WO1999063426A1

WO1999063426A1 - Accelerated cryptographic operations

Info

Publication number: WO1999063426A1
Application number: PCT/CA1999/000466
Authority: WO
Inventors: Robert J. Lambert
Original assignee: Certicom Corp.
Priority date: 1998-06-01
Filing date: 1999-06-01
Publication date: 1999-12-09
Also published as: AU4125199A; CA2239372A1

Abstract

The present invention relates to a method and apparatus for decompressing elliptic curve points in cryptographic systems, wherein an elliptic curve point on an elliptic curve y2=f(x) is defined over a field F¿p? where p is either 3 mod 4 or 5 mod 8 and p is sparsely represented, the method comprising extracting a square root ∑f(x) including calculating exponents comprised of a success series of 1's in a binary expansion of the exponent and combining these exponents together with an appropriate number of squarings and multiplications to obtain a desired square root, the square root being a solution said curve.

Description

ACCELERATED CRYPTOGRAPHIC OPERATIONS

This invention relates to a method and apparatus for accelerating arithmetic operations in a cryptographic system.

BACKGROUND OF THE INVENTION

It is well known that to communicate data electronically between a pair of correspondents, typically, a pair of computer terminals or a personal card and a computer terminal. Widespread use is made of such communication in the banking environment in order to conduct transactions. Verification and encryption schemes are utilized to ensure secure data exchange between these correspondents. Generally, in smart card type applications, the card contains a low power processor and thus, it is desirable to optimize the computationally intensive operations in order to accelerate cryptographic operations, particularly, verification and encryption in these low power electronic cards, but efficient operation is generally useful.

In elliptic curve encryption systems, part of the data exchange between the corresponds includes elliptic curve points which are usually represented by two coordinates (x,y). These points are generally represented by large bit strings, however, it has been found that a point can be compressed (i.e., the entire y-coordinate does not have to be transmitted) and thus, transmitted more efficiently with reduced bandwidth. This is particularly important in wireless systems or where many sessions are performed.

Point compression is possible, because the elliptic curve is symmetrical about the x- axis, these elliptic curve points can be more compactly represented by the -coordinate along with a (one-bit) indication of the y-coordinate, which indicates on which side of the x-axis the point lies.

The -coordinate and the one-bit representing the v-coordinate is transmitted to a recipient which then utilizes the one-bit to reconstruct the appropriate y-coordinate corresponding to the x-coordinate. In order to extract the ^-coordinate however, the recipient has to perform a number of operations, one of these operations is a square root operation which heretofore is computationally intensive. By speeding up this operation, it is possible to accelerate the entire data communication operation. Thus, there is a need to provide an accelerated square root extraction scheme in order to facilitate a more efficient cryptographic system when utilizing compressed point transmission. To more clearly illustrate, elliptic curves defined over prime fields (that is modulo a prime) the curve representation is usually defined as y² = f(x) , where f(x) is a cubic function of x. Thus, for a given x, there are (at most) two possible square roots giving a solution for y. \ϊy₀ is such a solution to the square root, then - y₀ = p -y₀ mod p is another such solution. Since the prime over which the elliptic curve is defined will be odd for practical systems, one of yo and - y₀ is odd. Thus the least significant bit of y makes a suitable one-bit indication of the jy-coordinate of a specific point on the elliptic curve. Given an x value on the elliptic curve and the least significant bit of y, a point is expanded into the standard ordered pair representation by solving the square root y² = f(x) modp for the particular curve parameterization and typically, a square root yo is obtained. Once yo is known, y can be determined as either y₀ or -yo =p -yo modp, selected according to the least significant bit of y specified in the compressed representation.

SUMMARY OF THE INVENTION

In accordance with this invention there is provided a method of decompressing elliptic curve points for use in a cryptographic system.

When elliptic curve points are represented in a compressed format, square root algorithms are required to decompress this format into the standard (x,y) representation useful for additional computation. For elliptic curves defined over prime fields, where the prime/? has a specific form and is also sparsely represented, the method of the subject invention efficiently extracts these square roots by a mechanism which efficiently calculates exponents comprised of successive ones in the binary expansion of the exponent, and combines these exponents together with the appropriate numbers of squarings and finally multiplication to obtain the desired square root.

In an embodiment of the invention particular advantages are obtained where/) is either 3 mod 4 or 5 mod 8.

An advantage of the invention is to provide an efficient method for producing exponents all-ones in binary expansion, not requiring inversion.

A further advantage of the invention is a method for using such exponents to produce exponents deriving from sparse exponents, such as those that arise in performing square roots modulo certain primes having a sparse representation. An embodiment of the invention further provides for a method for using such exponentiations to extract square roots modulo certain primes, without first testing if the given element has a square root, or in the case p = 3 (mod 5) which exponentiation will produce a square root.

A still further embodiment of the invention provides a method, which uses such square root extraction to decompress compressed elliptic curve points defined on elliptic curves over primes over which such methods are applicable.

BRIEF DESCRIPTION OF THE DRAWINGS

These and other features of the preferred embodiments of the invention will become more apparent in the following detailed description in which reference is made to the appended drawings wherein:

Figure 1 is a schematic diagram of a data communication system;

Figure 2 is a schematic diagram of an encryption module used with the communication system of Figure 1;

Figure 3 is a flowchart showing an accelerated square root extraction function used in the communication system of Figure 2.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

Referring to Figure 1, a message is to be transferred from a transmitter 10 to a receiver 12, being the pair of correspondents, through a communication channel 14. Each of the transmitters 10 and receiver 12 have a cryptographic processing unit or module 16 associated therewith. These modules implement encryption/decryption functions, key exchange protocols and other cryptographic operations.

In a typical embodiment, the module 16 is shown schematically in Figure 2 and includes an arithmetic unit 20 to perform the cryptographic computations in the various schemes. A memory 21 which contains the various system parameters, such as parameters of the elliptic curve, a base point P, that lies in the elliptic curve, a private key, and such like. These parameters are available to the CPU 22 and the arithmetic unit 20. Referring back to Figure 1, one of the correspondents provides as part of a cryptographic operation, a compressed elliptic curve point (x,y) to the other correspondent. The recipient then has to extract the coordinate y, which satisfies the equation y² =f(x) modp where y is the solution toy^{2 =}f(x) then -y will also be a solution, as shown in Figure 3. For efficiency reasons, the primes p over which elliptic curve cryptosystems are defined can be chosen to have a sparse representation that is p = Σ_ieS ± 2' , for S a limited (or sparse) set of bit positions. For these types of primes it is desirable to provide an efficient mechanism for square root extraction, as may be applied to point decompression, as outlined above.

For roughly 3/4 of the primes, there exist known exponential formula for square root determination. These formula are the starting point for our invention.

If p = 3 mod 4, then the square root of a, if it exists, is given by

^ = a^(p+]), modp) .

Similarly, if/? = 5 mod 8, then the square root of a, if it exists, is given by _r _ J a^ip+i) (modp) if _a ^ip-^])l4 = 1 (mod/?) ^{a ~} [2- (4α)^(p+3)/8 (mod/?) if α⁽'-'^)/4 = -1 (mod/?)

Other, more complicated expressions can be developed for some other primes, and the method of the present invention can be applied there as well.

Our invention efficiently calculates such exponents when such a p is a sparsely represented prime.

The method of the present invention utilizes the following:

To raise an element a to the exponent 2 -1, which in binary is an exponent consisting of k ones, one can use the standard square and multiply technique. From this point onward, we shall assume all operations are performed modulo p, the prime over which the elliptic curve is defined. In the square and multiply technique, an accumulator, A is set initially to a, a is the squared producing a² and A is multiplied by this, which results in A being a . The a² value is squared again and the result, a⁴, multiplied into A, producing a , and the process continued until a - 1 is obtained. This requires A: - 1 squares and multiplies.

Instead, our mechanism to compute a to the power of 2^k-l, builds up this exponent from smaller exponents of all ones (in a binary representation of the exponent) as shown in Figure 3. To this end, write k itself in a binary representation, the bits of which are k₀, k_\,..., where ∑_ik_i 2' and proceed with the following mechanism:

Set 5=1, =a, ι=l While k≠O do

If fc mod 2 = l then B = BA k = k/2

A = A^2'A i = 2i

B now contains a^{2 ~l}

It is also possible to compute this exponent (all ones in binary representation) by repeated squaring and one multiplication by the inverse of the element a, but this is not typically a preferred embodiment, since the inversion operation is typically an expensive (either in time, or components of a computing engine) operation.

If/? = 3 (mod 4) or/? = 5 (mod 8), then square roots can be efficiently extracted via certain exponentiations.

If/? = 3 (mod 4), then the square root of a, if it exists is given by [u^~ = a^(p+l)l4 (modp).

Similarly, if/? = 5 mod 8, then the square root of a, if it exists, is given by r- _ { a^ip+3)/& (mod/?) // «⁽'-^1)/4 = l (mod/?) ^{α _} {2-¹ (4α)⁽"⁺³⁾'⁸ (mod/?) // α⁽'-^{I) 4} = -l (mod/?)

Notice that these exponents are in every case integers. If in addition, p is sparsely represented (typically in binary) then these exponents, either (p + l)/4 or ( ?+3)/8, are also typically represented by long strings of O's and long strings of 1 's interleaved with sporadic O's and 1 's. To compute these exponents, the method given above for computing all-one exponents is employed and the resulting pieces shifted (via squaring) and the components assembled with multiplication.

It is intended, in a preferred embodiment, that the computation of a set of all-one exponents of different lengths k, be computed in a single loop like the one described above, where the exponents of k_} each take from the current accumulator A value whatever portions are required for that particular k and each k_} is divided by 2 on each loop iteration.

More precisely, let e be the exponent (/?+l)/4 or ( ?+3)/8, as appropriate for/?, then e can be represented as a sent of n runs of zeros of lengths z = [z₀ , z, ,...z._, ] , interleaved with runs of ones of lengths u = [u₀ ,u_l ,...«„_, ] . This means that, from the least significant bit of e, there begins a run of zeros of length ZQ, followed by a run of ones of length u₀,which are followed by the last run of ones of length u„._\. For example, if/? = 2'^oυ + 7 = 3 (mod 4), then

1 R e = (p+l)/4 =2 +2, which has runs of ones of lengths u = [1,1], and interleaving runs of zeros of lengths z = [1,156]. If instead/? = 2¹⁶⁰ -2³¹ + 128 + 15 - 3 (mod 4), then e = 2¹⁵⁸ -2²⁹ +36 and z=[2,2,23] and u = [1,1,129].

Given an exponent e specified by a run length vectors z and u of length n, the following mechanism computes a

Set b = [b₀,b_l ,...,b_n__i ] = [1,1,..., 1] a vector of length tt, =a, i=\ Z = z + u (component-wise)

/* Compute each run of ones: */ While any component of u is not 0 do For j from 0 to n - 1 do liu_j mod 2 = 1, then b_j = b_jA mod p

U_j = U_j/2

A - A² mod /? i = 21

*/Assemble the runs of ones:/*

5 = 1 For/^' from n - 1 down to 0 do

B = Bu_j mod/?

B = B² mod /? B now contains a^e

Also, instead of testing before extraction if the element has a square root, and for the/? = 5 mod 8 case, which formula is useful, we propose that the exponent ( α^{(p+1)/ 4} or a^{{p+3)! &} ) be computed directly, and checked for solution by squaring and testing the result against a. In the/? = 5 mod 8 case, 2^"'4⁽'^{,+3) /8} can also be precomputed and multiplied with the prospective square root, and the result tested in the event the first possibility a^ip+2) did not produce the correct result upon squaring. If these computations do not reproduce a, it can be concluded that the element a does not have a square root modulo the prime/?.

If/? = 2¹⁶⁰ - 2³¹-1, then/? =3 (mod 4), and then the appropriate exponent e = 2¹⁵⁸ - 2²⁹. For specific primes/?, and therefore exponents e, less general mechanisms can be produced.

For example, a mechanism producing the square root of a, that is (mod/?), for p = 2¹⁶⁰ - 2³¹-1 can be described by:

b = a, i = 1 for/^' from 1 to 7 do c = b for k from 1 to/^' do c - c² mod/? b = be mod p i = 2/ b = b² mod/? b - ba mod /?

6 = ό² mod/? if b² mod /? = a then b contains v a

If p = 2¹⁹² - 2⁶⁴-l, then/? =3 (mod 4), and then the appropriate exponent e = 2^m - 2⁶² and a specific mechanism producing the square root of a is given by: b = a, i = l for/^' from 1 to 7 do c = b for k from 1 to/^' do c = c² mod/? b = bcmodp i - 21

b = b² mod/? if b² mod/? = α then b contains Vα

If ? = 2^{1 2} - 2 + 581, then/? = 5 (mod 8), and then the appropriate exponent e = 2¹⁸⁹ - 2⁶⁴ + 73, C - 2^~14^(p+3)/8 and a specific mechanism producing the square root of α is given by: b = α z = l for i from 1 to 7 do c = b for/^' from 1 to i do c = c² mod/? b = be mod /? i — 2i for i from 1 to 54 do b = b² mod/? b - b² mod/? b - ba mod p b - b² mod/? b = b² mod/? 6 = 6² mod/? b = ba mod /? /3 = t?² mod/? b = b² mod/? b = £² mod/? ό = άαmod/? if b² mod/? = a then b contains sfa b = Cbmodp if 6² mod/? = a then b contains yα otherwise a has no square root.

Although the invention has been described with reference to certain specific embodiments, various modifications thereof will be apparent to those skilled in the art without departing from the spirit and scope of the invention as outlined in the claims appended hereto.

Claims

THE EMBODIMENTS OF THE INVENTION IN WHICH AN EXCLUSIVE PROPERTY OR PRIVILEGE IS CLAIMED ARE DEFINED AS FOLLOWS:

1. A method for exponentiating a base value by an exponent in a cryptographic system, said method comprising the steps of:

(a) representing said exponent as a binary vector k₀,kι,...,k,;

(b) partitioning said binary vector into runs of zero's and ones;

(c) determining for each runs of ones a respective run length;

(d) representing each said run length in binary;

(e) using said binary representation of said run length to determine which of said powers of said base to multiply into a result register;

(f) repeating said step (e) for each said run;

(g) composing each step (f) to obtain said exponentiated value in said result register.

2. A method as defined in claim 1, including using such exponents to produce exponents deriving from sparse exponents, such as those that arise in performing square roots modulo certain primes having a sparse representation.

3. A method as defined in claim 1, including using such exponentiations to extract square roots modulo certain primes, without first testing if the given element has a square root, or in the case p = 3 (mod 5) which exponentiation will produce a square root.

4. A method for decompressing a compressed elliptic curve point, said method comprising the steps of: using a square root extraction to decompress said compressed elliptic curve points defined on elliptic curves over primes.