CA2631276C - Exponentiation method using multibase number representation - Google Patents
Exponentiation method using multibase number representation Download PDFInfo
- Publication number
- CA2631276C CA2631276C CA 2631276 CA2631276A CA2631276C CA 2631276 C CA2631276 C CA 2631276C CA 2631276 CA2631276 CA 2631276 CA 2631276 A CA2631276 A CA 2631276A CA 2631276 C CA2631276 C CA 2631276C
- Authority
- CA
- Canada
- Prior art keywords
- representation
- multibase
- scalar
- multiplication
- ecc
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
- G06F7/60—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers
- G06F7/72—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers using residue arithmetic
- G06F7/724—Finite field arithmetic
- G06F7/725—Finite field arithmetic over elliptic curves
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/002—Countermeasures against attacks on cryptographic mechanisms
- H04L9/003—Countermeasures against attacks on cryptographic mechanisms for power analysis, e.g. differential power analysis [DPA] or simple power analysis [SPA]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L9/3066—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2207/00—Indexing scheme relating to methods or arrangements for processing data by operating upon the order or content of the data handled
- G06F2207/72—Indexing scheme relating to groups G06F7/72 - G06F7/729
- G06F2207/7219—Countermeasures against side channel or fault attacks
- G06F2207/7261—Uniform execution, e.g. avoiding jumps, or using formulae with the same power profile
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/12—Details relating to cryptographic hardware or logic circuitry
- H04L2209/125—Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/80—Wireless
- H04L2209/805—Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Pure & Applied Mathematics (AREA)
- Mathematical Optimization (AREA)
- Mathematical Analysis (AREA)
- Computing Systems (AREA)
- Mathematical Physics (AREA)
- Computational Mathematics (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- General Engineering & Computer Science (AREA)
- Algebra (AREA)
- Complex Calculations (AREA)
Abstract
A method of scalar multiplication for use in elliptic curve-based cryptosystems (ECC) is provided. Scalars are represented using a generic multibase form combined with the non-adjacency property, which greatly reduces the nonzero density in the representation. The method allows for flexibly selecting an unrestricted number of bases and their weight in the representation according to the particular characteristics of a setting, in such a way that computing costs are minimized. A simple, memory-friendly conversion process from binary to multibase representation and an inexpensive methodology to protect the multibase scalar multiplication against simple-side channel attacks are also provided.
Description
EXPONENTIATION METHOD USING MULTIBASE NUMBER
REPRESENTATION
TECHNICAL FIELD
The present invention relates to security technology, specifically, it relates to the computation of elliptic curve scalar multiplication.
BACKGROUND =
Elliptic curve cryptosystems (ECC) are public-key cryptosystems that have attracted increasing attention in recent years due to their shorter key length requirement in comparison with other public-key cryptosystems such as RSA.
Public-key cryptosystems make use of a pair of keys, called public and private keys, to perform cryptographic operations such as encryption/decryption of data and signing/verification of digital signatures. In particular for ECC, in some protocols private keys are scalar values that are kept in secret, and public keys are points on the elliptic curve that are made public. Given a secret scalar k and points P
and kP
on a elliptic curve, where kP is a multiple of the point P, the elliptic curve discrete logarithm problem (ECDLP) is defined as the problem of determining k, with P
and kP known. The ECDLP problem is thought to be hard to solve, and the difficulty to solve it is precisely the security foundation of EC-based systems.
ECC can be defined over different finite fields. Most important finite fields used to date to implement this cryptosystem have been binary, prime and extension fields.
Finite fields are denoted by GF(q), where q is a prime power of the form pm (p prime) and also represents the number of elements (order) of the field. If m = 1, this field is referred to as prime field. If, otherwise, 2 then it is known as extension field. The particular case m = 2 among extension fields is also known as binary field.
For the case of prime fields, the generic equation to represent an elliptic curve is given by:
E: y2 =x3 +ax+b, -1¨
where: a,b E GF(p) and A = 4a3 + 27b2 0(modp) (A denotes the discriminant of the curve E).
For the case of binary fields, the generic equation to represent an elliptic curve is given by:
E: y2+xy=x3-Fax2+b, where: a,b E GF(r) and A = b #0 .
Other variants of elliptic curve forms that also use prime, extended and/or binary fields can be found in the literature. Some examples are: Hessian and Jacobi forms, Edwards curves, Montgomery curves, elliptic curves of degree 2/3 isogenies, among others.
The central and most time-consuming operation in ECC is scalar multiplication, which is generally represented by kP. This operation can be interpreted as the result of adding the point P to itself (i.e., P+P+...+P) (k-1) times, where k is a scalar of very large value. Currently, a secure ECC system uses scalars with bit lengths in the range [160,512], where larger values provide higher security level.
Another important aspect related to the deployment of a cryptosystem is its vulnerability to attacks exploiting side-channel information.
Side-channel information, such as power dissipation and electromagnetic emission, leaked by real-world devices has been shown to be highly useful for revealing private keys and effectively breaking the otherwise mathematically-strong ECC
crypto system.
There are two main strategies to these attacks: simple (SSCA) and differential (DSCA) side-channel attacks. SSCA is based on the analysis of a single execution trace of a scalar multiplication to guess the secret key by revealing the sequence of operations used in the execution of ECC point arithmetic.
Extensive research has been carried out to yield effective countermeasures to deal with SSCA. Among them, side-channel atomicity dissolves point operations into small homogenous blocks, known as atomic blocks, which cannot be distinguished -2¨
from one another through simple ide-channel analysis because each one contains the same pattern of basic field operations. Furthermore, atomic blocks are made sufficiently small to make this approach inexpensive. For example the structure M-A-N-A (field multiplication, addition, negation, addition) has been proposed to build SSCA-protected point operations over prime fields.
However, the main drawback of the traditional M-A-N-A structure is that it relies on the assumption that field multiplication and squaring are indistinguishable from each other. In software implementations, timing and power consumption have been shown to be quite different for these operations, making them directly distinguishable through power analysis. Furthermore, from a performance viewpoint, the M-A-N-A structure is not optimal in several settings where the increased number of field additions that it requires becomes non-negligible.
Nowadays, embedded computers dominate the marketplace. They are used in almost every new application requiring certain computing capabilities, especially in those involving consumer devices. A very important issue involves providing adequate security to these applications. However, this task seems to contrast with the effort by manufacturers of reducing product cost, size and power consumption. It is therefore a challenging task to make possible the implementation of cryptographic systems on these constrained devices. In particular for ECC, there is a need for accelerating the scalar multiplication without impacting memory and keeping it protected against side-channel attacks, in such a way that its implementation can be realized in the myriad of new devices with limited resources.
SUMMARY
The disclosure provides a method for accelerating scalar multiplication by representing the scalar value with a short multibase representation. A method that converts any positive integer (scalar) to such representation without requiring additional memory resources is also provided.
In accordance with the present disclosure there is provided a method of accelerating scalar multiplication in an elliptic curve-based cryptosystem by representing a scalar value with a multibase representation comprising the steps of: a) selecting a set of -3¨
bases and corresponding set of window values for performing an ECC scalar multiplication; b) calculating precomputed values according to selected bases and window values wherein the precomputed values are points of a form diP, where diEDNO} and P is a point on a elliptic curve for which a ECC scalar multiplication kP is computed; c) determining a multibase representation of the selected scalar value; and d) scanning digits of the multibase representation from left to right until all the digits of the multibase representation are exhausted, performing a point operation of the form aiQ for every scanned digit with associated base ai E A, and performing an additional point addition of a form Q=Q diP if a digit has nonzero value di, where diP is a point of the precomputed table and Q is a partial result of the scalar multiplication.
In accordance with the present disclosure there is provided an apparatus for accelerating scalar multiplication in an elliptic curve-based cryptosystem by representing a scalar value with a multibase representation, the apparatus comprising: a memory; a processor for performing the steps of: a) selecting a set of bases and corresponding set of window values for performing an ECC scalar multiplication; b) calculating precomputed values according to selected bases and window values wherein the precomputed values are points of a form diP, where EDNOI and P is a point on a elliptic curve for which a ECC scalar multiplication kP is computed; c) determining a multibase representation of the selected scalar value; and d) scanning digits of the multibase representation from left to right until all the digits of the multibase representation are exhausted, performing a point operation of the form (1N for every scanned digit with associated base a E A, and performing an additional point addition of a form Q=Q diP if a digit has nonzero value di, where diP is a point of the precomputed table and Q is a partial result of the scalar multiplication.
In accordance with the present disclosure there is provided a computer readable medium containing instructions for accelerating scalar multiplication in an elliptic curve-based cryptosystem by representing a scalar value with a multibase representation, the instructions which when executed by a processor perform the -4¨
steps of: a) selecting a set of bases and corresponding set of window values for performing an ECC scalar multiplication; b) calculating precomputed values according to selected bases and window values wherein the precomputed values are points of a form diP , where di EDNO} and P is a point on a elliptic curve for which a ECC scalar multiplication kP is computed; c) determining a multibase representation of the selected scalar value; and d) scanning digits of the multibase representation from left to right until all the digits of the multibase representation are exhausted, performing a point operation of the form aiQ for every scanned digit with associated base ai E A, and performing an additional point addition of a form Q.Q diP if a digit has nonzero value di, where diP is a point of the precomputed table and Q is a partial result of the scalar multiplication.
The multibase representation may be of the form:
m J
k =Esinar , 1=1 j=1 where: positive prime integers al aj are selected bases determining the set A ={al,...,aj}, global base a = araP...a}vi is set using a selected window set SI = {wi,w2,= = -,w4, where w; 0 for 1 si are signed digits from the set D\ {0} , s.t.
and si ED\ {0} , where the digit set is given by:
[a 2 -11 - 1- - 2a-,, ap= = , p= = ,-If , = 2ai - za2 2a - J
ci(j) are decreasing exponents, s.t. c1(f) c1+0)+ wi w; for 1 m-1 and each 1 and m is the length of the expansion.
REPRESENTATION
TECHNICAL FIELD
The present invention relates to security technology, specifically, it relates to the computation of elliptic curve scalar multiplication.
BACKGROUND =
Elliptic curve cryptosystems (ECC) are public-key cryptosystems that have attracted increasing attention in recent years due to their shorter key length requirement in comparison with other public-key cryptosystems such as RSA.
Public-key cryptosystems make use of a pair of keys, called public and private keys, to perform cryptographic operations such as encryption/decryption of data and signing/verification of digital signatures. In particular for ECC, in some protocols private keys are scalar values that are kept in secret, and public keys are points on the elliptic curve that are made public. Given a secret scalar k and points P
and kP
on a elliptic curve, where kP is a multiple of the point P, the elliptic curve discrete logarithm problem (ECDLP) is defined as the problem of determining k, with P
and kP known. The ECDLP problem is thought to be hard to solve, and the difficulty to solve it is precisely the security foundation of EC-based systems.
ECC can be defined over different finite fields. Most important finite fields used to date to implement this cryptosystem have been binary, prime and extension fields.
Finite fields are denoted by GF(q), where q is a prime power of the form pm (p prime) and also represents the number of elements (order) of the field. If m = 1, this field is referred to as prime field. If, otherwise, 2 then it is known as extension field. The particular case m = 2 among extension fields is also known as binary field.
For the case of prime fields, the generic equation to represent an elliptic curve is given by:
E: y2 =x3 +ax+b, -1¨
where: a,b E GF(p) and A = 4a3 + 27b2 0(modp) (A denotes the discriminant of the curve E).
For the case of binary fields, the generic equation to represent an elliptic curve is given by:
E: y2+xy=x3-Fax2+b, where: a,b E GF(r) and A = b #0 .
Other variants of elliptic curve forms that also use prime, extended and/or binary fields can be found in the literature. Some examples are: Hessian and Jacobi forms, Edwards curves, Montgomery curves, elliptic curves of degree 2/3 isogenies, among others.
The central and most time-consuming operation in ECC is scalar multiplication, which is generally represented by kP. This operation can be interpreted as the result of adding the point P to itself (i.e., P+P+...+P) (k-1) times, where k is a scalar of very large value. Currently, a secure ECC system uses scalars with bit lengths in the range [160,512], where larger values provide higher security level.
Another important aspect related to the deployment of a cryptosystem is its vulnerability to attacks exploiting side-channel information.
Side-channel information, such as power dissipation and electromagnetic emission, leaked by real-world devices has been shown to be highly useful for revealing private keys and effectively breaking the otherwise mathematically-strong ECC
crypto system.
There are two main strategies to these attacks: simple (SSCA) and differential (DSCA) side-channel attacks. SSCA is based on the analysis of a single execution trace of a scalar multiplication to guess the secret key by revealing the sequence of operations used in the execution of ECC point arithmetic.
Extensive research has been carried out to yield effective countermeasures to deal with SSCA. Among them, side-channel atomicity dissolves point operations into small homogenous blocks, known as atomic blocks, which cannot be distinguished -2¨
from one another through simple ide-channel analysis because each one contains the same pattern of basic field operations. Furthermore, atomic blocks are made sufficiently small to make this approach inexpensive. For example the structure M-A-N-A (field multiplication, addition, negation, addition) has been proposed to build SSCA-protected point operations over prime fields.
However, the main drawback of the traditional M-A-N-A structure is that it relies on the assumption that field multiplication and squaring are indistinguishable from each other. In software implementations, timing and power consumption have been shown to be quite different for these operations, making them directly distinguishable through power analysis. Furthermore, from a performance viewpoint, the M-A-N-A structure is not optimal in several settings where the increased number of field additions that it requires becomes non-negligible.
Nowadays, embedded computers dominate the marketplace. They are used in almost every new application requiring certain computing capabilities, especially in those involving consumer devices. A very important issue involves providing adequate security to these applications. However, this task seems to contrast with the effort by manufacturers of reducing product cost, size and power consumption. It is therefore a challenging task to make possible the implementation of cryptographic systems on these constrained devices. In particular for ECC, there is a need for accelerating the scalar multiplication without impacting memory and keeping it protected against side-channel attacks, in such a way that its implementation can be realized in the myriad of new devices with limited resources.
SUMMARY
The disclosure provides a method for accelerating scalar multiplication by representing the scalar value with a short multibase representation. A method that converts any positive integer (scalar) to such representation without requiring additional memory resources is also provided.
In accordance with the present disclosure there is provided a method of accelerating scalar multiplication in an elliptic curve-based cryptosystem by representing a scalar value with a multibase representation comprising the steps of: a) selecting a set of -3¨
bases and corresponding set of window values for performing an ECC scalar multiplication; b) calculating precomputed values according to selected bases and window values wherein the precomputed values are points of a form diP, where diEDNO} and P is a point on a elliptic curve for which a ECC scalar multiplication kP is computed; c) determining a multibase representation of the selected scalar value; and d) scanning digits of the multibase representation from left to right until all the digits of the multibase representation are exhausted, performing a point operation of the form aiQ for every scanned digit with associated base ai E A, and performing an additional point addition of a form Q=Q diP if a digit has nonzero value di, where diP is a point of the precomputed table and Q is a partial result of the scalar multiplication.
In accordance with the present disclosure there is provided an apparatus for accelerating scalar multiplication in an elliptic curve-based cryptosystem by representing a scalar value with a multibase representation, the apparatus comprising: a memory; a processor for performing the steps of: a) selecting a set of bases and corresponding set of window values for performing an ECC scalar multiplication; b) calculating precomputed values according to selected bases and window values wherein the precomputed values are points of a form diP, where EDNOI and P is a point on a elliptic curve for which a ECC scalar multiplication kP is computed; c) determining a multibase representation of the selected scalar value; and d) scanning digits of the multibase representation from left to right until all the digits of the multibase representation are exhausted, performing a point operation of the form (1N for every scanned digit with associated base a E A, and performing an additional point addition of a form Q=Q diP if a digit has nonzero value di, where diP is a point of the precomputed table and Q is a partial result of the scalar multiplication.
In accordance with the present disclosure there is provided a computer readable medium containing instructions for accelerating scalar multiplication in an elliptic curve-based cryptosystem by representing a scalar value with a multibase representation, the instructions which when executed by a processor perform the -4¨
steps of: a) selecting a set of bases and corresponding set of window values for performing an ECC scalar multiplication; b) calculating precomputed values according to selected bases and window values wherein the precomputed values are points of a form diP , where di EDNO} and P is a point on a elliptic curve for which a ECC scalar multiplication kP is computed; c) determining a multibase representation of the selected scalar value; and d) scanning digits of the multibase representation from left to right until all the digits of the multibase representation are exhausted, performing a point operation of the form aiQ for every scanned digit with associated base ai E A, and performing an additional point addition of a form Q.Q diP if a digit has nonzero value di, where diP is a point of the precomputed table and Q is a partial result of the scalar multiplication.
The multibase representation may be of the form:
m J
k =Esinar , 1=1 j=1 where: positive prime integers al aj are selected bases determining the set A ={al,...,aj}, global base a = araP...a}vi is set using a selected window set SI = {wi,w2,= = -,w4, where w; 0 for 1 si are signed digits from the set D\ {0} , s.t.
and si ED\ {0} , where the digit set is given by:
[a 2 -11 - 1- - 2a-,, ap= = , p= = ,-If , = 2ai - za2 2a - J
ci(j) are decreasing exponents, s.t. c1(f) c1+0)+ wi w; for 1 m-1 and each 1 and m is the length of the expansion.
In addition there is provided for protecting scalar multiplication against simple side-channel attacks using atomic structures that offer higher security level and/or lower computational overhead.
Other aspects and features will become apparent to those ordinarily skilled in the art upon review of the following description in conjunction with the accompanying figures.
BRIEF DESCRIPTION OF THE DRAWINGS
Further features and advantages will become apparent from the following detailed description, taken in combination with the appended drawings, in which:
FIG. 1 is a flow diagram for computing scalar multiplications using multibase number representation;
FIG. 2 is a flow diagram for converting any scalar value to multibase representation;
FIG. 3 is a flow diagram showing the method of protecting against simple side-channel attacks;
FIG. 4 is a flow diagram showing the method of replacing multiplication by squarings and other cheaper field operations; and FIG. 5 is a block diagram illustrating an execution environment.
It should be noted that throughout the appended drawings, like features are identified by like reference numerals.
DETAILED DESCRIPTION
Embodiments are described below, by way of example only, with reference to Figs.
1-5. A system and method are provided for accelerating scalar multiplication by representing the scalar value with a short multibase representation, which is obtained by means of a conversion methodology that does not require additional memory resources.
Other aspects and features will become apparent to those ordinarily skilled in the art upon review of the following description in conjunction with the accompanying figures.
BRIEF DESCRIPTION OF THE DRAWINGS
Further features and advantages will become apparent from the following detailed description, taken in combination with the appended drawings, in which:
FIG. 1 is a flow diagram for computing scalar multiplications using multibase number representation;
FIG. 2 is a flow diagram for converting any scalar value to multibase representation;
FIG. 3 is a flow diagram showing the method of protecting against simple side-channel attacks;
FIG. 4 is a flow diagram showing the method of replacing multiplication by squarings and other cheaper field operations; and FIG. 5 is a block diagram illustrating an execution environment.
It should be noted that throughout the appended drawings, like features are identified by like reference numerals.
DETAILED DESCRIPTION
Embodiments are described below, by way of example only, with reference to Figs.
1-5. A system and method are provided for accelerating scalar multiplication by representing the scalar value with a short multibase representation, which is obtained by means of a conversion methodology that does not require additional memory resources.
A direct calculation of a scalar multiplication of the form kP would involve adding P
to itself (i.e., P+P+...+P) (k-1) times. This procedure is highly time consuming for typical sizes of k. A straightforward improvement would be representing the scalar value using a binary representation with elements {0,1}. Thus, scalar multiplication becomes more efficient by using the two basic ECC point operations, namely doubling (2P) and addition (P+Q) of points, where P and Q are points on the elliptic curve. The nonzero density of the binary representation is about 1/2. Hence, the average cost of a scalar multiplication in this case is approximately (n-1)D+(n/ 2)A, where n is the average bit length of a randomly chosen scalar k, and D and A
represent cost of point doubling and addition, respectively.
By observing that additive inverses of ECC points (e.g., -P) are very inexpensive to compute, one can make use of a signed binary representation. Among different signed radix-2 representations using elements in the set D ={0, 1} , Non-Adjacent Form (NAF) is a canonical representation with the fewest number of nonzero digits for any scalar value. The NAF representation of a scalar contains at most one nonzero digit among any two successive digits. The expected nonzero density of this representation is 1/3. Hence, the average cost of a scalar multiplication using NAF is approximately (n - 1)D+(n/3)A.
If there is memory available, one can make use of precomputations to reduce the computing time further. This method is known as Window-w NAF (wNAF), and it basically exploits the availability of precomputed values to "insert" windows of width w, which permits the consecutive execution of several doublings to reduce the density of the expansion. The wNAF representation of a scalar contains at most one nonzero digit among any w successive digits. The average density of nonzero digits for a window of width w is D,NAF =1/(w +1), and the number of required precomputed points is (2w-2-1) (hereafter we refer as precomputed points to non-trivial points not including {0,9). Thus, the cost using this method is approximately (n-1)D+ (n I(w + 1))A
Other alternative methods exist. However, they provide mixed results because they may achieve lower computing costs but involve very expensive requirements in terms of memory. For instance, although the evaluation stage of the scalar multiplication using the double-base number system (DBNS) can be sped up by reducing the required number of point additions, converting a number to DBNS representation is very costly in terms of speed and memory. The latter is especially impractical in constrained devices such as smartcards, RFIDs and many others.
In the present disclosure, a system and method is described that computes the scalar multiplication using a generic multibase representation with the objective of reducing the time execution by utilizing short multibase representations without impacting memory is also provided.
The following multibase representation is provided for the representation of a given scalar k:
m J
k = sinar , (1) i=1 j=i where: bases al az aj are positive prime integers from a set of bases A =
{a 1, = = = ,a4 si are signed digits from a given set D\ {0} , i.e 1 and si E D \ {0} .
c1(j) are decreasing exponents, and m is the length of the expansion.
In addition, a global base a = ariar ...alp is defined, using window set n =
{wbw2,...,wf}, where wi 0 for 1 j :5. J, and impose the following restriction:
c1(j) ci+I(j)+ wi w, for 1 m -1 and each 1 J.
The previous condition guarantees that an expansion of the form (1) is efficiently executed by a scalar multiplication using Homer's method as follows:
kP =(m J J
Es Ear P nato nafr-.0 +sõ,P
i=1 j=1 j=i j=1 , where 4(j _0, and di(j).w., for 15j5_m ¨1 and 15_ j _µ1 .
For efficiency purposes, the multibase representation requires a digit set of the form (2) {2a1 2a2 2ai where there are only considered digits that are not multiples of the bases.
The multibase representation provided permits to flexibly define the set of bases that are the most efficient for a given setting. Also, it permits to specify well-defined distances between exponents by means of the highly flexible global base. It will become evident in the following paragraphs that the latter allows for devising efficient methods to convert numbers to short multibase representations.
Figure 1 illustrates a method for computing the scalar multiplication using a representation of the form (1). At step 102, the method involves first defining or selecting the set of bases and windows to use according to the characteristics of a given setting. In particular, to include a given base a1 in the representation it is determined whether or not performing an operation of the form aiQ , where Q is a point on the elliptic curve, is relatively efficient. For instance, doubling (i.e., aj =2) is a highly efficient operation in most common elliptic curve forms, so it should be included to achieve the highest performance when working with these specific curves.
In the case of the window set, the window values should be defined for each base aj according to the relative performance of the corresponding operation aiQ
and also taking into account memory restrictions.
Once the set of bases has been defined, and according to the particular application, at step 104 it is determined if SSCA protection is required. If it is required, YES at step 104, at step 106 the method depicted by Figure 3 is executed to protect all the operations of the form a iQ , and also point addition.
to itself (i.e., P+P+...+P) (k-1) times. This procedure is highly time consuming for typical sizes of k. A straightforward improvement would be representing the scalar value using a binary representation with elements {0,1}. Thus, scalar multiplication becomes more efficient by using the two basic ECC point operations, namely doubling (2P) and addition (P+Q) of points, where P and Q are points on the elliptic curve. The nonzero density of the binary representation is about 1/2. Hence, the average cost of a scalar multiplication in this case is approximately (n-1)D+(n/ 2)A, where n is the average bit length of a randomly chosen scalar k, and D and A
represent cost of point doubling and addition, respectively.
By observing that additive inverses of ECC points (e.g., -P) are very inexpensive to compute, one can make use of a signed binary representation. Among different signed radix-2 representations using elements in the set D ={0, 1} , Non-Adjacent Form (NAF) is a canonical representation with the fewest number of nonzero digits for any scalar value. The NAF representation of a scalar contains at most one nonzero digit among any two successive digits. The expected nonzero density of this representation is 1/3. Hence, the average cost of a scalar multiplication using NAF is approximately (n - 1)D+(n/3)A.
If there is memory available, one can make use of precomputations to reduce the computing time further. This method is known as Window-w NAF (wNAF), and it basically exploits the availability of precomputed values to "insert" windows of width w, which permits the consecutive execution of several doublings to reduce the density of the expansion. The wNAF representation of a scalar contains at most one nonzero digit among any w successive digits. The average density of nonzero digits for a window of width w is D,NAF =1/(w +1), and the number of required precomputed points is (2w-2-1) (hereafter we refer as precomputed points to non-trivial points not including {0,9). Thus, the cost using this method is approximately (n-1)D+ (n I(w + 1))A
Other alternative methods exist. However, they provide mixed results because they may achieve lower computing costs but involve very expensive requirements in terms of memory. For instance, although the evaluation stage of the scalar multiplication using the double-base number system (DBNS) can be sped up by reducing the required number of point additions, converting a number to DBNS representation is very costly in terms of speed and memory. The latter is especially impractical in constrained devices such as smartcards, RFIDs and many others.
In the present disclosure, a system and method is described that computes the scalar multiplication using a generic multibase representation with the objective of reducing the time execution by utilizing short multibase representations without impacting memory is also provided.
The following multibase representation is provided for the representation of a given scalar k:
m J
k = sinar , (1) i=1 j=i where: bases al az aj are positive prime integers from a set of bases A =
{a 1, = = = ,a4 si are signed digits from a given set D\ {0} , i.e 1 and si E D \ {0} .
c1(j) are decreasing exponents, and m is the length of the expansion.
In addition, a global base a = ariar ...alp is defined, using window set n =
{wbw2,...,wf}, where wi 0 for 1 j :5. J, and impose the following restriction:
c1(j) ci+I(j)+ wi w, for 1 m -1 and each 1 J.
The previous condition guarantees that an expansion of the form (1) is efficiently executed by a scalar multiplication using Homer's method as follows:
kP =(m J J
Es Ear P nato nafr-.0 +sõ,P
i=1 j=1 j=i j=1 , where 4(j _0, and di(j).w., for 15j5_m ¨1 and 15_ j _µ1 .
For efficiency purposes, the multibase representation requires a digit set of the form (2) {2a1 2a2 2ai where there are only considered digits that are not multiples of the bases.
The multibase representation provided permits to flexibly define the set of bases that are the most efficient for a given setting. Also, it permits to specify well-defined distances between exponents by means of the highly flexible global base. It will become evident in the following paragraphs that the latter allows for devising efficient methods to convert numbers to short multibase representations.
Figure 1 illustrates a method for computing the scalar multiplication using a representation of the form (1). At step 102, the method involves first defining or selecting the set of bases and windows to use according to the characteristics of a given setting. In particular, to include a given base a1 in the representation it is determined whether or not performing an operation of the form aiQ , where Q is a point on the elliptic curve, is relatively efficient. For instance, doubling (i.e., aj =2) is a highly efficient operation in most common elliptic curve forms, so it should be included to achieve the highest performance when working with these specific curves.
In the case of the window set, the window values should be defined for each base aj according to the relative performance of the corresponding operation aiQ
and also taking into account memory restrictions.
Once the set of bases has been defined, and according to the particular application, at step 104 it is determined if SSCA protection is required. If it is required, YES at step 104, at step 106 the method depicted by Figure 3 is executed to protect all the operations of the form a iQ , and also point addition.
-9¨
If SSCA is not required, NO at step 104, at step 108 the values of the precomputed table are calculated. Specifically, in the case of multibase representation, the table consists of all the points of the form d,P, where diED \{0} (see (2)).
At step 110, the procedure depicted by Figure 2 is executed to determine the multibase representation of the scalar value. Then, the value of the scalar multiplication is computed by scanning the obtained multibase representation digit by digit. Per digit scanned, a step 112, one operation of the form aiQ is executed, where a, is the specific base associated to the current digit at step 114.
If the digit scanned is nonzero, YES at step 116, then one addition of the form Q d,P is performed at step 118, where Q is the current value of the scalar multiplication and d,P is a point from the precomputed table. Note that the value d, corresponds to the value of the scanned digit. Although, the precomputed table only contains positive values, it has been stated previously that computing inverses of points (in this case, ¨d,P) is inexpensive and can be calculated on-the-fly.
If the scanning is complete, YES at step 120, all the digits in the multibase representation has been scanned, and the result of the scalar multiplication is provided at step 122.
In the following, a method is described that determines short multibase representations of scalar values.
Referring to figure 2, short multibase representations of the scalar value are determined. Inputs of the scalar value are provided at step 210, and then at step 220 begins the execution while the initial or partial value of the scalar is different from zero and any value of the precomputed table. Once it reaches zero, YES at step 220, the method ends and gives the multibase representation of the input scalar at step 230.
At each iteration, and while the partial value of the scalar is other than zero, NO at step 220, it is determined at step 240 if the scalar is divisible by one of the bases.
For a given set of bases A = {a1,...,a4, the test of divisibility begins with j = 1 and stops when j = .1 or if a base divides the scalar value. If one of the bases is successfully selected, YES at step 240, then a zero digit is set at step 250 together with its corresponding base, and the scalar value is updated by dividing it by the base in step 290.
If, otherwise, NO at step 240, the scalar is not divisible by any of the bases, at step 260 its value is approximated to the closest extreme in the predefined window by performing an addition of the form k=k di where diEDNO} (see (2)), For this approximation to guarantee a successive execution of at least (wi + W2 Wi) operations of the form afQ in posterior executions, the window is delimited by the two closest integers to the partial scalar value that are multiples of the global base.
Then, the corresponding digit is set to the nonzero value di in step 270.
At step 280, it is performed again the test of divisibility as was described previously.
The base selected is associated to the nonzero digit from step 270. Note that, although the test of divisibility has a predetermined order, the set of bases is efficiently specified by according to the characteristics of the particular setting.
Finally, the scalar value is updated by dividing it by the selected base in step 290. It is then determined at step 220 if the scalar is equivalent to zero or one of the values of the precomputed table.
By way of example only, and to illustrate the way methods of Figures 1 and 2 work during a scalar multiplication execution, two kinds of parameter selections are distinguished that are efficient for different settings, and explain their particular characteristics through examples.
Multibase Non-Adjacent Form (mbNAF) In the first case, it is assumed that a given application has very constrained memory resources. Thus, the use of precomputations should be minimized. For the disclosed multibase representation, the latter can be achieved by imposing the following additional restrictions to exponents c1(j) in (1):
If SSCA is not required, NO at step 104, at step 108 the values of the precomputed table are calculated. Specifically, in the case of multibase representation, the table consists of all the points of the form d,P, where diED \{0} (see (2)).
At step 110, the procedure depicted by Figure 2 is executed to determine the multibase representation of the scalar value. Then, the value of the scalar multiplication is computed by scanning the obtained multibase representation digit by digit. Per digit scanned, a step 112, one operation of the form aiQ is executed, where a, is the specific base associated to the current digit at step 114.
If the digit scanned is nonzero, YES at step 116, then one addition of the form Q d,P is performed at step 118, where Q is the current value of the scalar multiplication and d,P is a point from the precomputed table. Note that the value d, corresponds to the value of the scanned digit. Although, the precomputed table only contains positive values, it has been stated previously that computing inverses of points (in this case, ¨d,P) is inexpensive and can be calculated on-the-fly.
If the scanning is complete, YES at step 120, all the digits in the multibase representation has been scanned, and the result of the scalar multiplication is provided at step 122.
In the following, a method is described that determines short multibase representations of scalar values.
Referring to figure 2, short multibase representations of the scalar value are determined. Inputs of the scalar value are provided at step 210, and then at step 220 begins the execution while the initial or partial value of the scalar is different from zero and any value of the precomputed table. Once it reaches zero, YES at step 220, the method ends and gives the multibase representation of the input scalar at step 230.
At each iteration, and while the partial value of the scalar is other than zero, NO at step 220, it is determined at step 240 if the scalar is divisible by one of the bases.
For a given set of bases A = {a1,...,a4, the test of divisibility begins with j = 1 and stops when j = .1 or if a base divides the scalar value. If one of the bases is successfully selected, YES at step 240, then a zero digit is set at step 250 together with its corresponding base, and the scalar value is updated by dividing it by the base in step 290.
If, otherwise, NO at step 240, the scalar is not divisible by any of the bases, at step 260 its value is approximated to the closest extreme in the predefined window by performing an addition of the form k=k di where diEDNO} (see (2)), For this approximation to guarantee a successive execution of at least (wi + W2 Wi) operations of the form afQ in posterior executions, the window is delimited by the two closest integers to the partial scalar value that are multiples of the global base.
Then, the corresponding digit is set to the nonzero value di in step 270.
At step 280, it is performed again the test of divisibility as was described previously.
The base selected is associated to the nonzero digit from step 270. Note that, although the test of divisibility has a predetermined order, the set of bases is efficiently specified by according to the characteristics of the particular setting.
Finally, the scalar value is updated by dividing it by the selected base in step 290. It is then determined at step 220 if the scalar is equivalent to zero or one of the values of the precomputed table.
By way of example only, and to illustrate the way methods of Figures 1 and 2 work during a scalar multiplication execution, two kinds of parameter selections are distinguished that are efficient for different settings, and explain their particular characteristics through examples.
Multibase Non-Adjacent Form (mbNAF) In the first case, it is assumed that a given application has very constrained memory resources. Thus, the use of precomputations should be minimized. For the disclosed multibase representation, the latter can be achieved by imposing the following additional restrictions to exponents c1(j) in (1):
- 11 ¨
CO are decreasing exponents, such that C1(/) C2(j) . . . Cm(i) 0 for each j from 2 to .1, and ci(1) are decreasing exponents for the main base al (i.e., j = 1), such that 41) c1+1(1)+2 2 , for m-1.
Assuming the previous extra conditions implies that n = {2,0,...,0}, where only the first base al (which is referred to as main base) has nonzero window value, and consequently, the global base becomes a = a?a9 = a?. From (2), it can be seen that these parameters reduces the digit set to:
(3) which minimizes the required number of precomputations to only (al - 2)(a1 +1) precomputed points2 without considering {0,P).
Consider the computation of 3750P, where k = 3750 is the selected scalar and P
is a point on a generic elliptic curve over a prime field. First, we select the set of bases A = {2,3} and windows SI = {2,0} as per step 102, Figure 1. Note that al= 2 and a2 =3 are selected as bases because point doubling (2Q) and tripling (3Q) are relatively efficient in the chosen curve form. In particular, doubling is the most efficient operation and hence selected as main base.
Assuming that SSCA protection is not required, in step 108 the precomputed table d iP is built. In this case, di E D+ \ {0} = {1} (see (3)), so that it is only required to store nil non-trivial points and the trivial points {0,P}.
Then, the multibase representation is determined as per Figure 2. In the example, the procedure to find the representation follows the next sequence which sets the following digit-wise representation using digits from D (see (3)) (2,3)NAF2(3750) = 1(2) 0(3) 0(2)1(2) 0(3) 0(2) 0(2) 0(2) 1(2) 0(3) 0(2) , where the superscript (a;) represents the base associated with a given digit.
Note that the notation (a1,a2)NAFõi (k) is used to represent the mbNAF
representation of k using bases A = {a1,a2} and windows wi *0 and 14/2 = 0 .
In a scalar multiplication the execution consists of scanning the multibase representation from left to right, and performing a doubling if the digit is 0(2) , a tripling if it is 0(3) , and a doubling or tripling followed by an addition if it is 1(2) or respectively, as described previously for steps 112-122, Figure 1. The correctness of the procedure can be verified by checking that the previous execution is equivalent to the following using Homer's method, where the execution begins in the most inner parentheses 3750P = 2 x3(24x3(22x3P+P)+P) According to the example above, the scalar multiplication 3750P costs 7D + 3T
+
2A, which translates to a cost of 107.2M if IS = 0.8M. The cost of doubling (D) is 3 multiplications (M) and 5 squarings (S), the cost of tripling (T) is 7M+7S and the cost of addition is 7M+4S. In contrast a traditional NAF method would cost 12D + 5A
=
135M, which is significantly more expensive in terms of computational effort.
Window-w Multibase Non-Adjacent Form (wmbNAF) In another scenario, assume that the application has additional memory resources that can be exploited to store precomputations and, thus, speed up the execution of the multibase scalar multiplication. This variation is referred as Window-w Multibase NAF (or simply wmbNAF).
The proposed multibase representation is achieved by imposing the following additional restrictions to exponents c1(j) in (1):
ci(j) are decreasing exponents, such that ci(j)_ C2(/) Cm(i) ?_ 0 for each j from 2 to J, and c1(1) are decreasing exponents for the main base al (i.e., j = 1), such that c1(1) ciA(1)+w1 , for m-1, where Iv, > 2 Ã Z+
CO are decreasing exponents, such that C1(/) C2(j) . . . Cm(i) 0 for each j from 2 to .1, and ci(1) are decreasing exponents for the main base al (i.e., j = 1), such that 41) c1+1(1)+2 2 , for m-1.
Assuming the previous extra conditions implies that n = {2,0,...,0}, where only the first base al (which is referred to as main base) has nonzero window value, and consequently, the global base becomes a = a?a9 = a?. From (2), it can be seen that these parameters reduces the digit set to:
(3) which minimizes the required number of precomputations to only (al - 2)(a1 +1) precomputed points2 without considering {0,P).
Consider the computation of 3750P, where k = 3750 is the selected scalar and P
is a point on a generic elliptic curve over a prime field. First, we select the set of bases A = {2,3} and windows SI = {2,0} as per step 102, Figure 1. Note that al= 2 and a2 =3 are selected as bases because point doubling (2Q) and tripling (3Q) are relatively efficient in the chosen curve form. In particular, doubling is the most efficient operation and hence selected as main base.
Assuming that SSCA protection is not required, in step 108 the precomputed table d iP is built. In this case, di E D+ \ {0} = {1} (see (3)), so that it is only required to store nil non-trivial points and the trivial points {0,P}.
Then, the multibase representation is determined as per Figure 2. In the example, the procedure to find the representation follows the next sequence which sets the following digit-wise representation using digits from D (see (3)) (2,3)NAF2(3750) = 1(2) 0(3) 0(2)1(2) 0(3) 0(2) 0(2) 0(2) 1(2) 0(3) 0(2) , where the superscript (a;) represents the base associated with a given digit.
Note that the notation (a1,a2)NAFõi (k) is used to represent the mbNAF
representation of k using bases A = {a1,a2} and windows wi *0 and 14/2 = 0 .
In a scalar multiplication the execution consists of scanning the multibase representation from left to right, and performing a doubling if the digit is 0(2) , a tripling if it is 0(3) , and a doubling or tripling followed by an addition if it is 1(2) or respectively, as described previously for steps 112-122, Figure 1. The correctness of the procedure can be verified by checking that the previous execution is equivalent to the following using Homer's method, where the execution begins in the most inner parentheses 3750P = 2 x3(24x3(22x3P+P)+P) According to the example above, the scalar multiplication 3750P costs 7D + 3T
+
2A, which translates to a cost of 107.2M if IS = 0.8M. The cost of doubling (D) is 3 multiplications (M) and 5 squarings (S), the cost of tripling (T) is 7M+7S and the cost of addition is 7M+4S. In contrast a traditional NAF method would cost 12D + 5A
=
135M, which is significantly more expensive in terms of computational effort.
Window-w Multibase Non-Adjacent Form (wmbNAF) In another scenario, assume that the application has additional memory resources that can be exploited to store precomputations and, thus, speed up the execution of the multibase scalar multiplication. This variation is referred as Window-w Multibase NAF (or simply wmbNAF).
The proposed multibase representation is achieved by imposing the following additional restrictions to exponents c1(j) in (1):
ci(j) are decreasing exponents, such that ci(j)_ C2(/) Cm(i) ?_ 0 for each j from 2 to J, and c1(1) are decreasing exponents for the main base al (i.e., j = 1), such that c1(1) ciA(1)+w1 , for m-1, where Iv, > 2 Ã Z+
Assuming the previous extra conditions implies that n = wõo,...,ol, where only the first base al (which is referred to as main base) has nonzero window value, and consequently, the global base becomes a =
a9 = a. From (2), it can be seen that these parameters reduces the digit set to:
(4) which requires to precompute a table with I I
points without considering {0,P). Although this parameter selection does not minimize the number of precomputations, it will enable further reductions in the number of nonzero terms appearing in the multibase representation. This makes the computation even faster.
Consider again the computation of 3750P on a generic elliptic curve over a prime field. First, the set of bases A = {2,3} and windows = {5,0} were selected as per step 102, Figure 1.
Assuming that SSCA protection is not required, in step 108 the precomputed table diP is built. In this case, di E D+ {0) = {1,3,5,...,15} (see(4)), so that it is required to store 7 non-trivial points and the trivial points {0,P).
Then, the multibase representation is determined as per Figure 2. In the example, the procedure to find the representation follows the next sequence which sets the following digit-wise representation using digits from D (see (4)) (2,3)NAF5(3750) = 5(2) 02) 0(2) 02) 0(2) 02) 0(2)_15(2) 03) (2), -14¨
where again the superscript (a') represents the base associated with a given digit.
The notation (a, ,a2)NAFõ,, (k) is used to represent the wmbNAF representation of k using bases A = { a, , a2} and windows vti >2 and 14)2 = 0 .
As previously described, following procedure for steps 112-122, Figure 1, the execution of the scalar multiplication would be performed by scanning digits from left to right, and performing a doubling if the digit is 0(2), a tripling if it is 0(3) , and a doubling or tripling followed by an addition if it is d:2) or - dio) , respectively, where E D+ {0}= {1, 3, 5, ... ,15) . This procedure is equivalent to the following using Homer's method 3750P = 2x 3(27 x 5P-15P).
According to the example above, the scalar multiplication 3750P costs 80 + IT
+ 1A
= 78.8M, if 1S = 0.8M. Compare this cost to the traditional wNAF method with window w = 5: 12D + 2A = 104.4M, which is significantly more expensive in terms of computational effort although requires the same amount of memory.
Figure 3 presents a methodology for the case where protection against SSCA
needs to be implemented. The procedure is described in the following.
According to the particular application, if it is determined that protection is to be implemented, at step 310 it is determined if ECC point operations such as doubling, tripling or addition are to be implemented either by distinguishing field squarings from multiplications or by assuming that these operations are equivalent. The decision mainly depends on the chosen platform. In general terms, in software implementations, squarings are usually faster and distinguishable from multiplications. To have strong protection against SSCA, then an adequate approach should involve atomic blocks that include squarings.
If squarings are to be distinguished from multiplications, YES at step 310, at step 320 the number of field multiplications and squarings found in an ECC point operation are determined.
a9 = a. From (2), it can be seen that these parameters reduces the digit set to:
(4) which requires to precompute a table with I I
points without considering {0,P). Although this parameter selection does not minimize the number of precomputations, it will enable further reductions in the number of nonzero terms appearing in the multibase representation. This makes the computation even faster.
Consider again the computation of 3750P on a generic elliptic curve over a prime field. First, the set of bases A = {2,3} and windows = {5,0} were selected as per step 102, Figure 1.
Assuming that SSCA protection is not required, in step 108 the precomputed table diP is built. In this case, di E D+ {0) = {1,3,5,...,15} (see(4)), so that it is required to store 7 non-trivial points and the trivial points {0,P).
Then, the multibase representation is determined as per Figure 2. In the example, the procedure to find the representation follows the next sequence which sets the following digit-wise representation using digits from D (see (4)) (2,3)NAF5(3750) = 5(2) 02) 0(2) 02) 0(2) 02) 0(2)_15(2) 03) (2), -14¨
where again the superscript (a') represents the base associated with a given digit.
The notation (a, ,a2)NAFõ,, (k) is used to represent the wmbNAF representation of k using bases A = { a, , a2} and windows vti >2 and 14)2 = 0 .
As previously described, following procedure for steps 112-122, Figure 1, the execution of the scalar multiplication would be performed by scanning digits from left to right, and performing a doubling if the digit is 0(2), a tripling if it is 0(3) , and a doubling or tripling followed by an addition if it is d:2) or - dio) , respectively, where E D+ {0}= {1, 3, 5, ... ,15) . This procedure is equivalent to the following using Homer's method 3750P = 2x 3(27 x 5P-15P).
According to the example above, the scalar multiplication 3750P costs 80 + IT
+ 1A
= 78.8M, if 1S = 0.8M. Compare this cost to the traditional wNAF method with window w = 5: 12D + 2A = 104.4M, which is significantly more expensive in terms of computational effort although requires the same amount of memory.
Figure 3 presents a methodology for the case where protection against SSCA
needs to be implemented. The procedure is described in the following.
According to the particular application, if it is determined that protection is to be implemented, at step 310 it is determined if ECC point operations such as doubling, tripling or addition are to be implemented either by distinguishing field squarings from multiplications or by assuming that these operations are equivalent. The decision mainly depends on the chosen platform. In general terms, in software implementations, squarings are usually faster and distinguishable from multiplications. To have strong protection against SSCA, then an adequate approach should involve atomic blocks that include squarings.
If squarings are to be distinguished from multiplications, YES at step 310, at step 320 the number of field multiplications and squarings found in an ECC point operation are determined.
-15¨
At step 330, a balanced number of field multiplications and squarings should be determined in such a way that the minimum number of atomic blocks is required for the given ECC point operation. Such decisions should take into consideration the atomic structure to be used (and also considering that the same atomic structure should be applied to all the available ECC point operations). For instance, the following atomic structures: S-N-A-M-N-A-A (sq uaring-negation-addition-multiplication-negation-addition-addition) or S-N-A-A-M-N-A-A (squaring-negation-addition-addition-multiplication-negation-addition-addition) may be utilized.
Note that squaring is included into the atomic structure, which not only speeds up computations since squaring is usually faster than multiplication, but also protects against potential attacks that are able of distinguishing multiplication from squaring.
At this step, the method detailed in Figure 4 and disclosed in U.S. patent publication no. US20090074178 filed September 14, 2007 can be used to achieve the balanced number of multiplications and squarings. Thus, multiplications are traded by 1, 2 or more squarings according to the given ECC point operation.
Now referring to Figure 4, at step 410, the method involves first identifying field multiplications a.b that can be replaced by 1, 2 or 3 squarings as given by:
ab = ¨1[(a +02 ¨ a2 ¨b2] (5) Determining which multiplications fall in this category if using (5) mainly depends on whether values a2, b2 or both pre-exist in the ECC point operation. For instance, in sequential implementations replacing one multiplication by one squaring is of benefit since the former is generally more time consuming than the latter. However, if 2 or 3 squarings replace one multiplication, then the execution becomes slower.
Hence, in this setting both a2 and b2 should pre-exist in the ECC point operation to make practical the aforementioned substitution and essentially trade a.b for (a +
b)2.
At step 420, it is determined if some of the multiplications to be traded are not even (i.e., do not contain a multiple of 2 in their execution). If at least one of the multiplications is not even at decision step 430, the current point representation is replaced by an equivalent one that inserts the necessary multiple of 2 into the odd multiplication(s). The equivalent point is taken from the equivalence class for projective coordinates given by:
(X: Y :Z). {(2` X ,AdY,A2): E K* ,c,d , where X, = 2t, t E .
Once multiplications to be traded are even, at step 450 they are replaced by applying the following algebraic substitutions, which hold for prime fields:
2ab = (a + b)2 ¨a2 ¨b2 (6) For instance, for the point addition in generic elliptic curves traditionally containing 8 multiplications and 3 squarings:
X3= a 2 ¨fl3 ¨2XJ32 , Y3= a (X062 ¨X3)¨Y," , Z3 = Z, 13 , where: a = Zi3Y2¨Y, , p=z12x2-x1, it is possible to achieve a balanced number of multiplications and squarings by following the method described previously, which yields the following:
X3 = a2 ¨4133 ¨20 , 1'3= a (0 ¨ X3)-8Y,I33 , Z3 =(z, + - p2 , where: a =
, 13 = X2¨ X, , 0 = (X, +132)2 ¨(X1¨ 132)2 . This formula costs 6 multiplications and 6 squarings.
In the previous example, the new point representation (4X3,8Y3,2Z3) , equivalent to (X3, Y3,Z3) , uses multiples of 2 and makes possible substitutions of the form 2ab = (a + ¨a2 ¨b2 for Z3 and 0, respectively.
Balancing and fixing the computing cost to 6 multiplications and 6 squarings makes the point addition require only 6 S-N-A-M-N-A-A atomic blocks in contrast to the original 11 M-A-N-A atomic blocks, which represents a significant reduction in execution time.
Returning to Figure 3, if NO at step 310, squarings are presumed not to be distinguishable from multiplications, as can be the case of hardware platforms where usually a multiplier executes both kinds of operations, then an approach assuming that squarings and multiplications are equivalent is more flexible and faster.
Following the latter, at step 350, the number of field multiplications (including squarings) should be determined in such a way that the minimum number of field operations is required for the given ECC point operation. Such determination takes into consideration the atomic structure to be used (and also considering that the same atomic structure is to be applied to all the required ECC point operations). For instance, the following new atomic structure: M-N-A-M-N-A-A (multiplication-negation-addition-multiplication-negation-addition-addition) may be utilized.
Note that the previous structure permits to reduce the number of required additions when compared to the traditional M-A-N-A structure, so it would be particularly attractive for applications where the cost ratio field addition/multiplication is relatively high. For instance, the traditional doubling formula on generic curves over prime fields costs 4 multiplications and 4 squarings. Protecting it using M-A-N-A would require 8 blocks and a total cost of 8 multiplications and 16 additions. In contrast, by using M-N-A-M-N-A-A, the implementation of doubling reduces to only 4 blocks with a total cost of 8 multiplications and 12 additions.
In Figure 5, a computing environment 500 is provided in which an elliptic curve cryptosystem may be implemented as computer software in the form of computer readable code executed. The computing environment may be any number of computing or computer based platforms such as mobile devices, personal computer, notebook computers, personal digital assistants, networking devices such as routers, or be resident in application specific processors devices such as smart cards, security cards or radio frequency identification (RFID) devices requiring security implementations.
The computer 502 comprises central processing unit (CPU) 504 and memory 506.
The CPU may be a single processor or multiprocessor system. In addition a -18¨
multiprocessor implementation of the elliptic curve cryptosystem may utilize more than one computing environment for execution of a parallel architecture. In various computing environments, main memory 506 and storage 512 can reside wholly on computer environment 500, or they may be distributed between multiple computers.
Input devices 510 such as a keyboard and mouse may be coupled to a bi-directional system bus of a computer 502. The keyboard and mouse are for introducing user input to a computer 502 and communicating that user input to processor 504 if required. Computer 502 may also include a communication interface 514.
Communication interface 514 provides a two-way data communication coupling via a network link to a network 516 by wired or wireless connection or may provide an interface to other host device 518 by a direct radio frequency connection. In any such implementation, communication interface 514 sends and receives electrical, electromagnetic or optical signals which carry digital data streams representing various types of information.
Communication between the communication interface unit 514 and the network 516 or host 518 use electrical, electromagnetic or optical signals which carry digital data streams. The signals through the various networks and the signals on network link and through communication interface, which carry the digital data to and from computer, are exemplary forms of carrier waves transporting the information.
The computer 502 may also be able to display the results of the computation to a user in the form of output.
The computer processor 504 or similar device may be programmed in the manner of method steps, or may be executed by an electronic system which is provided with means for executing these steps. The storage device 512 provides a computer readable medium which may include both fixed and removable media, such as magnetic, optical or magnetic optical storage systems, Random Access Memory (RAM), Read Only Memory (ROM) or any other available mass storage technology.
The storage device or media may be programmed to execute such method steps.
As well, electronic signals representing these method steps may also be transmitted via a communication network.
At step 330, a balanced number of field multiplications and squarings should be determined in such a way that the minimum number of atomic blocks is required for the given ECC point operation. Such decisions should take into consideration the atomic structure to be used (and also considering that the same atomic structure should be applied to all the available ECC point operations). For instance, the following atomic structures: S-N-A-M-N-A-A (sq uaring-negation-addition-multiplication-negation-addition-addition) or S-N-A-A-M-N-A-A (squaring-negation-addition-addition-multiplication-negation-addition-addition) may be utilized.
Note that squaring is included into the atomic structure, which not only speeds up computations since squaring is usually faster than multiplication, but also protects against potential attacks that are able of distinguishing multiplication from squaring.
At this step, the method detailed in Figure 4 and disclosed in U.S. patent publication no. US20090074178 filed September 14, 2007 can be used to achieve the balanced number of multiplications and squarings. Thus, multiplications are traded by 1, 2 or more squarings according to the given ECC point operation.
Now referring to Figure 4, at step 410, the method involves first identifying field multiplications a.b that can be replaced by 1, 2 or 3 squarings as given by:
ab = ¨1[(a +02 ¨ a2 ¨b2] (5) Determining which multiplications fall in this category if using (5) mainly depends on whether values a2, b2 or both pre-exist in the ECC point operation. For instance, in sequential implementations replacing one multiplication by one squaring is of benefit since the former is generally more time consuming than the latter. However, if 2 or 3 squarings replace one multiplication, then the execution becomes slower.
Hence, in this setting both a2 and b2 should pre-exist in the ECC point operation to make practical the aforementioned substitution and essentially trade a.b for (a +
b)2.
At step 420, it is determined if some of the multiplications to be traded are not even (i.e., do not contain a multiple of 2 in their execution). If at least one of the multiplications is not even at decision step 430, the current point representation is replaced by an equivalent one that inserts the necessary multiple of 2 into the odd multiplication(s). The equivalent point is taken from the equivalence class for projective coordinates given by:
(X: Y :Z). {(2` X ,AdY,A2): E K* ,c,d , where X, = 2t, t E .
Once multiplications to be traded are even, at step 450 they are replaced by applying the following algebraic substitutions, which hold for prime fields:
2ab = (a + b)2 ¨a2 ¨b2 (6) For instance, for the point addition in generic elliptic curves traditionally containing 8 multiplications and 3 squarings:
X3= a 2 ¨fl3 ¨2XJ32 , Y3= a (X062 ¨X3)¨Y," , Z3 = Z, 13 , where: a = Zi3Y2¨Y, , p=z12x2-x1, it is possible to achieve a balanced number of multiplications and squarings by following the method described previously, which yields the following:
X3 = a2 ¨4133 ¨20 , 1'3= a (0 ¨ X3)-8Y,I33 , Z3 =(z, + - p2 , where: a =
, 13 = X2¨ X, , 0 = (X, +132)2 ¨(X1¨ 132)2 . This formula costs 6 multiplications and 6 squarings.
In the previous example, the new point representation (4X3,8Y3,2Z3) , equivalent to (X3, Y3,Z3) , uses multiples of 2 and makes possible substitutions of the form 2ab = (a + ¨a2 ¨b2 for Z3 and 0, respectively.
Balancing and fixing the computing cost to 6 multiplications and 6 squarings makes the point addition require only 6 S-N-A-M-N-A-A atomic blocks in contrast to the original 11 M-A-N-A atomic blocks, which represents a significant reduction in execution time.
Returning to Figure 3, if NO at step 310, squarings are presumed not to be distinguishable from multiplications, as can be the case of hardware platforms where usually a multiplier executes both kinds of operations, then an approach assuming that squarings and multiplications are equivalent is more flexible and faster.
Following the latter, at step 350, the number of field multiplications (including squarings) should be determined in such a way that the minimum number of field operations is required for the given ECC point operation. Such determination takes into consideration the atomic structure to be used (and also considering that the same atomic structure is to be applied to all the required ECC point operations). For instance, the following new atomic structure: M-N-A-M-N-A-A (multiplication-negation-addition-multiplication-negation-addition-addition) may be utilized.
Note that the previous structure permits to reduce the number of required additions when compared to the traditional M-A-N-A structure, so it would be particularly attractive for applications where the cost ratio field addition/multiplication is relatively high. For instance, the traditional doubling formula on generic curves over prime fields costs 4 multiplications and 4 squarings. Protecting it using M-A-N-A would require 8 blocks and a total cost of 8 multiplications and 16 additions. In contrast, by using M-N-A-M-N-A-A, the implementation of doubling reduces to only 4 blocks with a total cost of 8 multiplications and 12 additions.
In Figure 5, a computing environment 500 is provided in which an elliptic curve cryptosystem may be implemented as computer software in the form of computer readable code executed. The computing environment may be any number of computing or computer based platforms such as mobile devices, personal computer, notebook computers, personal digital assistants, networking devices such as routers, or be resident in application specific processors devices such as smart cards, security cards or radio frequency identification (RFID) devices requiring security implementations.
The computer 502 comprises central processing unit (CPU) 504 and memory 506.
The CPU may be a single processor or multiprocessor system. In addition a -18¨
multiprocessor implementation of the elliptic curve cryptosystem may utilize more than one computing environment for execution of a parallel architecture. In various computing environments, main memory 506 and storage 512 can reside wholly on computer environment 500, or they may be distributed between multiple computers.
Input devices 510 such as a keyboard and mouse may be coupled to a bi-directional system bus of a computer 502. The keyboard and mouse are for introducing user input to a computer 502 and communicating that user input to processor 504 if required. Computer 502 may also include a communication interface 514.
Communication interface 514 provides a two-way data communication coupling via a network link to a network 516 by wired or wireless connection or may provide an interface to other host device 518 by a direct radio frequency connection. In any such implementation, communication interface 514 sends and receives electrical, electromagnetic or optical signals which carry digital data streams representing various types of information.
Communication between the communication interface unit 514 and the network 516 or host 518 use electrical, electromagnetic or optical signals which carry digital data streams. The signals through the various networks and the signals on network link and through communication interface, which carry the digital data to and from computer, are exemplary forms of carrier waves transporting the information.
The computer 502 may also be able to display the results of the computation to a user in the form of output.
The computer processor 504 or similar device may be programmed in the manner of method steps, or may be executed by an electronic system which is provided with means for executing these steps. The storage device 512 provides a computer readable medium which may include both fixed and removable media, such as magnetic, optical or magnetic optical storage systems, Random Access Memory (RAM), Read Only Memory (ROM) or any other available mass storage technology.
The storage device or media may be programmed to execute such method steps.
As well, electronic signals representing these method steps may also be transmitted via a communication network.
-19¨
Application code may be embodied in any form of computer program product. A
computer program product comprises a medium or memory configured to store or transport computer readable code, or in which computer readable code may be embedded. Some examples of computer program products are CD-ROM disks, ROM cards, floppy disks, magnetic tapes, computer hard drives, and servers on a network.
The method steps of the present disclosure may be embodied in sets of executable machine code stored in a variety of formats such as object code or source code.
Such code is described generically herein as programming code, or a computer program for simplification. Clearly, the executable machine code or portions of the code may be integrated with the code of other programs, implemented as subroutines, plug-ins, add-ons, software agents, by external program calls, in firmware or by other techniques as known in the art. The scope of the claims should not be limited by the preferred embodiments set forth in the examples, but should be given the broadest interpretation consistent with the description as a whole.
Application code may be embodied in any form of computer program product. A
computer program product comprises a medium or memory configured to store or transport computer readable code, or in which computer readable code may be embedded. Some examples of computer program products are CD-ROM disks, ROM cards, floppy disks, magnetic tapes, computer hard drives, and servers on a network.
The method steps of the present disclosure may be embodied in sets of executable machine code stored in a variety of formats such as object code or source code.
Such code is described generically herein as programming code, or a computer program for simplification. Clearly, the executable machine code or portions of the code may be integrated with the code of other programs, implemented as subroutines, plug-ins, add-ons, software agents, by external program calls, in firmware or by other techniques as known in the art. The scope of the claims should not be limited by the preferred embodiments set forth in the examples, but should be given the broadest interpretation consistent with the description as a whole.
Claims (20)
1. A method of accelerating scalar multiplication in an elliptic curve-based cryptosystem by representing a scalar value k with a multibase representation, the method executed in a processor comprising the steps of:
a) selecting a set of bases and corresponding set of window values for performing an ECC scalar multiplication;
b) calculating precomputed values according to selected bases and window values wherein the precomputed values are points of a form d i P , where d i~D+ \{0} and P is a point on a elliptic curve for which a ECC
scalar multiplication kP is computed;
c) determining a multibase representation of the scalar value; and d) scanning digits of the multibase representation from left to right until all the digits of the multibase representation are exhausted, performing a point operation of a form .alpha.i Q for every scanned digit with associated base .alpha. j ~ A , and performing an additional point addition of a form Q = Q ~ d i P if a digit has nonzero value d i , where d i P is a point of the precomputed values and Q is a partial result of the scalar multiplication.
a) selecting a set of bases and corresponding set of window values for performing an ECC scalar multiplication;
b) calculating precomputed values according to selected bases and window values wherein the precomputed values are points of a form d i P , where d i~D+ \{0} and P is a point on a elliptic curve for which a ECC
scalar multiplication kP is computed;
c) determining a multibase representation of the scalar value; and d) scanning digits of the multibase representation from left to right until all the digits of the multibase representation are exhausted, performing a point operation of a form .alpha.i Q for every scanned digit with associated base .alpha. j ~ A , and performing an additional point addition of a form Q = Q ~ d i P if a digit has nonzero value d i , where d i P is a point of the precomputed values and Q is a partial result of the scalar multiplication.
2. The method of claim 1 wherein the multibase representation is of a form:
where: positive prime integers .alpha.1 .noteq. a2 .noteq.
....noteq..alpha.J are selected bases determining a set A ={.alpha.1,...,.alpha.J}, global base is set using a selected window set .OMEGA. =
{W1,W,...,W J}, where W j >= 0 for 1 <= j <= J , s i are signed digits from a set D\{0}, s.t. ¦s i¦>=1 and s i ~ D\{0} , where the digit set is given by:
c i(j) are decreasing exponents, s.t. c i(j)>=c i+1(j)+w j >=w j for 1<=i<=m-1 and each 1 <=j<= J, and m is a length of the expansion.
where: positive prime integers .alpha.1 .noteq. a2 .noteq.
....noteq..alpha.J are selected bases determining a set A ={.alpha.1,...,.alpha.J}, global base is set using a selected window set .OMEGA. =
{W1,W,...,W J}, where W j >= 0 for 1 <= j <= J , s i are signed digits from a set D\{0}, s.t. ¦s i¦>=1 and s i ~ D\{0} , where the digit set is given by:
c i(j) are decreasing exponents, s.t. c i(j)>=c i+1(j)+w j >=w j for 1<=i<=m-1 and each 1 <=j<= J, and m is a length of the expansion.
3. The method of claim 2 wherein the step of c) determining a multibase representation further comprising:
e) receiving the scalar value together with the selected set of bases A
and windows .OMEGA.;
f) setting a zero digit with its associated base if any of the bases divides the scalar value, and updating the value of the scalar by dividing it by the selected base;
g) if the scalar value is not divisible by any of the bases, approximating the scalar value k to the closest extreme in the window by performing an addition of a form k = k ~ d i where d i~D+\{0} wherein the window is delimited by two closest integers to the partial scalar value that are multiples of the global base and the corresponding digit is set to the nonzero value ~ d i; and h) determining the base that divides the updated value of the scalar, associating the base to the nonzero digit from the c), and updating the value of the scalar by dividing it by the selected base.
e) receiving the scalar value together with the selected set of bases A
and windows .OMEGA.;
f) setting a zero digit with its associated base if any of the bases divides the scalar value, and updating the value of the scalar by dividing it by the selected base;
g) if the scalar value is not divisible by any of the bases, approximating the scalar value k to the closest extreme in the window by performing an addition of a form k = k ~ d i where d i~D+\{0} wherein the window is delimited by two closest integers to the partial scalar value that are multiples of the global base and the corresponding digit is set to the nonzero value ~ d i; and h) determining the base that divides the updated value of the scalar, associating the base to the nonzero digit from the c), and updating the value of the scalar by dividing it by the selected base.
4. The method of claim 2 wherein prior to b) calculating the precomputed value, the method further comprising:
i) determining a number of multiplication operations and squaring operations in an ECC point operation; and j) balance the number of multiplication operations and squaring operations within the ECC point operation.
i) determining a number of multiplication operations and squaring operations in an ECC point operation; and j) balance the number of multiplication operations and squaring operations within the ECC point operation.
5. The method of claim 4 further, wherein at step j), the method further comprising:
k) identifying multiplication operations within the ECC point operation that can be replaced with squarings and other cheaper field operations to balance a number of field multiplications and squarings;
I) determining if identified multiplication operations in the ECC point operation are even or odd multiplications;
m) modifying the ECC point operation if the multiplication operations are odd, with an equivalent point representation utilizing multiples of two;
and n) performing algebraic substitutions of the multiplication operations with squaring operations and other cheaper field operations such as addition, subtraction and multiplication or division by a small constant.
k) identifying multiplication operations within the ECC point operation that can be replaced with squarings and other cheaper field operations to balance a number of field multiplications and squarings;
I) determining if identified multiplication operations in the ECC point operation are even or odd multiplications;
m) modifying the ECC point operation if the multiplication operations are odd, with an equivalent point representation utilizing multiples of two;
and n) performing algebraic substitutions of the multiplication operations with squaring operations and other cheaper field operations such as addition, subtraction and multiplication or division by a small constant.
6. The method of claim 4 wherein at step i) the ECC point operation is modified using an equivalence class for projective coordinates:
(X :Y :Z)={(.lambda.c X ,.lambda.d Y,.lambda.Z):.lambda.~ K*,c,d ~Z+}, where (X :Y :Z) represents a projective representation of an ECC point P =
(x,y) = (X I Z c ,Y I Z d ), c and d are the weights of the projective representation being used, and .lambda. = 2t, such that c, d and t are in Z+, a set of positive integers, in order to insert multiples of 2.
(X :Y :Z)={(.lambda.c X ,.lambda.d Y,.lambda.Z):.lambda.~ K*,c,d ~Z+}, where (X :Y :Z) represents a projective representation of an ECC point P =
(x,y) = (X I Z c ,Y I Z d ), c and d are the weights of the projective representation being used, and .lambda. = 2t, such that c, d and t are in Z+, a set of positive integers, in order to insert multiples of 2.
7. The method of claim 4 further comprising:
o) defining an atomic structure for execution of the ECC point operations wherein the atomic structure is defined to be resistant to simple side channel attacks (SSCA) by levelling power dissipation, electromagnetic emission or any other information leakage by processor.
o) defining an atomic structure for execution of the ECC point operations wherein the atomic structure is defined to be resistant to simple side channel attacks (SSCA) by levelling power dissipation, electromagnetic emission or any other information leakage by processor.
8. The method of claim 7 wherein the atomic structures to protect against SSCA are defined by performing the operations of Squaring-Negation-Addition-Multiplication-Negation-Addition-Addition (S-N-A-M-N-A-A) or Squaring-Negation-Addition-Addition-Multiplication-Negation-Addition-Addition (S-N-A-A-M-N-A-A)
9 The method of claim 2 wherein prior to b) calculating the precomputed value, the method further comprising:
p) determining a number of multiplication operations in an ECC point operation, and q) defining an atomic structure for execution of the ECC point operations wherein the atomic structure is defined to be resistant to simple side channel attacks (SSCA) by levelling power dissipation, electromagnetic emission or any other information leakage by processor.
p) determining a number of multiplication operations in an ECC point operation, and q) defining an atomic structure for execution of the ECC point operations wherein the atomic structure is defined to be resistant to simple side channel attacks (SSCA) by levelling power dissipation, electromagnetic emission or any other information leakage by processor.
10. The method of claim 9 wherein the atomic structures to protect against SSCA are defined at step b) by performing the operations of Multiplication-Negation-Addition-Multiplication-Negation-Addition-Addition (M-N-A-M-N-A-A).
11 The method of claim 4 wherein the ECC point operations are on an elliptic curve defined by:
E: y2 = x3 + ax + b where: a,b ~ F p and .DELTA. = 4a3 + 27b2 .noteq. 0
E: y2 = x3 + ax + b where: a,b ~ F p and .DELTA. = 4a3 + 27b2 .noteq. 0
12. The method of claim 4 wherein the ECC point operations are on an elliptic curve defined by:
E: y2 + xy = x3 + ax2 + b, where: a,b ~ GF(2 m) and .DELTA. =b.noteqØ
E: y2 + xy = x3 + ax2 + b, where: a,b ~ GF(2 m) and .DELTA. =b.noteqØ
13. The method of claim 4 wherein the ECC point operations are on a Hessian or Jacobi curve form, including but not limiting to Jacobi-intersection and Jacobi-quartic forms.
14. The method of claim 4 wherein the ECC point operations are based upon elliptic curves with degree 2/3 isogenies.
15. The method of claim 4 wherein the ECC point operations are on an Edward curve form.
16. An apparatus for accelerating scalar multiplication in an elliptic curve-based cryptosystem by representing a scalar value k with a multibase representation, the apparatus comprising:
a memory;
a processor for performing the steps of:
selecting a set of bases and corresponding set of window values for performing an ECC scalar multiplication;
calculating precomputed values according to selected bases and window values wherein the precomputed values are points of a form d i P , where d i ~ D+ \ {0} and P is a point on a elliptic curve for which a ECC scalar multiplication kP is computed;
determining a multibase representation of the scalar value; and scanning digits of the multibase representation from left to right until all the digits of the multibase representation are exhausted, performing a point operation of a form a j Q for every scanned digit with associated base a j ~ A , and performing an additional point addition of a form Q = Q~ d i P if a digit has nonzero value d i, where d i P is a point of the precomputed values and Q is a partial result of the scalar multiplication.
a memory;
a processor for performing the steps of:
selecting a set of bases and corresponding set of window values for performing an ECC scalar multiplication;
calculating precomputed values according to selected bases and window values wherein the precomputed values are points of a form d i P , where d i ~ D+ \ {0} and P is a point on a elliptic curve for which a ECC scalar multiplication kP is computed;
determining a multibase representation of the scalar value; and scanning digits of the multibase representation from left to right until all the digits of the multibase representation are exhausted, performing a point operation of a form a j Q for every scanned digit with associated base a j ~ A , and performing an additional point addition of a form Q = Q~ d i P if a digit has nonzero value d i, where d i P is a point of the precomputed values and Q is a partial result of the scalar multiplication.
17. The apparatus of claim 16 wherein the multibase representation is of a form:
where: positive prime integers a1 .noteq. a2 .noteq. ... .noteq. a j are selected bases determining a set A ={a i, ..., a j}, global base a = a ~1 a~2 ...a~J is set using a selected window set .OMEGA.=
{w1, w2,...,w J}, where w j 0 >= for 1<= j <=J , s i are signed digits from a set D\{0}, s.t. ¦s i¦>= and s i ~ D\ {0} , where the digit set is given by:
c i(j) are decreasing exponents, s.t. c i(j)>=ci+1(j)+w j->= w j for 1<= i<= m -1 and each 1 <= j <= J, and m is a length of the expansion.
where: positive prime integers a1 .noteq. a2 .noteq. ... .noteq. a j are selected bases determining a set A ={a i, ..., a j}, global base a = a ~1 a~2 ...a~J is set using a selected window set .OMEGA.=
{w1, w2,...,w J}, where w j 0 >= for 1<= j <=J , s i are signed digits from a set D\{0}, s.t. ¦s i¦>= and s i ~ D\ {0} , where the digit set is given by:
c i(j) are decreasing exponents, s.t. c i(j)>=ci+1(j)+w j->= w j for 1<= i<= m -1 and each 1 <= j <= J, and m is a length of the expansion.
18. The apparatus of claim 16 wherein the apparatus is an radio frequency identification device (RFID) device.
19. A computer readable non-transitory memory containing instructions for accelerating scalar multiplication in an elliptic curve-based cryptosystem by representing a scalar value k with a multibase representation, the instructions which when executed by a processor perform the steps of:
selecting a set of bases and corresponding set of window values for performing an ECC scalar multiplication;
calculating precomputed values according to selected bases and window values wherein the precomputed values are points of a form cliP , where d i ~D+\{0} and P is a point on a elliptic curve for which a ECC
scalar multiplication kP is computed;
determining a multibase representation of the scalar value; and scanning digits of the multibase representation from left to right until all the digits of the multibase representation are exhausted, performing a point operation of a form.alpha. j ~ for every scanned digit with associated base .alpha. A , and performing an additional point addition of a form ~= ~ d i P if a digit has nonzero value ei where d i P is a point of the precomputed values and Q is a partial result of the scalar multiplication.
selecting a set of bases and corresponding set of window values for performing an ECC scalar multiplication;
calculating precomputed values according to selected bases and window values wherein the precomputed values are points of a form cliP , where d i ~D+\{0} and P is a point on a elliptic curve for which a ECC
scalar multiplication kP is computed;
determining a multibase representation of the scalar value; and scanning digits of the multibase representation from left to right until all the digits of the multibase representation are exhausted, performing a point operation of a form.alpha. j ~ for every scanned digit with associated base .alpha. A , and performing an additional point addition of a form ~= ~ d i P if a digit has nonzero value ei where d i P is a point of the precomputed values and Q is a partial result of the scalar multiplication.
20. The computer readable memory of claim 19 wherein the multibase representation is of a form:
where: positive prime integers .alpha. i .noteq. .alpha.2 .noteq. ... .alpha.
j a, are selected bases determining a set A ={.alpha.1,...,.alpha. j}, global base .alpha.= .alpha.1w1.alpha.2w2 ... .alpha. w j is set using a selected window set .OMEGA. =
{w1,w2,...,w j}, where w j >= 0 for 1 <= j <= J , s i are signed digits from a set D \ {0} , s.t. ¦si¦ >= 1 and si .epsilon. D \ {0} , where the digit set is given by:
c i(j) are decreasing exponents, s.t. c i (j) >= c i+1(j)+w j, >=
w j, for 1 <= i <= m11 and each 1 <= J <= j, and m is a length of the expansion.
where: positive prime integers .alpha. i .noteq. .alpha.2 .noteq. ... .alpha.
j a, are selected bases determining a set A ={.alpha.1,...,.alpha. j}, global base .alpha.= .alpha.1w1.alpha.2w2 ... .alpha. w j is set using a selected window set .OMEGA. =
{w1,w2,...,w j}, where w j >= 0 for 1 <= j <= J , s i are signed digits from a set D \ {0} , s.t. ¦si¦ >= 1 and si .epsilon. D \ {0} , where the digit set is given by:
c i(j) are decreasing exponents, s.t. c i (j) >= c i+1(j)+w j, >=
w j, for 1 <= i <= m11 and each 1 <= J <= j, and m is a length of the expansion.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CA 2631276 CA2631276C (en) | 2008-05-14 | 2008-05-14 | Exponentiation method using multibase number representation |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CA 2631276 CA2631276C (en) | 2008-05-14 | 2008-05-14 | Exponentiation method using multibase number representation |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CA2631276A1 CA2631276A1 (en) | 2009-11-14 |
| CA2631276C true CA2631276C (en) | 2014-12-09 |
Family
ID=41297200
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CA 2631276 Expired - Fee Related CA2631276C (en) | 2008-05-14 | 2008-05-14 | Exponentiation method using multibase number representation |
Country Status (1)
| Country | Link |
|---|---|
| CA (1) | CA2631276C (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR101817879B1 (en) * | 2016-11-18 | 2018-01-11 | 부산대학교 산학협력단 | Device and method for high-speed non-adjacent form conversion |
| CN111756538B (en) * | 2020-06-28 | 2023-10-13 | 哈尔滨理工大学 | Method and device for realizing ECC scalar multiplier based on prime preprocessing |
-
2008
- 2008-05-14 CA CA 2631276 patent/CA2631276C/en not_active Expired - Fee Related
Also Published As
| Publication number | Publication date |
|---|---|
| CA2631276A1 (en) | 2009-11-14 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US7991154B2 (en) | Exponentiation method using multibase number representation | |
| KR101154695B1 (en) | Encryption computing device | |
| US7991162B2 (en) | Accelerating scalar multiplication on elliptic curve cryptosystems over prime fields | |
| JP4752313B2 (en) | Cryptographic processing operation method, cryptographic processing apparatus, and computer program | |
| US8369517B2 (en) | Fast scalar multiplication for elliptic curve cryptosystems over prime fields | |
| US8374345B2 (en) | Data processing system and data processing method | |
| US20080025500A1 (en) | Cryptographic device having tamper resistance to power analysis attack | |
| Aranha et al. | Faster implementation of scalar multiplication on Koblitz curves | |
| US7139396B2 (en) | Koblitz exponentiation with bucketing | |
| JP4513752B2 (en) | Cryptographic processing apparatus, cryptographic processing method, and computer program | |
| KR101019242B1 (en) | Method for scalar multiplication using extended montgomery ladder | |
| WO2008106792A1 (en) | Methods and apparatus for performing an elliptic curve scalar multiplication operation using splitting | |
| JP2012239171A (en) | Modular exponentiation and device resistant against side-channel attacks | |
| US7680268B2 (en) | Elliptic curve point octupling using single instruction multiple data processing | |
| CA2631276C (en) | Exponentiation method using multibase number representation | |
| US7697683B2 (en) | Cryptography-processing method, cryptography-processing apparatus and computer program | |
| Walter | The Montgomery and Joye powering ladders are dual | |
| CA2602766C (en) | Accelerating scalar multiplication on elliptic curve cryptosystems over prime fields | |
| KR101423947B1 (en) | Modular multiplication and modular exponentiation using extended NIST prime | |
| Al-Somani et al. | High performance elliptic curve scalar multiplication with resistance against power analysis attacks | |
| JP2004053814A (en) | Elliptic curve cryptosystem device and elliptic curve cryptosystem operation method | |
| WO2006103851A1 (en) | Power value generation device | |
| JP2008020757A (en) | Encryption processing device, encryption processing computation method, and computer program |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| EEER | Examination request |
Effective date: 20130418 |
|
| MKLA | Lapsed |
Effective date: 20190514 |