degree 32 with a certain 8-bit prime characteristic instead of the 256-bit prime characteristic. It enables to execute 256-bit ECC operations without complicated multiple-precision arithmetic on small computers like 8-bit microcontrollers. This approach efficiently realizes the scalability of the ECC encryption strength. In addition, the authors use a twisted Montgomery curve with a Montgomery ladder technique which enables fast calculations without inversions referring to Curve25519. It is considered resistant to the Side Channel Attack (SCA) since it applies the Montgomery ladder technique for scalar multiplication (SCM). This ECC implementation on Arduino UNO, an 8-bit microcontroller board, can be utilized for a key agreement protocol among IoT devices.

We present a high-speed public-key cryptoprocessor that exploits three-level parallelism in Elliptic Curve Cryptography (ECC) over GF(2 n ). The proposed cryptoprocessor employs a Parallelized Modular Arithmetic Logic Unit (P-MALU) that exploits two types of different parallelism for accelerating modular operations. The sequence of scalar multiplications is also accelerated by exploiting Instruction-Level Parallelism (ILP) and processing multiple P-MALU instructions in parallel. The system is programmable and hence independent of the type of the elliptic curves and scalar multiplication algorithms. The synthesis results show that scalar multiplication of ECC over GF(2163) on a generic curve can be computed in 20 and 16 μs respectively for the binary NAF (Non-Adjacent Form) and the Montgomery method. The performance can be accelerated furthermore on a Koblitz curve and reach scalar multiplication of 12 μs with the TNAF (τ-adic NAF) method. This fast performance allows us to perform over 80,000 scalar multiplications per second and to enhance security in wireless mobile applications.

There have been many digital signature schemes were developed based on the discrete logarithm problem on a finite field. In this study, we use the elliptic curve discrete logarithm problem to build new collective signature schemes. The cryptosystem on elliptic curve allows to generate digital signatures with the same level of security as other cryptosystems but with smaller keys. To extend practical applicability and enhance the security level of the group signature protocols, we propose two new types of collective digital signature schemes based on the discrete logarithm problem on the elliptic curve: i) the collective digital signature scheme shared by several signing groups and ii) the collective digital signature scheme shared by several signing groups and several individual signers. These two new types of collective signatures have combined the advantages of group digital signatures and collective digital signatures. These signatures have a fixed size and do not depend on the number of members participating in the creation of the final collective signature. One of the advantages of the proposed collective signature protocols is that they can be deployed on top of the available public key infrastructures.

On the low-end embedded processors, the implementations of Elliptic Curve Cryptography (ECC) are considered to be a challenging task due to the limited computation power and storage of the low-end embedded processors. Particularly, the multi-precision multiplication and squaring operations are the most expensive operations for ECC implementations. In order to enhance the performance, many works presented efficient multiplication and squaring routines on the target devices. Recent works show that 128-bit security level ECC is available within a second and this is practically fast enough for IoT services. However, previous approaches missed the other important storage issues (i.e., program size, ROM). Considering that the embedded processors only have a few KB ROM, we need to pay attention to the compact ROM size with reasonable performance. In this article, we present very compact and generic implementations of multiplication and squaring operations on the 16-bit MSP430X processors for the ECC. The implementations utilize the new 32-bit multiplier and advanced multiplication and squaring routines. Since the proposed routines are generic, the arbitrary length of operand is available with high-speed and small code size. With proposed multiplication and squaring routines, we implemented Curve25519 on the MSP430X processors. The scalar multiplication is performed within 6,666,895 clock cycles and 4,054 bytes. Compared with previous works based on the speed-optimized version, our memory-efficient version reduces the code size by 59.8%, sacrificing the execution timing by 20.5%.

We propose to represent a scalar in the form of d (1/2)(superscript a)3(superscript b), where a and b are integers and d is an odd integer belonging to a given set. This representation is a combination of the extended double-base number system (DBNS) and the double-base chain representation using powers of 1/2 and 3. Experimental results show that our approach leads to a shorter DBNS expansion and a lower complexity in elliptic curve scalar multiplication, with the cost of only a few pre-computations and storages. This contributes to the efficient implementation of elliptic curve cryptography (ECC).