The computational complexity of elliptic curve integer sub-decomposition (ISD) method

This work presents an evaluation of different software implementations of algorithms to compute the most demanding operation in cryptographic schemes based on Elliptic Curve Cryptography (ECC), the scalar multiplication. Five different methods were studied, including traditional and more sophisticated methods for elliptic curve cryptography defined over prime and binary fields. For evaluation, the key generation algorithm in ECC consisting on a single scalar multiplication was implemented on a P500h LG smarthphone, which includes an ARM processor running at 600MHz. Both execution time and memory usage was evaluated. It was found that in general, scalar multiplication runs 8 times faster for ECC defined over prime fields, being the NAF the best performer method. For ECC over binary fields, the best performer method was wNAF. The results presented in this work could help a designer to select the most appropriate method when implementing ECC-based cryptographic schemes such as encryption or digital signatures on mobile devices like smartphones, meeting implementation requirements in terms of execution time and memory usage.

The GLV method of Gallant, Lambert, and Vanstone (CRYPTO 2001) computes any multiple kP of a point P of prime order n lying on an elliptic curve with a low-degree endomorphism ? (called GLV curve) over $\mathbb{F}_{p}$ as $$kP = k_1P + k_2\varPhi(P) \quad\text{with } \max \bigl\{ |k_1|,|k_2| \bigr\} \leq C_1\sqrt{n} $$ for some explicit constant C 1>0. Recently, Galbraith, Lin, and Scott (EUROCRYPT 2009) extended this method to all curves over $\mathbb{F}_{p^{2}}$ which are twists of curves defined over $\mathbb{F}_{p}$ . We show in this work how to merge the two approaches in order to get, for twists of any GLV curve over $\mathbb{F}_{p^{2}}$ , a four-dimensional decomposition together with fast endomorphisms ?,? over $\mathbb{F}_{p^{2}}$ acting on the group generated by a point P of prime order n, resulting in a proven decomposition for any scalar k?[1,n] given by $$kP=k_1P+ k_2\varPhi(P)+ k_3\varPsi(P) + k_4\varPsi\varPhi(P) \quad \text{with } \max_i \bigl(|k_i| \bigr) 0. Remarkably, taking the best C 1,C 2, we obtain C 2/C 1<412, independently of the curve, ensuring in theory an almost constant relative speedup. In practice, our experiments reveal that the use of the merged GLV---GLS approach supports a scalar multiplication that runs up to 1.5 times faster than the original GLV method. We then improve this performance even further by exploiting the Twisted Edwards model and show that curves originally slower may become extremely efficient on this model. In addition, we analyze the performance of the method on a multicore setting and describe how to efficiently protect GLV-based scalar multiplication against several side-channel attacks. Our implementations improve the state-of-the-art performance of scalar multiplication on elliptic curves over large prime characteristic fields for a variety of scenarios including side-channel protected and unprotected cases with sequential and multicore execution.

Several mathematical concepts from analytics number theory, especially the counting functions (CFs) are employed to solve some modern problems in mathematics, computer sciences, engineering and others. One of them is the factorization problem for integers into two primes. This work proposes an extended factorization problem using the CFs, as main part from analytics number theory, to factor a real number r into two primes p and q. The computations of the points doubling and addition on the elliptic curves E modulo a composite number n are also used in this extension to give new two versions of the factorization over real field R. On the first version, the primes are obtained from doubling and addition on elliptic curve points that are computed modulo composite number which is resulting as output of the CFs algorithm with the input r. Whereas, the primes, on the second version, are got directly from applying the CFs algorithm with r as input. The successful computation of the scalar multiplication kP on the elliptic curve E modulo primes are determined. The computational complexities of extended elliptic curve factorization versions are determined using the counting operations. These operations are elliptic curve and finite field operations. New numerical results on two versions are computed as study cases. The elliptic curve factorization algorithm over R (ECF-R) with two versions, is more efficient for factoring-based cryptography in comparing to the original ECM.

Elliptic curve cryptography (ECC) can ensure an equivalent security with much smaller key sizes. Elliptic curve scalar multiplication (ECSM) is a fundamental computation used in ECC. This paper focuses on ECSM resisting simple power attack and safe error attack of side-channel attack specifically. Elliptic curve complete addition (CA) formulae can achieve secure ECSM algorithms but are inefficient from memory and computational cost perspectives. Another secure ECSM, which uses (extended) affine, is more efficient for both memory and computational costs. However, it scans input scalars from right to left. In this paper, our developed scalar multiplication algorithms also use their extended affine, but scan from left to right (LR). We also prove the security of our LR ECSM algorithms and analyze them both theoretically and experimentally. Our new LR ECSM algorithms can reduce the amount of memory by \(37.5\%\) and reduce the computational time by more than \(40\%\) compared to Joye’s regular 2-ary LR algorithm with CA formulae.

We introduce Four $$\mathbb {Q}$$ , a high-security, high-performance elliptic curve that targets the 128-bit security level. At the highest arithmetic level, cryptographic scalar multiplications on Four $$\mathbb {Q}$$ can use a four-dimensional Gallant-Lambert-Vanstone decomposition to minimize the total number of elliptic curve group operations. At the group arithmetic level, Four $$\mathbb {Q}$$ admits the use of extended twisted Edwards coordinates and can therefore exploit the fastest known elliptic curve addition formulas over large prime characteristic fields. Finally, at the finite field level, arithmetic is performed modulo the extremely fast Mersenne prime $$p=2^{127}-1$$ . We show that this powerful combination facilitates scalar multiplications that are significantly faster than all prior works. On Intel’s Haswell, Ivy Bridge and Sandy Bridge architectures, our software computes a variable-base scalar multiplication in 59,000, 71,000 cycles and 74,000 cycles, respectively; and, on the same platforms, our software computes a Diffie-Hellman shared secret in 92,000, 110,000 cycles and 116,000 cycles, respectively.

Elliptic curve cryptography involves numerous scalar multiplications, incurring high operational costs. In view of this, fast endomorphism is used to represent scalar multiplications, kP on elliptic curves. In the past, techniques such as Gallant-Lambert-Vanstone (GLV) method and Integer Sub-Decomposition (ISD) method have been proposed to reduce the cost of scalar multiplication on elliptic curves by using fast endomorphism. The GLV method employs a single-layer decomposition, breaking k into k1 and k2, while the ISD method uses a bilayer decomposition. The existence of fast endomorphisms which are constructed based on the concept of isogeny increase the computational efficiency of the GLV approach and reduce the operation count on the ISD method. This paper embeds the fast endomorphisms in the scalar multiplications on one of the family of elliptic curves with j-invariant 0, E0, which is the 192-bit Koblitz curve (Secp192k1). The performance of the ISD method in computing certain scalar multiplications on Secp192k1 in conjunction with fast endomorphisms and other various techniques such as binary representation, NAF representation, w-NAF and sliding windows are computed. The results demonstrated that the ISD method together with fast endomorphism, yields the most promising outcomes. This underscores the advantages of using fast endomorphisms in the ISD method on E0. .

In this work, a new graph has been defined as a main point to design a new version of an asymmetric encryption scheme. This graph is formed based on the scalar multiplication operation on elliptic curve defined over a prime field, which is called an elliptic scalar multiplication (ESM) graph. Some mathematical facts to show the ESM graph is a complete graph are proved theoretically. On the complete elliptic scalar multiplication (CESM) graph, an asymmetric encryption algorithm has been implemented. Fast computations on the proposed algorithm are Z obtained through the matrices representation and determination of the minimum spanning tree (MST) to compute the ciphertext. More secure computations with the CESM graphic encryption algorithm in comparison with the previous asymmetric encryption algorithms. So, the CESM graphic asymmetric encryption algorithm is considered as a new sight for elliptic curve cryptographic usages.

In this paper we introduce scalar multiplication algorithms for several classes of elliptic and hyperelliptic curves. The methods are variations on Yao's scalar multiplication algorithm where independent group operations are shown in an explicit way. We can thusmerge several group operations and reduce the number of field operations by means of Montgomery's trick. The results are that scalar multiplication on elliptic curves in even characteristic based on point halving can be improved by at least 10% and the performance of Koblitz curves by 25% to 32%.

The first step in elliptic curve scalar multiplication algorithms based on scalar decompositions using efficient endomorphisms—including Gallant–Lambert–Vanstone (GLV) and Galbraith–Lin–Scott (GLS) multiplication, as well as higher-dimensional and higher-genus constructions—is to produce a short basis of a certain integer lattice involving the eigenvalues of the endomorphisms. The shorter the basis vectors, the shorter the decomposed scalar coefficients, and the faster the resulting scalar multiplication. Typically, we use the eigenvalues to write down a long basis, which we then reduce using the Euclidean algorithm, Gauss reduction, LLL, or even a more specialized algorithm. In this work, we use elementary facts about quadratic rings to immediately write down a short basis for the elliptic curve GLV, GLS, GLV+GLS, and Q \mathbb {Q} -curve constructions, and for genus 2 real multiplication constructions. We do not pretend that this represents a significant optimization in scalar multiplication, since the lattice reduction step is always an offline precomputation—but it does give a better insight into the structure of scalar decompositions. In any case, it is always more convenient to use a ready-made short basis than it is to compute a new one.

Pseudo-random scalar multiplication based on group isomorphism

We present a new methodology to derive faster composite operations of the form dP + Q, where d is a small integer ≥ 2, for generic ECC scalar multiplications over prime fields. In particular, we present an efficient Doubling-Addition (DA) operation that can be exploited to accelerate most scalar multiplication methods, including multiscalar variants. We also present a new precomputation scheme useful for window-based scalar multiplication that is shown to achieve the lowest cost among all known methods using only one inversion. In comparison to the remaining approaches that use none or several inversions, our scheme offers higher performance for most common I/M ratios. By combining the benefits of our precomputation scheme and the new DA operation, we can save up to 6.2% on the scalar multiplication using fractional wNAF.

We present new algorithms computing 3P and $$2P+Q$$2P+Q by removing the same part of numerators and denominators of their formulas, given two points P and Q on elliptic curves defined over prime fields and binary fields in affine coordinates. Our algorithms save one or two field multiplications compared with ones presented by Ciet, Joye, Lauter, and Montgomery. Since $$2P+Q$$2P+Q takes $$\frac{1}{3}$$13 proportion, 28.5i¾?% proportion, and 25.8i¾?% proportion of all point operations by non-adjacent form, binary/ternary approach and tree approach to compute scalar multiplications respectively, 3P occupies 42.9i¾?% proportion and 33.4i¾?% proportion of all point operations by binary/ternary approach and tree approach to compute scalar multiplications respectively, utilizing our new formulas of $$2P+Q$$2P+Q and 3P, scalar multiplications by using non-adjacent form, binary/ternary approach and tree approach are improved.

This paper proposes fast elliptic curve multiplication algorithms resistant against side channel attacks, based on the Montgomery-type scalar multiplication. The proposed scalar multiplications can be applied to all curves over prime fields, e.g., any standardized curves over finite fields with characteristic larger than 3. The method utilizes the addition formulas xECDBL and xECADD assembled by only x-coordinates of points, and is applicable for any types of curves over finite fields. Then, we encapsulate two addition formulas into one formula xECADDDBL, which accomplishes a faster computation because several auxiliary variables of two formulas can be shared. We also develop a novel addition chain for the new formula, with which we can compute scalar multiplications. The improvement of our scalar multiplications over previous Coron's dummy operation method is about 18% for a 160-bit scalar multiplication. Our method requires no table-up of precomputed points and it is suitable for the implementation on memory constraint computing architectures, e.g., smart cards. Moreover, we optimize the proposed algorithms for parallelized implementations with SIMD operations. Compared with the similar scheme proposed by Fischer et al., our scheme is about 16% faster.

Design of highly efficient elliptic curve crypto-processor with two multiplications over GF(2 163)

Because of their shorter key sizes, cryptosystems based on elliptic curves are being increasingly used in practical applications. A special class of elliptic curves, namely, Koblitz curves, offers an additional but crucial advantage of considerably reduced processing time. In this article, power analysis attacks are applied to cryptosystems that use scalar multiplication on Koblitz curves. Both the simple and the differential power analysis attacks are considered and a number of countermeasures are suggested. While the proposed countermeasures against the simple power analysis attacks rely on making the power consumption for the elliptic curve scalar multiplication independent of the secret key, those for the differential power analysis attacks depend on randomizing the secret key prior to each execution of the scalar multiplication.