Edwards Curves Research Articles

Distributing of point division on 4 results of Edwards curve points group to adjacement classes

Elliptic curves in Edwards form are perspective for usage in modern asymmetric cryptosystems. Such curves have a series of advantages in compare with elliptic curves in canonical form, such as speed of addition, universality of addition law, existence of affine coordinates for neutral element of group of points. The fact that Edwards curves are symmetric in both variables involves some properties of such curves that are used in cryptogogy. These days Edwards curves are actively investigates all over the world, for instance, the possibility is investigated to design new digital signature standards on Edwards curves. The most interesting for practical usage are Edwards curves which orders are equal to 4n, where n is large prime number. The security of digital signature on Edwards curves is based on complication of DLP (Discrete logarithm problem) in subgroup of Edwards curve points. The usage of Edwards curve for new digital signature standards stipulates the actuality of cryptanalysis of such cryptosystems. The important place among attacks on DLP-based cryptosystems take special attacks that use the features of the cyclic group in which the DLP problem is considered. Because of this it is necessary to investigate the structure of the cyclic group and its features for cryptanalysis of such systems. One of the algebraic tasks which may be useful in cryptanalysis is representation of Edwards curve points by the pair of left (right) adjacent classes by subgroups of the order 4 and of the maximal prime order n. One of the algorithms for cryptographic analysis of the Edwards curve cryptosystems is the division of point of Edwards curve by four. Division results are tightly connected with the split of point groups of Edward curve by adjacent classes of subgoups of maximum prime order and of the order 4. Structure of the Edwards curve points group allows to determine definitively position of any point of this group, simultaneously in two adjacent classes of subgroups of maximum prime order or fourth order. Example is given of discrete logarithmic problem solution using division of point by four and classification of results of division by adjacent classes for point groups of Edwards curve of order twenty eight and seventy six.

Efficient Pairing Computation on Twisted Weierstrass Curves

In this paper, we construct the twists of twisted Edwards curves in Weierstrass form. Then we define a new twisted Ate pairing on twisted Weierstrass curves named the Tx-Ate pairing. Following Miller's algorithm, we give a computation of the Tx-Ate pairing on high degree twisted Weierstrass curves, where the point operations are over Edwards form, and the computation of Miller function is over Weierstrass form. Although, in one doubling loop, our method to compute the Tx-Ate pairing is a litter slower than the previously fastest method. By twists, the Tx-Ate pairing can be calculated on more twisted Weierstrass curves with short loop length. The TxAte pairing is even competitive with optimal Ate pairing when they have the same short loop length.

Reconfigurable Hardware Architecture for Authenticated Key Agreement Protocol Over Binary Edwards Curve

In this article, we present a high-performance hardware architecture for Elliptic curve based (authenticated) key agreement protocol “Elliptic Curve Menezes, Qu and Vanstone” (ECMQV) over Binary Edwards Curve (BEC). We begin by analyzing inversion module on a 251-bit binary field. Subsequently, we present Field Programmable Gate Array (FPGA) implementations of the unified formula for computing elliptic curve point addition on BEC in affine and projective coordinates and investigate the relative performance of these two coordinates. Then, we implement the w -coordinate based differential addition formulae suitable for usage in Montgomery ladder. Next, we present a novel hardware architecture of BEC point multiplication using mixed w -coordinates of the Montgomery laddering algorithm and analyze it in terms of resistance to Simple Power Analysis (SPA) attack. In order to improve the performance, the architecture utilizes registers efficiently and uses efficient scheduling mechanisms for the BEC arithmetic implementations. Our implementation results show that the proposed architecture is resistant against SPA attack and yields a better performance when compared to the existing state-of-the-art BEC designs for computing point multiplication (PM). Finally, we present an FPGA design of ECMQV key agreement protocol using BEC defined over GF(2 251 ). The execution of ECMQV protocol takes 66.47μs using 32,479 slices on Virtex-4 FPGA and 52.34μs using 15,988 slices on Virtex-5 FPGA. To the best of our knowledge, this is the first FPGA design of the ECMQV protocol using BEC.

Supersingularity of elliptic and Edwards curves over $F_{p^n}$

We consider the algebraic curves which have form of Edwards and elliptic curves with coordinates in $F_ p^n $. These curves are most effective support for a cyclic group of points which have many applications now. In this paper it was found conditions of supersingularity for Edwards curve and same case of twisted Edwards and Montgomery curves over $F_ p^n $ where $p\equiv 3 mod 4$. There was proved that projective twisted Edwards curve is not elliptic. Some properties of this curve were investigated. Conditions of minimal cofactor of twisted Edwards curve were founded. Construction of a curve with given order and minimal cofactor was made.

Degenerate curve attacks: extending invalid curve attacks to Edwards curves and other models

Invalid curve attacks are a well known attack class targeting elliptic curve arithmetic implementations. In such attacks, the adversary tricks the cryptographic device into carrying out scalar multiplications on a weaker curve instead of on the expected, secure curve. The original approach of Antipa et al., however, only affects elliptic curve implementations using addition and doubling formulas that are independent of at least one of the curve parameters. This property is satisfied for elliptic curves in Weierstrass form, but not newer, increasingly popular models such as (twisted) Edwards curves. It has, therefore, been suggested that invalid curve attacks would not be applicable against these alternate models. In this study, the authors demonstrate that this is not the case, and present the first attack of this nature against (twisted) Edwards curves, Jacobi quartics, Jacobi intersections, and more. They also extend the analysis to characteristic 2 models, namely binary Huff, Edwards, and Lambda coordinates. They also show that our result may be used constructively as a fault attack countermeasure inspired by Shamir's trick, particularly on curves over random base fields.

Constructing eliptic curves with zero trace of Frobenius endomorphism

Most cryptosystems of the modern cryptography can benaturally transform into elliptic curves. We consider Edwardsalgebraic curves over a finite field, which at the presenttime is one of the most promising supports of sets ofpoints that are used for fast group operations[1,2,14].These are found in asymmetric cryptosystems. In particular,for constructing random crypto-stable sequences. It isshown that the projective curve is not elliptic. This paperaims to find the criterion and sufficient conditions for thesupersingularity of the Edwards curve and the elliptic curvein the Montgomery form over the finite field p also a generalizationof this criterion for a finite algebraic extentionof n pF . The result obtained allows us to construct an arbitrarysupersingle curve of Edwards and Montgomery withoutdecomposing on the factors the polynomial from,which is distinguished in the formula by the defining curve.Till now it was proved that only for coefficients1 d 2, d 2   over p [10]. The set of all coefficients ofd Ewhich contribute supersingularity of d E over p isresearched in this paper. Also in purpouse of our paper iscriterion and sufficient conditions of Edwards and ellipticcurves supersingularity over n pF , viz our purpouse is researchingof the parametrs set such that whereby we get apair of cirves with Frobenius trace which is equal to zero.It was found not only the set of such coefficients and characteristicsof fields where these curves are supersingularand general formula which provids a way to check for supersingularcurve over a field n p . In this paper the resultabout supersingular curves with coefficients 1 d 2, d 2  over p obtained in [10] was generalized also formulationof Theorem 3 was refined. The same research was providedfor elliptic curve in the Montgomery form over fieldsp and n p .

An optimal Tate pairing computation using Jacobi quartic elliptic curves

This research paper proposes new explicit formulas to compute the Tate pairing on Jacobi quartic elliptic curves. We state the first geometric interpretation of the group law on Jacobi quartic curves by presenting the functions which arise in the addition and doubling. We draw together the best possible optimization that can be used to efficiently evaluate the Tate pairing using Jacobi quartic curves. They are competitive with all published formulas for Tate pairing computation using Short Weierstrass or Twisted Edwards curves. Finally we present several examples of pairing-friendly Jacobi quartic elliptic curves which provide optimal Tate pairing.

A class of safe and efficient binary Edwards curves

This work describes a family of binary Edwards curves that admit modular reductions (an operation that can be responsible for up to 30% of the processing time in point arithmetic) twice as fast than the best usual settings, while essentially being as secure as a binary elliptic curve can be (in terms of being rigid and twist safe). Moreover, we present a hardware architecture with a generic VHDL description that can be synthesized to any FPGA with enough area to support the circuit. For this architecture, we are able to execute a point multiplication by scalar on $$\mathbb {F}_{562}$$ in 2.28 ms on Cyclone IV GX, in 1.23 ms on Virtex-7 and in 1.01 ms on Zynq 7020.

РОЗРАХУНОК ПАРАМЕТРІВ КРИПТОСТІЙКОЇ КРИВІЙ ЕДВАРДСА НАД ПОЛЯМИ ХАРАКТЕРИСТИК 5 ТА 7

The method of search of cryptographic strong elliptic curves in the Edwards form (where parameter d is non square in the field) over the extended finite fields of small characteristics p ≠ 2.3 is proposed. For these curves is performed the completeness of the points addition law, so they are called as complete Edwards curve. In the first stage over a small prime fields and we find the parameters d of complete Edwards curves who have minimum orders . For both curves we obtain the same values d = 3, which are non square in the fields and . Next with help recurrent formulae for both curves we calculated the orders (where n is odd) of these curves over the extended fields with prime degrees of extension m within known cryptographic standards (with the same bit-length field module 200 ... 600 bits). The calculated values n are tested on primelity. The extensions m, which provide a psevdoprime order 4n of curve with a prime value n, are selected. This provides the highest cryptographic stability of curve by the discrete logarithm problem solution. As a result, over the fields of the characteristic p = 5 we obtain two curves with degrees of expansion m = 181 and m = 277, and over the fields of the characteristic p = 7 one curve with the degree m = 127. For them, the corresponding large prime values of n are determined. The next stage is the calculation of other system-parameters of cryptographic systems based on complete Edwards curves. over the fields of characteristics 5 and 7. The arithmetic of extended fields is based on irreducible primitive polynomials P (z) of degree m. The search and construction of polynomial tables P (z) (for 10 different polynomials for each value m, respectively, for the values of the characteristics p = 5 and p = 7) has been performed. On the basis of each polynomial according to the developed method, the coordinates of the random point P of the curve are calculated. The possible order of this point is the value of 4n, 2n or n. The double doubling of this point is the coordinates and for 30 different generators G = 4P cryptosystems that have a prime order n. The set of parameters that satisfy the standard cryptographic requirements and can be recommended in projecting cryptosystems is obtained.

Supersingular complete Edwards curves over a prime field

The analysis of the conditions for the existence of super singular complete Edwards curves over a simple field is given. Three theorems are formulated and proved on the conditions for the existence of super singular curves with j-invariants equal to 0,123 and 663 .

Properties of twisted Edwards curve, halving of its point and its applications in cryptography

The conditions of the existence of divisibility in half an element from the group of points of the twistedEdwards curve a,d E over pn Fare investigated. Conditions of point order 8 existing are found. Thegenus of twisted curve Edwards is found. I was proved that projective twisted Edwards curve is notelliptic

Full‐custom hardware implementation of point multiplication on binary Edwards curves for application‐specific integrated circuit elliptic curve cryptosystem applications

This study presents an efficient and high‐speed very large‐scale integration implementation of point multiplication on binary Edwards curves over binary finite field GF(2m) with Gaussian normal basis representation. The proposed implementation is a low‐cost structure constructed by one digit‐serial multiplier. In the proposed scheduling of point multiplication, the field multiplier is busy during point addition and point doubling computations. In the field multiplier structure, by using the logical effort technique the delay is optimally decreased and the drive ability of the circuit in the point multiplication architecture is increased. Also, to reduce area and number of transistors of the point multiplication circuit, all components are selected based on low‐cost structures. The design is implemented in 0.18 μm CMOS technology over binary finite field GF(2233). The results confirm the validity of the proposed structure and its high performance in terms of delay and area cost.

Online template attacks

Template attacks are a special kind of side-channel attacks that work in two stages. In a first stage, the attacker builds up a database of template traces collected from a device which is identical to the attacked device, but under the attacker’s control. In the second stage, traces from the target device are compared to the template traces to recover the secret key. In the context of attacking elliptic curve scalar multiplication with template attacks, one can interleave template generation and template matching and reduce the amount of template traces. This paper enhances the power of this technique by defining and applying the concept of online template attacks, a general attack technique with minimal assumptions for an attacker, who has very very limited control over the template device. We show that online template attacks need only one power consumption trace of a scalar multiplication on the target device; they are thus suitable not only against ECDSA and static elliptic curve Diffie–Hellman (ECDH), but also against elliptic curve scalar multiplication in ephemeral ECDH. In addition, online template attacks need only one template trace per scalar bit and they can be applied to a broad variety of scalar multiplication algorithms. To demonstrate the power of online template attacks, we recover scalar bits of a scalar multiplication using the double-and-add-always algorithm on a twisted Edwards curve running on a smartcard with an ATmega163 CPU.

GEOMETRIC PROGRESSIONS ON ELLIPTIC CURVES.

In this paper, we look at long geometric progressions on different model of elliptic curves, namely Weierstrass curves, Edwards and twisted Edwards curves, Huff curves and general quartics curves. By a geometric progression on an elliptic curve, we mean the existence of rational points on the curve whose x-coordinate (or y-coordinate) are in geometric progression. We find infinite families of twisted Edwards curves and Huff curves with geometric progressions of length 5, an infinite family of Weierstrass curves with 8 term progressions, as well as infinite families of quartic curves containing 10-term geometric progressions.

Using modular extension to provably protect Edwards curves against fault attacks

Fault injection attacks are a real-world threat to cryptosystems, in particular, asymmetric cryptography. In this paper, we focus on countermeasures which guarantee the integrity of the computation result, hence covering most existing and future fault attacks. Namely, we study the modular extension protection scheme in previously existing and newly contributed variants of the countermeasure on elliptic curve scalar multiplication (ECSM) algorithms. We find that an existing countermeasure is incorrect and we propose new “test-free” variant of the modular extension scheme that fixes it. We then formally prove the correctness and security of modular extension: specifically, the fault non-detection probability is inversely proportional to the security parameter. Finally, we implement an ECSM protected with test-free modular extension during the elliptic curve operation to evaluate the efficient of this method on Edwards and twisted Edwards curves.

Elliptic Curve Cryptography with Efficiently Computable Endomorphisms and Its Hardware Implementations for the Internet of Things

Verification of an ECDSA signature requires a double scalar multiplication on an elliptic curve. In this work, we study the computation of this operation on a twisted Edwards curve with an efficiently computable endomorphism, which allows reducing the number of point doublings by approximately 50 percent compared to a conventional implementation. In particular, we focus on a curve defined over the 207-bit prime field F <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">p</sub> with p = 2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">207</sup> - 5,131. We develop several optimizations to the operation and we describe two hardware architectures for computing the operation. The first architecture is a small processor implemented in 0.13 μm CMOS ASIC and is useful in resource-constrained devices for the Internet of Things (IoT) applications. The second architecture is designed for fast signature verifications by using FPGA acceleration and can be used in the server-side of these applications. Our designs offer various trade-offs and optimizations between performance and resource requirements and they are valuable for IoT applications.

Efficient Elliptic Curve Cryptography for Embedded Devices

Many resource-constrained embedded devices, such as wireless sensor nodes, require public key encryption or a digital signature, which has induced plenty of research on efficient and secure implementation of elliptic curve cryptography (ECC) on 8-bit processors. In this work, we study the suitability of a special class of finite fields, called optimal prime fields (OPFs), for a “lightweight” ECC implementation with a view toward high performance and security. First, we introduce a highly optimized arithmetic library for OPFs that includes two implementations for each finite field arithmetic operation, namely a performance-optimized version and a security-optimized variant. The latter is resistant against simple power analysis attacks in the sense that it always executes the same sequence of instructions, independent of the operands. Based on this OPF library, we then describe a performance-optimized and a security-optimized implementation of scalar multiplication on the elliptic curve over OPFs at several security levels. The former uses the Gallant-Lambert-Vanstone method on twisted Edwards curves and reaches an execution time of 3.14M cycles (over a 160-bit OPF) on an 8-bit ATmega128 processor, whereas the latter is based on a Montgomery curve and executes in 5.53M cycles.

On Reduced Computation Cost for Edwards and Extended Twisted Edwards Curves

Background: Scalar multiplication is having the scope for gaining the computational efficiency for Elliptic Curve Cryptography (ECC). The security strength and effectiveness have been better reported on shorter key lengths. Methods: The Edwards curves are one of the form used in cryptography is showing one of advanced study for generating the more randomness and unpredictability behaviors. The numbers of researchers have shown the significant improvement to solve the same problem on two, four and eight processors and that are contributing the immense contribution in the field of security. Findings: The manuscript solves the Edwards Curves and twisted Edwards Curves problems on four and eight processors based on reduced computation cost from to on four processors and to on 8-processors, respectively. Our generalized computation cost on 8-processors for -bit scalar multiplication is reporting better than the cost for Montgomery Ladder method and for extended twisted Edwards curves on radix-8. Applications: The operation is performing on input scalar which multiplies with point-coordinates on curve, which has accumulated on reduced clock cycles with resistance to the simple side channel attack.

Elliptic‐curve cryptography for wireless sensor network nodes without hardware multiplier support

AbstractWith its relatively small key size, elliptic‐curve cryptography (ECC) is considered as the public‐key cryptographic algorithm of choice for wireless sensor networks (WSNs). In this work, we implemented ECC in the frequency domain, that is, by using the number theoretic transform, and without using hardware multiplier support, on the constrained MSP430 microcontroller widely used in WSNs. Our 169‐bit ECC implementation uses Edwards curves and performs scalar point multiplication in only 1.97 and 0.98 s for multiplication of random and fixed points, respectively. Unlike many implementations in literature, our implementation does not use hardware multiplier support, which makes it desirable for low‐power applications on constrained WSN platforms. To our knowledge, this study presents the first ever software implementation of ECC in the frequency domain on a constrained low‐power microcontroller without hardware multiplier support. Copyright © 2016 John Wiley &amp; Sons, Ltd.

Algorithms for Base Point Generation on an Edwards Curve with the Use of Point Divisibility Criteria

New criteria for Edwards curve point divisibility by 2, 4, and other natural numbers are obtained and proved. Using these results, new algorithms are constructed for extracting the root of arbitrary degree in the Edwards curve group and also new algorithms are obtained for generating the base point of such a curve that are proven to have some advantages.