Constructive and destructive implementations of elliptic-curve arithmetic

112 Pages·2012·0.92 MB·English

Constructive and destructive implementations of
elliptic-curve arithmetic
Peter Schwabe
Research Center for Information Technology Innovation
Academia Sinica
October 30, 2012
ECC 2012, Querétaro, Mexico
Variable-basepoint scalar multiplication
(Part of) Patrick Longa’s first slide at ECC 2011
“Elliptic Curve Cryptography at High Speeds”
Constructiveanddestructiveimplementationsofelliptic-curvearithmetic 2
Answers to this question
(cid:73) Three recent updates (all for Intel Sandy Bridge):
(cid:73) Aranha, Faz-Hernández, López, and Rodríguez-Henríquez: Faster
implementation of scalar multiplication on Koblitz curves,
Latincrypt 2012.
Result: 99200 cycles on the NIST-K283 curve.
Code will be available
(cid:73) Longa and Sica: Four-Dimensional Gallant-Lambert-Vanstone
Scalar Multiplication, Asiacrypt 2012.
Result: 91000 cycles on a 256-bit curve over a prime field.
Code not available
(cid:73) Oliveira, Rodríguez-Henríquez, and López: New timings for scalar
multiplication using a new set of coordinates, ECC 2012 rump
session.
Result: 75000 cycles on a 254-bit curve over a binary field.
Code will be available
Constructiveanddestructiveimplementationsofelliptic-curvearithmetic 3
(cid:73) Maybe I’m not doing my job properly, or maybe it is (often) the
wrong question to ask in the first place?
(cid:73) Certainly there is a lot more to do for ECC software performance
(cid:73) Example 1: Elliptic-curve Diffie-Hellman key exchange
(cid:73) Example 2: Elliptic-curve signatures
(cid:73) Example 3: Solving the ECDLP with Pollard’s rho algorithm
Outline of this talk
(cid:73) In all ECC software I wrote I never answered the question “How fast
can we do variable-basepoint scalar multiplication?”
Constructiveanddestructiveimplementationsofelliptic-curvearithmetic 4
(cid:73) Example 1: Elliptic-curve Diffie-Hellman key exchange
(cid:73) Example 2: Elliptic-curve signatures
(cid:73) Example 3: Solving the ECDLP with Pollard’s rho algorithm
Outline of this talk
(cid:73) In all ECC software I wrote I never answered the question “How fast
can we do variable-basepoint scalar multiplication?”
(cid:73) Maybe I’m not doing my job properly, or maybe it is (often) the
wrong question to ask in the first place?
(cid:73) Certainly there is a lot more to do for ECC software performance
Constructiveanddestructiveimplementationsofelliptic-curvearithmetic 4
Outline of this talk
(cid:73) In all ECC software I wrote I never answered the question “How fast
can we do variable-basepoint scalar multiplication?”
(cid:73) Maybe I’m not doing my job properly, or maybe it is (often) the
wrong question to ask in the first place?
(cid:73) Certainly there is a lot more to do for ECC software performance
(cid:73) Example 1: Elliptic-curve Diffie-Hellman key exchange
(cid:73) Example 2: Elliptic-curve signatures
(cid:73) Example 3: Solving the ECDLP with Pollard’s rho algorithm
Constructiveanddestructiveimplementationsofelliptic-curvearithmetic 4
(cid:73) High level: reduce number of EC additions and doublings
(cid:73) Mid level: reduce number of field operations per EC addition and
doubling
(cid:73) Low level: reduce number of CPU cycles taken by field operations
(cid:73) Second step sounds exactly like variable basepoint scalar
multiplication
(cid:73) Usual way to make this fast:
Elliptic-curve Diffie-Hellman key exchange
(cid:73) Alice and Bob each pick random secret scalar, compute scalar
product with a fixed base point
(cid:73) Alice and Bob each receive point from the other one, multiply by
their secret scalar
Constructiveanddestructiveimplementationsofelliptic-curvearithmetic 5
(cid:73) High level: reduce number of EC additions and doublings
(cid:73) Mid level: reduce number of field operations per EC addition and
doubling
(cid:73) Low level: reduce number of CPU cycles taken by field operations
(cid:73) Usual way to make this fast:
Elliptic-curve Diffie-Hellman key exchange
(cid:73) Alice and Bob each pick random secret scalar, compute scalar
product with a fixed base point
(cid:73) Alice and Bob each receive point from the other one, multiply by
their secret scalar
(cid:73) Second step sounds exactly like variable basepoint scalar
multiplication
Constructiveanddestructiveimplementationsofelliptic-curvearithmetic 5
Elliptic-curve Diffie-Hellman key exchange
(cid:73) Alice and Bob each pick random secret scalar, compute scalar
product with a fixed base point
(cid:73) Alice and Bob each receive point from the other one, multiply by
their secret scalar
(cid:73) Second step sounds exactly like variable basepoint scalar
multiplication
(cid:73) Usual way to make this fast:
(cid:73) High level: reduce number of EC additions and doublings
(cid:73) Mid level: reduce number of field operations per EC addition and
doubling
(cid:73) Low level: reduce number of CPU cycles taken by field operations
Constructiveanddestructiveimplementationsofelliptic-curvearithmetic 5
(cid:73) Standard optimization: Use signed representation
(cid:73) For curves with efficiently computable endomorphism ϕ:
(cid:73) Split scalar k in k1,k2, s.t. kP =k1P +k2ϕ(P)
(cid:73) Perform double-scalar multiplication with half-size scalars
(cid:73) Halves the number of doublings
(cid:73) Estimate by Galbraith, Lin, Scott (2009): speedup of 30% to 40%
Sliding-window scalar multiplication
(cid:73) Choose window size w
(cid:73) Precompute P,3P,5P,...,(2w−1)P
(cid:73) Rewrite scalar k as k =(cid:80)k 2i with k in {0,1,3,5,...,2w−1}
i i
with at most one non-zero entry in each window of length w
(cid:73) Double for each coefficient, add for nonzero coefficients
(cid:73) Expected number of additions: ≈len(k)/(w+1)+2w−1
Constructiveanddestructiveimplementationsofelliptic-curvearithmetic 6