EP1920323A1

EP1920323A1 - Method for scalarly multiplying points on an elliptic curve

Info

Publication number: EP1920323A1
Application number: EP06777699A
Authority: EP
Inventors: Bernd Meyer; Anton Kargl
Original assignee: Siemens AG
Current assignee: Siemens AG
Priority date: 2005-08-30
Filing date: 2006-07-11
Publication date: 2008-05-14
Also published as: WO2007025796A1; US20090136025A1; DE102005041102A1; CN101253473A

Abstract

The invention relates to a method for scalarly multiplying points on an elliptic curve by a finite expandable field K of a first field Fp of a p>3 characteristic, wherein said characteristic p has low Hamming weight and the expandable field has a polynom F(X) = Xd-2 of order d in the polynomial representation thereof.

Description

description

Method for scalar multiplication of points on an elliptic curve

The invention relates to a method for scalar multiplication of points on an elliptic curve, in particular of elliptic curves over a finite extension body K of a primary body F _p with a characteristic p> 3.

Cryptography distinguishes between symmetric and asymmetric methods. Symmetric methods use only one secret key, both for encryption and decryption. The key must be distributed to both communication parties via a secure channel. Asymmetric procedures use two keys, one public and one private. The public key can be distributed to all subscribers without jeopardizing the security of the data exchange. Key exchange is therefore less problematic in asymmetric methods than in symmetric methods. A disadvantage of the asymmetric methods is that they are about one hundred to one thousand times slower than comparable symmetrical methods.

Elliptic curves have been used since 1985 in asymmetric cryptography techniques. The main advantage of elliptic curve-based cryptography is that, compared to other methods, such as RSA, smaller keys can be used and still the same

Security level is achieved. A key length of 160 bits has the same security against attacks as a 1,024 bit key in the RSA method. For each bit of key, elliptic curve cryptography provides the highest security of all currently known methods. Elliptic curve cryptography is therefore particularly suitable for channels with a very limited bandwidth. The disadvantage, however, is that the encryption and decryption are calculated more complicated than other methods. For use in cryptographic methods, it is therefore important to make an optimal selection of the parameters of the cryptographic system.

Let K be a finite field of the characteristic p> 3 and a, be K. An elliptic curve over the field K is the set of zeros of the equation y ² = x ³ + ax + b with 4a ³ + 27b ² ≠ 0. Elliptic curves are under Inclusion of the infinite distant point as a neutral element additive groups. Let G c E be a subgroup with a prime order. Then every non-trivial point P e G is a generator of P. Thus, every point Q e G is the result of a scalar multiplication Q = sP, with se {0, ..., ord (P) -l}. If the scalar s is a positive integer, the scalar multiplication corresponds to the s-repeated addition of a point P to itself.

Scalar multiplication is currently a one-way mathematical function for curves with specific properties. It can be calculated in polynomial time, but in the current state of the art reversed only in exponential time. The inverse of scalar multiplication on elliptic curves is also referred to as discrete logarithm problem (ECDLP) and is the mathematical basis for elliptic curve based cryptosystems. The currently known methods for calculating discrete logarithms on cryptographically suitable elliptic curves have the complexity O (2 ° ' ⁵ⁿ ), where n is the binary length of the order of G c E. In order to meet the current safety requirements, it is recommended to select at least one bit length of n> 160.

The scalar multiplication of a point P is usually implemented by adding and doubling points of the elliptic curve. The calculation rule for addition and doubling consists of elementary operations on elements of the body K. For an effective implementation scalar multiplication requires optimized arithmetic in the body K.

The most important factor in choosing the underlying body K is the architecture of the available hardware platform. If a long-range arithmetic is available on the hardware platform and if coprocessors are integrated in the body K for the purpose of accelerating the arithmetic, K primers can be used for the body. Chip cards with coprocessor and long-number arithmetic z. B. elliptic curves with primes with bit lengths of 160 to 600 bits very effectively.

On the other hand, in hardware environments that do not have specialized comput- ers, such as embedded systems, with bus widths of only 8 or 16 bits and no coprocessor, long-range arithmetic must first be implemented using appropriate software commands. The cryptographic methods must thus be completely realized in software and are only difficult or can only be optimized with a great deal of experience.

The performance of such software solutions for scalar multiplication can be significantly increased if the hardware-provided optimization options, such as the SSE2 unit of a Pentium 4 processor or the simultaneous addition and multiplication of a signal processor, can be exploited.

As an alternative to the choice of a priming body, expansion bodies of a primer F _p can be selected for the body K. Using smaller primes p with binary lengths of only 20-30 bits and an irreducible polynomial of degree d, one can construct a smaller body F _p . The body elements of an expansion body are polynomials whose coefficients also originate from the body F _p , ie are polynomials. In this way, despite the smaller primes p can achieve a high effective number of bits, which then a sufficiently high security possible. The required polynomial arithmetic can thus be adapted to the bus width of the respective processor, so that the arithmetic operations provided in the respective processor can be used optimally and no long-number arithmetic is required. In polynomial arithmetic, as in the multiplication of two n-bit numbers, n ² multiplies are required. The advantage of polynomial arithmetic, however, is that the use of special algorithms reduces the total number of operations much more.

In order to get back into the body when multiplying two polynomials, whose result is a polynomial of maximum degree 2d - 2, the polynomial must be reduced. On the one hand, the coefficients of the polynomial are modulo p reduced in the finite field F _p , on the other hand, the polynomial itself modulo irreducible polynomial is reduced.

By skillful choice of the expansion body F _p can minimize the cost of both types of reduction. Optimum expansion bodies (OEF) via prime bodies F _p with a characteristic p> 3 and a polynomial representation with maximum degrees d - 1 are characterized by two essential properties:

1. The prime p is a pseudo-Mersenne prime in the form p = 2 ⁿ + c, where log (c) <n / 2. This property allows a rapid reduction in the body F _p .

2. There exists an irreducible polynomial F (X) = X ^d - we

F _P [X]. This property enables a fast reduction in the polynomial ring F _P [X], since the coefficients to be reduced can be reduced by multiplication and addition in F _p .

The optimal expansion bodies can be further type 1 or

Type 2 be:

Type 1: For the prime number p we have p = 2 ⁿ + 1, ie c = 1. Type 2: For the irreducible polynomial F (X) we have F (X) = X ^d - 2, ie w = 2.

It can be mathematically proved that an optimal extension body is either type 1 or type 2, but can not have both properties at the same time. The type 1 optimal extension body allows efficient arithmetic in the prime field F _p , while the type 2 optimal expansion field allows efficient reduction in the polynomial ring F _P [X]. In both cases, it can not be ruled out that during the reduction in F _p or in the polynomial ring F _P [X] multiplication with elements of the prime field F _p must be carried out.

If the body K is a prime particle F _p , the reduction of products from elements of the prime particle F _p can be accelerated by the choice of special prime numbers p. The number of operations required for a multiplication depends not only on the number of digits of the two factors, but rather on the Hamming weights of their representation. The Hamming weight of a number Z is understood as the number of set bits of Z. For example, the Hamming weight of 11101 is four. By a clever representation of numbers one can save arithmetic operations with a multiplication of two numbers: The number 63 has in binary form the representation 111111 with the Hamming weight 6. A multiplication with a power of 2 is achieved by pushing to the left, so that in this case a total of 5 times shift operations and 5 additions are required. However, the number 63 can also be represented as 2 ⁶ - 1. It has a Hamming weight of only 2 in this representation, so that a multiplication by 63 with a link shift by 6 bit positions and a subtraction can take place. In contrast, multiplication by the number 10 requires two shift operations and one addition, despite the smaller number of digits. The cost of multiplication thus depends heavily on their Hamming weight. In a list of recommended elliptic curves about Primitives of the National It is ensured that the prime number has a representation in the form p = 2 ⁿ + 2 ^m + 1 with the Hamming weight of 3, thus enabling an efficient reduction.

The irreducible polynomial X ^d - 2 has an optimal shape with respect to the reduction. It contains only two terms, X ^d and a constant, additive factor. This factor, 2, is also optimally chosen, since the coefficient has to be reduced by just shifting one bit to multiply it by 2. The prime in the representation p = 2 ⁿ + 1 is also optimal in terms of the reduction, since only one additive term to 2 ^{n is} present. Unfortunately, both types can not be combined, so choosing the expansion body always requires a balance of effort.

The coefficients a and b of an elliptic curve defined via an expansion body are generally polynomials. For a Koblitz curve, a and b are in the body and are polynomials of degree zero. The exponentiation of a point on the curve with p maps it back to the same curve due to the Frobenius homomorphism in the finite field. If a and b are polynomials, the point is mapped to another curve. The Frobenius

Endomorphism on the elliptic curve is in the endophormic ring, which means that in Koblitz curves one can represent all scalars with respect to the Frobenius endomorphism and thus obtain a very fast scalar multiplication algorithm.

The object of the present invention is therefore to specify an efficient realization of the scalar multiplication of points of an elliptic curve over a finite extension element with the characteristic p> 3 in software on a standard processor without additional coprocessors. The object is achieved by a method for scalar multiplication of points on an elliptic curve over a finite extension field K of a prime field F _p with a characteristic p> 3, the scalar multiplication within a cryptographic algorithm for an encryption of a message, a decryption of a message Signature generation is carried out from a message or a signature verification calculation from a message, and wherein the characteristic p has a Hamming weight ≤ 4 and the expansion body K in polynomial representation an irreducible polynomial F (X) = X ^d - 2 degree d owns. The optimum expansion body is thus of type 2 and has optimal reduction properties with respect to the reduction in the polynomial ring F _P [X]. Since optimal expansion bodies of type 1 and type 2 are mutually exclusive, a representation of the primary number in the form p = 2 ⁿ + 1 is not possible. In order nevertheless to enable efficient arithmetic in the prime field F _p , it is required that the prime number p has a low Hamming weight. Due to the low Hamming weight in the binary representation, the number of arithmetic operations is greatly reduced and the calculation of scalar multiplication accelerated.

According to an advantageous embodiment, the characteristic p has a Hamming weight of 3. For a Hamming weight less than 3 you will get an optimal expansion body of type 1. However, since an optimal expansion body of type 2 has already been chosen, this is not possible. If the Hamming weight is 4 or greater, additional summands are obtained that affect the efficiency of the scalar multiplication algorithm.

According to an advantageous embodiment, the characteristic is chosen such that p = 2 ⁿ + 2 ^m + 1, where n and m are natural numbers. If the characteristic is selected in this form, it automatically has a Hamming weight of 3. All operations can be performed by moving the bit Realize positions and addition or subtraction efficiently.

According to an advantageous embodiment, the degree d of the irreducible polynomial is a prime number. If d were an even number, then there would be a binomial formula with which the irreducible polynomial could be reduced. If the degree d is a prime number, known attacks can be prevented, which are possible if the degree d is not a prime number.

According to an advantageous embodiment, the elliptic curve is given by y ² = x ³ + ax + b with 4a ³ + 27b ² ≠ 0. This is not limiting, the method is also applicable to other curves. The condition for the coefficients a and b must apply, so that the elliptic curve is not singular

Points, otherwise it would be unsuitable for cryptography applications.

According to an advantageous embodiment, the elliptic curve is a Koblitz curve. Koblitz curves allow a fast scalar multiplication by Frobenius endomorphism over the body F _p .

According to an advantageous embodiment, the scalar multiplication by means of a Frobenius endomorphism in a

Power series representation of the scalar performed. The scalar multiplication can then be implemented as a sum of shorter scalar multiplications.

According to an advantageous embodiment, the powers of the power series are previously calculated and stored. The efficiency of the scalar multiplication algorithm can thereby be further increased.

According to an advantageous embodiment, the bit length of the characteristic p and the degree d are adapted to the processor on which scalar multiplication is carried out. For a processor with a word width of 8 bits, the prime p 5 to 6 bits, allowing a representation of primes up to 31. In order to provide sufficient security, the degree d of the irreducible polynomial must be set higher than with a prime number with a larger bit length. To realize a body of at least 160 bits, a degree of d = 23 or 29 is required. For a 16 bit word width processor, characteristics p with bit lengths of 12 to 13 bits may be used, the degree of the irreducible polynomial may then be lower, e.g. B. d = 11.

According to an advantageous embodiment, the characteristic p and the degree d are chosen so that the arithmetic operations provided for the bus width of the processor can be used directly for scalar multiplication. This saves saving intermediate results

Multiplication possible without a reduction in the characteristic p is required. Furthermore, no implementation for a long-number arithmetic is necessary.

According to an advantageous embodiment, parts of the arithmetic operations of scalar multiplication are executed in parallel by means of a streaming single instruction multiple data (SIMD) extension instruction set (SSE). By parallelizing and exploiting further optimization options available on the hardware platform, the required computation time can be dramatically reduced even without coprocessors.

According to the invention, the methods described above are used in an asymmetric cryptography application. These applications may enable key exchange, digital signatures, etc., with the computing time and hardware requirement being at a level acceptable to the user.

The invention will be explained in more detail with reference to exemplary embodiments. To speed up the calculation of scalar multiplication, an elliptic curve over an optimal extension field and field arithmetic must be optimized according to the existing hardware platform. This is achieved by an optimization in terms of the computational effort that is required if the optimal expansion body does not satisfy one of the conditions of type 1 or type 2. It turns out that if an optimal type 2 extender is chosen, the resulting non-optimal shape can be sufficiently compensated for Type 1 by a clever choice of the prime number p. If, on the other hand, the irreducible polynomial F (X) is not optimal, this means more computation effort, since this polynomial has a greater effect on the calculation and correspondingly has many coefficients depending on the degree d.

In order to compensate for the non-optimal form of the prime number with respect to type 1, a number with a very small Hamming weight in binary representation is therefore chosen as the prime number p. The smallest possible Hamming weight, namely 3, has prime numbers of the form p = 2 ⁿ + 2 ^m + 1. The additional summand 2 ^m has less serious effects on the computational time than a non-optimal reduction polynomial.

The prime number p is further selected so that as many intermediate results as possible can be kept in registers without having to reduce p with respect to the prime number. You can then allow the additive constant without major disadvantages in terms of the computational time, since only at the end must be reduced.

In the embodiments, the target platform used is a 32-bit Pentium 4 processor with an SSE2 unit. In order to do without long-number arithmetic or coprocessor, the bit length of the prime number p is selected between 20 and 30 bits. Compared to the recommended bit length of 160 bits, this represents a reduction by a factor of five to eight. The reduction polynomial is chosen to be F (X) = X ^d - w, where d = 11 and w = 2. The prime number is chosen to be p = 2 ²⁹ - 2 ⁹ + 1 where n = 29, m = 9 and c = 511 , The prime number p thus has a bit length of only 29 bits.

The multiplication with c = 511 necessary for the reduction in the definition of the optimal expansion body can then be realized very effectively with the fast operations of bitwise shifting, addition and subtraction because of the Hamming weight of 3.

By means of the invention it is now possible to find optimal expansion bodies which combine the advantages of Type 1 and Type 2 optimal expansion bodies. The reduction of production of elements of the prime F _p as well as the reduction of products in the polynomial ring over F _p can be performed without the use of multiplication commands from the processor. The multiplication by the additive constant c = + 2 ^m + 1 can be realized due to the small Hamming weight by a shift operation and a subtraction or addition. A reduction modulo p can be realized by only four shift operations, two subtractions and two additions. Furthermore, all subtotals of partial products of the coefficients of the operands can be stored in a 64-bit register without overflow. The reduction modulo p occurs once at the end of the calculation of the coefficients of the product.

Intel's SSE2 (Streaming SIMD Extension 2) Assembler instruction set allows parts of the body arithmetic to be parallelized across the body F _p on a Pentium 4 processor. The Single Instruction Multiple Data (SIMD) concept and the 128-bit registers allow the simultaneous calculation of two partial products, as shown in the following program segment.

movd xmmO, [edi]; load operand a punpcklqdq xmmO, xmmO; duplicate operand a movdqu xmmβ, [esi]; load operands b and c pmuludq xmmβ, xmmO; compute a * b and a * c paddq xmml, xmmβ; add a * b and a * c to previous results

The following program segment uses the clever representation of p = 2 ²⁹ - 2 ⁹ + 1 with a low Hamming weight in order to simultaneously reduce two intermediate results:

movdqa xmm7, xmml; mask both lower 29-bit parts pmm xmml, [mask] psrlq xmm7, 29; shift upper parts 29-bits right psubq xmml, xmm7; subtract psllq xmm7, 9; shift upper parts 9-bits left paddq xmml, xmm7; add

movdqa xmmβ, xmml; repeat reduction step pand xmml, [mask] psrlq xmmb, 29 psubq xmml, xmmb psllq xmmb, 9 paddq xmml, xmmb

mask dd Oxlfffffff, 0x00000000, Oxlfffffff, 0x00000000

Using SSE2 commands applied to 4 double words, it is even possible to calculate and reduce 4 coefficients simultaneously in addition and subtraction in F _p .

As an elliptic curve, a Koblitz curve with y ² = x ³ + ax + b modulus p with the parameters a = 468383287 and b = 63579974 is chosen. The coefficients a and b were determined randomly and are of degree 0, so that exponentiation of a point with p represents this again on the same curve. In this way it is possible to use the Frobenius endomorphism for a very fast scalar multiplication algorithm. For further acceleration, the required powers of the number 2 are calculated in advance and stored in tables.

The optimal expansion bodies can be similarly selected for hardware platforms with different bus widths. The prime number p is chosen such that on the one hand there is an optimal reduction polynomial of type 2, ie X ^d - 2, and on the other hand the prime number p has a minimal Hamming weight, so that as few summands as possible in the binary Representation are present. For a 16-bit processor, for example, the prime number p has a bit length of 11 or 13 bits.

Using the optimal expansion bodies shown above and the skillful choice of the prime number p reduces the computation time for scalar multiplication of points on elliptic curves, so that cryptographic procedures that use elliptic curves over optimal expander bodies can be performed more quickly. In addition, since the method for scalar multiplication can be scaled by an appropriate choice of the bit length of the primes and can thus be adapted to different processor bus widths, it can also be used on a wide variety of hardware platforms. In particular, in hardware platforms without Langzahlarithmetik or coprocessor asymmetric methods based on elliptic curves can be used with low processing times.

Claims

claims

1. A method for scalar multiplication of points on an elliptic curve over a finite extension body K of a prime body F _p with a characteristic p> 3, wherein the Skalarultiplikation within a cryptographic algorithm for encryption of a message, a decryption of a message, a signature generation from a message or a signature verification calculation is performed from a message, characterized in that

the characteristic p has a Hamming weight ≤ 4, and

- The extension body K in polynomial representation has an irreducible polynomial F (X) = X ^d - 2 of degree d.

2. The method according to claim 1, characterized in that the characteristic p has a Hamming weight of 3.

3. The method according to claim 2, characterized in that the characteristic p = 2 ⁿ + 2 ^m + 1 is selected, where n and m are natural numbers.

4. The method according to any one of claims 1 to 3, characterized in that the degree d of the irreducible polynomial is a prime number.

5. The method according to any one of claims 1 to 4, characterized in that the elliptic curve is given by y ² = x ³ + ax + b with 4a ³ + 27b ² ≠ 0.

6. The method according to claim 5, characterized in that the elliptic curve is a Koblitz curve.

7. The method according to claim 6, characterized in that the scalar multiplication is performed by means of a Frobenius endomorphism in a power series representation of the scalar.

8. The method according to claim 7, characterized in that the powers of the power series are previously calculated and stored.

9. Method according to one of claims 1 to 8, characterized in that the bit length of the characteristic p and the degree d are adapted to the processor on which the scalar multiplication is carried out.

10. The method according to claim 9, characterized in that the characteristic p and the degree d is selected such that the arithmetic operations provided for the bus width of the processor can be used directly for scalar multiplication.

A method according to claim 9 or 10, characterized in that the characteristic p and the degree d are chosen such that all coefficients of intermediate multiplication products of the modular multiplication can be stored in one of the registers of the processor via the extension body without overflow.

12. The method according to any one of the preceding claims, characterized in that

Parts of the arithmetic operations of the scalar multiplication are carried out in parallel by means of a streaming single instruction multiple data extention instruction set.

13. Use of the method according to one of the preceding claims in an asymmetric cryptography application.