Edwards Curves Research Articles

Efficient Lightweight Hardware Structures of Point Multiplication on Binary Edwards Curves for Elliptic Curve Cryptosystems

This paper presents efficient lightweight hardware implementations of the complete point multiplication on binary Edwards curves (BECs). The implementations are based on general and special cases of binary Edwards curves. The complete differential addition formulas have the cost of [Formula: see text] and [Formula: see text] for general and special cases of BECs, respectively, where [Formula: see text] and [Formula: see text] denote the costs of a field multiplication, a field squaring and a field multiplication by a constant, respectively. In the general case of BECs, the structure is implemented based on 3 concurrent multipliers. Also in the special case of BECs, two structures by employing 3 and 2 field multipliers are proposed for achieving the highest degree of parallelization and utilization of resources, respectively. The field multipliers are implemented based on the proposed efficient digit–digit polynomial basis multiplier. Two input operands of the multiplier proceed in digit level. This property leads to reduce hardware consumption and critical path delay. Also, in the structure, based on the change of input digit size from low digit size to high digit size the number of clock cycles and input words are different. Therefore, the multiplier can be flexible for different cryptographic considerations such as low-area and high-speed implementations. The point multiplication computation requires field inversion, therefore, we use a low-cost Extended Euclidean Algorithm (EEA) based inversion for implementation of this field operation. Implementation results of the proposed architectures based on Virtex-5 XC5VLX110 FPGA for two fields [Formula: see text] and [Formula: see text] are achieved. The results show improvements in terms of area and efficiency for the proposed structures compared to previous works.

High-performance Implementation of Elliptic Curve Cryptography Using Vector Instructions

Elliptic curve cryptosystems are considered an efficient alternative to conventional systems such as DSA and RSA. Recently, Montgomery and Edwards elliptic curves have been used to implement cryptosystems. In particular, the elliptic curves Curve25519 and Curve448 were used for instantiating Diffie-Hellman protocols named X25519 and X448. Mapping these curves to twisted Edwards curves allowed deriving two new signature instances, called Ed25519 and Ed448, of the Edwards Digital Signature Algorithm. In this work, we focus on the secure and efficient software implementation of these algorithms using SIMD parallel processing. We present software techniques that target the Intel AVX2 vector instruction set for accelerating prime field arithmetic and elliptic curve operations. Our contributions result in a high-performance software library for AVX2-ready processors. For example, our library computes digital signatures 19% (for Ed25519) and 29% (for Ed448) faster than previous optimized implementations. Also, our library improves by 10% and 20% the execution time of X25519 and X448, respectively.

Arithmetic Considerations for Isogeny-Based Cryptography

In this paper we investigate various arithmetic techniques which can be used to potentially enhance the performance in the supersingular isogeny Diffie-Hellman (SIDH) key-exchange protocol which is one of the more recent contenders in the post-quantum public-key arena. First, we give a systematic overview of techniques to compute efficient arithmetic modulo $2^xp^y\pm 1$2xpy±1. Our overview shows that in the SIDH setting, where arithmetic over a quadratic extension field is required, the approaches based on the Montgomery reduction for such primes of a special shape are to be preferred. Moreover, the outcome of our investigation reveals that there exist moduli which allow even faster implementations. Second, we investigate if it is beneficial to use other curve models to speed up the elliptic curve scalar multiplication. The use of twisted Edwards curves allows one to search for efficient addition-subtraction chains for fixed scalars while this is not possible with the differential addition law when using Montgomery curves. Our preliminary results show that despite the fact that we found such efficient chains, using twisted Edwards curves does not result in faster scalar multiplication arithmetic in the setting of SIDH.

Rational sequences on different models of elliptic curves

Given a set S of elements in a number field k, we discuss the existence of planar algebraic curves over k which possess rational points whose x-coordinates are exactly the elements of S. If the size vertical bar S vertical bar of S is either 4, 5, or 6, we exhibit infinite families of (twisted) Edwards curves and (general) Huff curves for which the elements of S are realized as the x-coordinates of rational points on these curves. This generalizes earlier work on progressions of certain types on some algebraic curves.

Supersingular Twisted Edwards Curves Over Prime Fields. I. Supersingular Twisted Edwards Curves with j-Invariants Equal to Zero and 123

An analysis of existence conditions of supersingular twisted Edwards curves over a prime field is given. Theorems on the conditions of existence of supersingular curves with j-invariants equal to zero and 123 in different classes of curves are formulated and proved. Based on these results, concrete parameters for some supersingular curves are obtained. A generalization of the results obtained earlier using an isomorphism of curves in Weierstrass and Edwards forms is given.

A new public key cryptosystem based on Edwards curves

The elliptic curve cryptography plays a central role in various cryptographic schemes and protocols. For efficiency reasons, Edwards curves and twisted Edwards curves have been introduced. In this paper, we study the properties of twisted Edwards curves on the ring $${\mathbb {Z}}/n{\mathbb {Z}}$$ where $$n=p^rq^s$$ is a prime power RSA modulus and propose a new scheme and study its efficiency and security.

Same value analysis on Edwards curves

Recently, several research groups in cryptography have presented new elliptic curve models based on Edwards curves. These new curves were selected for their good performance and security perspectives. Cryptosystems based on elliptic curves in embedded devices can be vulnerable to side-channel attacks (SCA), such as simple power analysis (SPA) or differential power analysis. In this paper, we analyze the existence of special points—whose use in SCA is known as same value analysis (SVA)—in the case of Edwards elliptic curves. These special points can be identified through a power analysis of the scalar multiplication. We show that all Edwards curves recently proposed for standardization contain some of these points and are therefore unsafe against SVA. As a countermeasure, we use the isogeny volcano approach to find SVA-secure isogenous curves to those proposed for standardization.

New Hybrid Method for Isogeny-Based Cryptosystems Using Edwards Curves

Along with the resistance against quantum computers, isogeny-based cryptography offers attractive cryptosystems due to small key sizes and compatibility with the current elliptic curve primitives. While the state-of-the-art implementation uses Montgomery curves, which facilitates efficient elliptic curve arithmetic and isogeny computations, other forms of elliptic curves can be used to produce an efficient result. In this paper, we present the new hybrid method for isogeny-based cryptosystem using Edwards curves. Unlike the previous hybrid methods, we exploit Edwards curves for recovering the curve coefficients and Montgomery curves for other operations. To this end, we first carefully examine and compare the computational cost of Montgomery and Edwards isogenies. Then, we fine-tune and tailor Edwards isogenies in order to blend with Montgomery isogenies efficiently. Additionally, we present the implementation results of Supersingular Isogeny Diffie–Hellman (SIDH) key exchange using the proposed method. We demonstrate that our method outperforms the previously proposed hybrid method, and is as fast as Montgomery-only implementation. Our results show that proper use of Edwards curves for isogeny-based cryptosystem can be quite practical.

Energy/Area-Efficient Scalar Multiplication with Binary Edwards Curves for the IoT.

Making Elliptic Curve Cryptography (ECC) available for the Internet of Things (IoT) and related technologies is a recent topic of interest. Modern IoT applications transfer sensitive information which needs to be protected. This is a difficult task due to the processing power and memory availability constraints of the physical devices. ECC mainly relies on scalar multiplication (kP)—which is an operation-intensive procedure. The broad majority of kP proposals in the literature focus on performance improvements and often overlook the energy footprint of the solution. Some IoT technologies—Wireless Sensor Networks (WSN) in particular—are critically sensitive in that regard. In this paper we explore energy-oriented improvements applied to a low-area scalar multiplication architecture for Binary Edwards Curves (BEC)—selected given their efficiency. The design and implementation costs for each of these energy-oriented techniques—in hardware—are reported. We propose an evaluation method for measuring the effectiveness of these optimizations. Under this novel approach, the energy-reducing techniques explored in this work contribute to achieving the scalar multiplication architecture with the most efficient area/energy trade-offs in the literature, to the best of our knowledge.

Combined small subgroups and side-channel attack on elliptic curves with cofactor divisible by 2m

Nowadays, alternative models of elliptic curves like Montgomery, Edwards, twisted Edwards, Hessian, twisted Hessian, Huff's curves and many others are very popular and many people use them in cryptosystems which are based on elliptic curve cryptography. Most of these models allow to use fast and complete arithmetic which is especially convenient in fast implementations that are side-channel attacks resistant. Montgomery, Edwards and twisted Edwards curves have always order of group of rational points divisible by 4. Huff's curves have always order of rational points divisible by 8. Moreover, sometimes to get fast and efficient implementations one can choose elliptic curve with even bigger cofactor , for example 16. Of course the bigger cofactor is, the smaller is the security of cryptosystem which uses such elliptic curve. In this article will be checked what influence on the security has form of cofactor of elliptic curve and will be showed that in some situations elliptic curves with cofactor divisible by $2^m$ are vulnerable for combined small subgroups and side-channel attacks.

FPGA Implementation of High-Speed Area-Efficient Processor for Elliptic Curve Point Multiplication Over Prime Field

Developing a high-speed elliptic curve cryptographic (ECC) processor that performs fast point multiplication with low hardware utilization is a crucial demand in the fields of cryptography and network security. This paper presents field-programmable gate array (FPGA) implementation of a high-speed, low-area, side-channel attacks (SCAs) resistant ECC processor over a prime field. The processor supports 256-bit point multiplication on recently recommended twisted Edwards curve, namely, Edwards25519, which is used for a high-security digital signature scheme called Edwards curve digital signature algorithm (EdDSA). The paper proposes novel hardware architectures for point addition and point doubling operations on the twisted Edwards curve, where the processor takes only 516 and 1029 clock cycles to perform each point addition and point doubling, respectively. For a 256-bit key, the proposed ECC processor performs single point multiplication in 1.48 ms, running at a maximum clock frequency of 177.7 MHz in a cycle count of 262 650 with a throughput of 173.2 kbps, utilizing only 8873 slices on the Xilinx Virtex-7 FPGA platform, where the points are represented in projective coordinates. The implemented design is time-area-efficient as it offers fast scalar multiplication with low hardware utilization without compromising the security level.

Edwards elliptic curves. Comparison of cryptographic libraries

Edwards Curves is a form of representing elliptic curves that supports fast, unified, and complete law of addition of points. Edwards curves have attracted great interest for their efficient addition and doubling formulas. In this paper, we described and compared programming libraries, which implemented Edwards curves and EdDSA signature.

Pseudo-random cryptological security sequences and the halving of a point of a wisted Edwards curve over prime and extended fields

Estimates of the complexity of the point division operation into two for twisted Edwards curve are obtained in comparison with the doubling of the point. One of the applications of the divisibility properties of a point into two is considered to determine the order of a point in a cryptosystem. The cryptological security of the pseudo-random sequence generator proposed by the author is shown on the basis of a curve in the form of Edwards. A new generation scheme and a new one-sided function of a pseudo-random cryptological security sequence based on these curves are proposed. The degree of embedding of these curves into a finite field for pairing on friendly elliptic curves of prime order or almost prime order is investigated. Pairingfriendly curves of prime or near-prime order are absolutely essential in certain pairing-based schemes like short signatures with longer useful life. For this goal we construct friendly curves on base of family of twisted Edwards curves. The possibility of constructing a twisted Edwards order curve, that is, one that has a minimal cofactor 4, has been found. A solution for the inverse doubling problem is obtained for quasi-elliptic curves that represented in the twisted Edwards form. Also its application to the proving of cryptographic pseudo-random sequence generator. It makes it possible to prove the cryptological security of the pseudo-random sequence we developed.

Substantiation of correctness and advantages of Lenstra factorization method on Edwards curves

The factorization problem, which is the basis for many classical asymmetric cryptosystems (RSA, Rabin, and others) and a cryptographically strong generator of pseudo-random sequences (PBS), has been investigated in this paper. The methods that served as prototypes for the Lenstra method were described, the method for factorization of numbers, which is analogous to the Lenstra method on Edwards curves, has been proposed. To substantiate the correctness of the method, an appropriate mathematical apparatus was developed. In addition, an analog of the Lenstra method on Edwards curves was constructed with the use of the presented apparatus; the appropriate algorithm for the factorization of numbers was designed. The correctness of the method and correctness of the algorithm operation were substantiated mathematically; the top analytical estimates of its performance speed, as well as the lower estimates of success probability, have been strictly proved. The advantages of the developed method in comparison with the classical Lenstra method, which applies elliptic curves in the Weierstrass form, were presented and strictly substantiated. A comparative analysis of the new and the classical algorithms was performed. Results of the research provided a strict proof that the new algorithm on full Edwards curves, in comparison with the classic one, has some advantages in terms of performance speed, by about 1.5 times. The presented experimental results show that the performance speed increases even larger (by up to 30 per cent) in case the twisted and quadratic curves are used instead of full Edwards curves. It was shown that the assessment of probability of success of the new method increases due to the emergence of new conditions that lead to success of the algorithm that are not satisfied for the classical Lenstra algorithm on Weierstrass curves. The obtained results make it possible to decrease the time required for solving the problem on factorization by approximately 1.5 times, and thus, enable the faster breaking of cryptosystems whose stability is based on this problem

Evaluation of Gaussian hypergeometric series using Huff’s models of elliptic curves

A Huff curve over a field K is an elliptic curve defined by the equation $$ax(y^2-1)=by(x^2-1)$$ where $$a,b\in K$$ are such that $$a^2\ne b^2$$ . In a similar fashion, a general Huff curve over K is described by the equation $$x(ay^2-1)=y(bx^2-1)$$ where $$a,b\in K$$ are such that $$ab(a-b)\ne 0$$ . In this note we express the number of rational points on these curves over a finite field $${\mathbb {F}_q}$$ of odd characteristic in terms of Gaussian hypergeometric series $$\displaystyle {_2F_1}(\lambda ):={_2F_1}\left( \begin{matrix} \phi &{}\phi &{} \epsilon \end{matrix}\Big | \lambda \right) $$ where $$\phi $$ and $$\epsilon $$ are the quadratic and trivial characters over $${\mathbb {F}_q}$$ , respectively. Consequently, we exhibit the number of rational points on the elliptic curves $$y^2=x(x+a)(x+b)$$ over $${\mathbb {F}_q}$$ in terms of $${_2F_1}(\lambda )$$ . This generalizes earlier known formulas for Legendre, Clausen and Edwards curves. Furthermore, using these expressions we display several transformations of $${_2F_1}$$ . Finally, we present the exact value of $$_2F_1(\lambda )$$ for different $$\lambda $$ ’s over a prime field $${\mathbb {F}_p}$$ extending previous results of Greene and Ono.

Design and leakage assessment of side channel attack resistant binary edwards Elliptic Curve digital signature algorithm architectures

Considering that Elliptic Curve Digital Signature Algorithm (ECDSA) implementations need to be efficient, flexible and Side Channel Attack (SCA) resistant, in this paper, a design approach and architecture for ECDSA and the underlined scalar multiplication operation is proposed for GF(2k), satisfying the above three directives. To achieve that, in the paper, Binary Edwards Curves (BECs) are adopted as an alternative to traditional Weierstrass Elliptic Curves (ECs) for GF(2k) since they offer intrinsic SCA resistance against simple attacks due to their uniformity, operation regularity and completeness. To achieve high performance and flexibility, we propose a hardware/software ECDSA codesign approach where scalar multiplication is implemented in hardware and integrated in the ECDSA functionality through appropriate drivers of an ECDSA software stack. To increase BEC scalar multiplier performance and introduce SCA resistance we adopt and expand a parallelism design strategy/methodology where GF(2k) operations of a scalar multiplier round for both point operations performed in this round are reordered and assigned into parallelism layer in order to be executed concurrently. Within this strategy we include hardware and software based SCA countermeasures that rely on masking/randomization and hiding. While scalar randomization is realized by the ECDSA software stack in an easy way, in order to achieve resistance using hardware means, we propose and introduce in every scalar multiplier round, within the parallelism layers, projective coordinates randomization of all the round’s output points. So, in our approach, considering that with the proposed parallelism plan in every scalar multiplier round BEC point operations are performed in parallel and that the round’s output points are randomized with a different number in each round, we manage to achieve maximum SCA resistance. To validate this resistance, we introduce and realize a leakage assessment process on BEC scalar multipliers for the first time in research literature. This process is based on real measurements collected from a controlled SAKURA X environment with a GF(2233) based scalar multiplier implementation. Using Welch’s t-test we investigate possible information leakage of the multiplier’s input point and scalar and after an extended analysis we find trivial leakage. Finally, we validate the ECDSA architecture and its scalar multiplier efficiency by implementing it on a Zynq 7000 series FPGA Avnet Zedboard and collecting very promising, well balanced, results on speed and hardware resources in comparison with other works.

Secure elliptic curves and their performance

Elliptic Curve Cryptography (ECC) is a branch of public-key cryptography based on the arithmetic of elliptic curves. In the short life of ECC, most standards have proposed curves defined over prime finite fields satisfying the curve equation in the short Weierstrass form. However, some researchers have started to propose as a securer alternative the use of Edwards and Montgomery elliptic curves, which could have an impact in current ECC deployments. This contribution evaluates the performance of the three types of elliptic curves using some of the examples provided by the initiative SafeCurves and a Java implementation developed by the authors, which allows us to offer some conclusions about this topic.

Faster Residue Multiplication Modulo 521-bit Mersenne Prime and an Application to ECC

We present faster algorithms for the residue multiplication modulo 521-bit Mersenne prime on 32- and 64-bit platforms by using Toeplitz matrix-vector product. The total arithmetic cost of our proposed algorithms is less than that of existing algorithms, with algorithms for 64- and 32-bit residue multiplication giving the best timing results on our test machine. The transition from 64- to 32-bit implementation is full of challenges because the number of limbs doubles and the limbs’ bitlengths are cut in half. Without using any intrinsics or SIMD/assembly instructions in our implementation on an Intel(R) Core i5 – 6402P CPU @ 2.80GHz, we find 136 and 550 cycles for our 64-and 32-bit residue multiplications, respectively. In addition, we implement constant-time variable- and fixed-base scalar multiplication for the standard NIST curve P-521 and Edwards curve E-521.

Efficient Isogeny Computations on Twisted Edwards Curves

The isogeny-based cryptosystem is the most recent category in the field of postquantum cryptography. However, it is widely studied due to short key sizes and compatibility with the current elliptic curve primitives. The main building blocks when implementing the isogeny-based cryptosystem are isogeny computations and point operations. From isogeny construction perspective, since the cryptosystem moves along the isogeny graph, isogeny formula cannot be optimized for specific coefficients of elliptic curves. Therefore, Montgomery curves are used in the literature, due to the efficient point operation on an arbitrary elliptic curve. In this paper, we propose formulas for computing 3 and 4 isogenies on twisted Edwards curves. Additionally, we further optimize our isogeny formulas on Edwards curves and compare the computational cost of Montgomery curves. We also present the implementation results of our isogeny computations and demonstrate that isogenies on Edwards curves are as efficient as those on Montgomery curves.

Efficient hardware implementations of point multiplication for binary Edwards curves

SummaryThis paper presents efficient and fast hardware implementations of the complete point multiplication on binary Edwards curves (BECs). The implementations are based on extremely fast complete differential addition and doubling formulas. These new complete differential addition formulas are performed for general and special cases of BECs with cost of 5M + 4S + 2Dand 5M + 4S + 1D, respectively, where,M,S, andDdenote the costs of a field multiplication, a field squaring and a field multiplication by a constant, respectively. In the general case of the BECs, proposed structures are implemented based on 3 and 1 pipelined digit‐serial Gaussian normal basis multipliers. In the design by 3 multipliers, computation of point addition and point doubling is performed concurrently. But in the second implementation for low‐cost design with low number of hardware resources, these computations are implemented by 1 multiplier. Also, in the special case of BECs, 2 structures are proposed for achieving the highest degree of parallelization and utilization of resources by using 3 and 2 field multipliers. Implementation results of the proposed architectures based on Virtex‐5 XC5VLX110, Virtex‐4 XC4VLX100, and Arria‐10 10AX115U4F45I3SG FPGAs for 2 fieldsandare achieved. The results show improvements in terms of execution time, area, and efficiency for the proposed structures compared with previous works.