Elliptic Curve Addition Research Articles

Secure and Compact Elliptic Curve Scalar Multiplication with Optimized Inversion

Abstract Elliptic curve cryptography (ECC) is a typical public key cryptography technique that can ensure equivalent security with considerably smaller key sizes than Rivest-Shamir-Adleman (RSA). Hence, various implementations based on ECC are recommended for block chain and Internet of Things (IoT) devices. Because elliptic curve scalar multiplication (ECSM) is a fundamental computation in ECC, enhancing the security and efficiency of ECSM is important. ECSM specifies a scalar multiplication algorithm and elliptic curve addition formulae. Elliptic curve addition formulae on affine coordinates are compact from a memory cost perspective but weak against side channel attacks. Elliptic curve complete addition (CA) formulae can achieve secure ECSMs but are inefficient. A newly proposed secure ECSM, which uses a right-to-left (RL) scalar multiplication algorithm and (extended) affine coordinates, takes advantage of elliptic curve addition formulae on affine coordinates. However, it can only scan the input scalars from right to left. We propose new ECSMs, which can scan the input scalars from left to right (LR) based on (extended) affine coordinates. We also prove that our LR ECSMs satisfy secure generality without requiring exceptional computations. We enhance the efficiency of both LR and RL ECSMs with optimized inversion. Our LR ECSM with a memory of 12 field elements reduces that of the Montgomery ladder and Joye’s LR with CA formulae by 36.84% and that of 2-ary RL with (extended) affine coordinates by 14.29%, respectively. Our compact ECSMs are fit for applications on IoT devices and block chain, with a critical memory requirement.

The Implementation Results of Identity-Based Hashing Algorithm for Iot

Nonrepudiation in Mobile environment is a major challenge in the area of IoT security. Public-key-based Digital Signature schemes are common and their computational requirements and complexities do not support constrained devices. This paper presents the design and implementation results of light weight nonrepudiation architecture based on public key cryptography and Elliptic Curve addition to reduce the overhead of processing and communication.

Parameterized Splitting Systems for the Discrete Logarithm

Hoffstein and Silverman suggested the use of low Hamming weight product (LHWP) exponents to accelerate group exponentiation while maintaining the security level. With LHWP exponents, the computation costs on <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">GF(2</i> <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</sup> ) or Koblitz elliptic curves can be reduced significantly, where the cost of squaring and elliptic curve doubling is much lower than that of multiplication and elliptic curve addition, respectively. In this paper, we present a parameterized splitting system with an additional property, which is a refinement version of the system introduced in PKC'08. We show that it yields an algorithm for the discrete logarithm problem (DLP) with LHWP exponents with lower complexity than that of any previously known algorithms. To demonstrate its application, we attack the GPS identification scheme modified by Coron, Lefranc, and Poupard in CHES'05 and the DLP with Hoffstein and Silverman's (2,2,11)-exponent. The time complexity of our key recovery attack against the GPS scheme is <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</i> <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">61.82</sup> , which was expected to be <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</i> <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">78</sup> . Hoffstein and Silverman's (2,2,11)-exponent can be recovered with a time complexity of <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</i> <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">53.02</sup> , which is the lowest among the known attacks.

Use of Sparse and/or Complex Exponents in Batch Verification of Exponentiations

Modular exponentiation in an abelian group is one of the most frequently used mathematical primitives in modern cryptography. Batch verification is an algorithm for verifying many exponentiations simultaneously. We propose two fast batch verification algorithms. The first one makes use of exponents of small weight, called sparse exponents, and is asymptotically 10 times faster than individual verification and twice as fast as previous works at the same security level. The second one can only be applied to elliptic curves defined over small finite fields. Using sparse Frobenius expansion with small integer coefficients, we give a complex exponent test which is four times faster than the previous works. For example, each exponentiation in one batch asymptotically requires nine elliptic curve additions on some elliptic curves for 2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">80</sup> security

A new addition formula for elliptic curves over GF(2/sup n/)

We propose an addition formula in projective coordinates for elliptic curves over GF(2/sup n/). The new formula speeds up the elliptic curve scalar multiplication by reducing the number of field multiplications. This was achieved by rewriting the elliptic curve addition formula. The complexity analysis shows that the new addition formula speeds up the addition in projective coordinates by about 10-2 percent, which leads to enhanced scalar multiplication methods for random and Koblitz curves.

``Chinese &amp; Match'', an alternative to Atkin's ``Match and Sort'' method used in the SEA algorithm

A classical way to compute the number of points of elliptic curves defined over finite fields from partial data obtained in SEA (Schoof Elkies Atkin) algorithm is a so-called ``Match and Sort'' method due to Atkin. This method is a ``baby step/giant step'' way to find the number of points among $C$ candidates with $O(\sqrt{C})$ elliptic curve additions. Observing that the partial information modulo Atkin's primes is redundant, we propose to take advantage of this redundancy to eliminate the usual elliptic curve algebra in this phase of the SEA computation. This yields an algorithm of similar complexity, but the space needed is smaller than what Atkin's method requires. In practice, our technique amounts to an acceleration of Atkin's method, allowing us to count the number of points of an elliptic curve defined over $\mathbb{F}_{2^{1663}}$. As far as we know, this is the largest point-counting computation to date. Furthermore, the algorithm is easily parallelized.