Montgomery Ladder Research Articles

Efficient Error Detection Cryptographic Architectures Benchmarked on FPGAs for Montgomery Ladder

Efficient Error Detection Cryptographic Architectures Benchmarked on FPGAs for Montgomery Ladder

GMC-crypto: Low latency implementation of ECC point multiplication for generic Montgomery curves over GF(p)

Elliptic Curve Cryptography (ECC) is the front-runner among available public key cryptography (PKC) schemes due to its potential to offer higher security per key bit. All ECC-based cryptosystems heavily rely on point multiplication operation where its efficient realization has attained notable focus in the research community. Low latency implementation of the point multiplication operation is frequently required in high-speed applications such as online authentication and web server certification. This paper presents a low latency ECC point multiplication architecture for Montgomery curves over generic prime filed GF(p). The proposed architecture is able to operate for a general prime modulus without any constraints on its structure. It is based on a new novel pipelined modular multiplier developed using the Montgomery multiplication and the Karatsuba-Offman technique with a four-part splitting methodology. The Montgomery ladder approach is adopted on a system level, where a high-speed scheduling strategy to efficiently execute GF(p) operations is also presented. Due to these circuit and system-level optimizations, the proposed design delivers low-latency results without a significant increase in resource consumption. The proposed architecture is described in Verilog-HDL for 256-bit key lengths and implemented on Virtex-7 and Virtex-6 FPGA platforms using Xilinx ISE Design Suite. On the Virtex-7 FPGA platform, it performs a 256-bit point multiplication operation in just 110.9 us with a throughput of almost 9017 operations per second. The implementation results demonstrate that despite its generic nature, it produces low latency as compared to the state-of-the-art. Therefore, it has prominent prospects to be used in high-speed authentication and certification applications.

Computing 2-isogenies between Kummer lines

We use theta groups to study 2 -isogenies between Kummer lines, with a particular focus on the Montgomery model. This allows us to recover known formulas, along with more efficient forms for translated isogenies, which require only 2 S + 2 m 0 for evaluation. We leverage these translated isogenies to build a hybrid ladder for scalar multiplication on Montgomery curves with rational 2 -torsion, which cost 3 M + 6 S + 2 m 0 per bit, compared to 5 M + 4 S + 1 m 0 for the standard Montgomery ladder.

A speed‐area‐efficient hardware ECPM‐engine in GF(p) over generic Weierstrass curves

AbstractThis paper proposes a 256‐bit speed‐area‐efficient hardware elliptic curve point‐multiplication engine (ECPM‐engine) in GF(p) over generic Weierstrass curves, which is optimized by a new speed‐area‐efficient radix‐64 Montgomery modular multiplication (R64MMM) and a novel Montgomery ladder scheduling. The R64MMM calls one 129‐bit adder and one (64x64+129)‐bit multiply‐accumulator (64‐129‐MAC) in parallel to make a trade‐off between speed and area. The novel Montgomery ladder scheduling is used to improve the utilization of MAC in ECPM operation. In this ECPM‐engine, both MAC utilization in R64MMM operations and R64MMM utilization in ECPM operations are close to 100%. The result shows that the proposed ECPM‐engine consumes 72k gates when the clock frequency is 714 MHz with a 90 nm standard cell library, and it computes one 256‐bit ECPM in 0.14 ms.

A Hybrid Approach for Efficient and Secure Point Multiplication on Binary Edwards Curves

The focus of this article is to present a novel crypto-accelerator architecture for a resource-constrained embedded system that utilizes elliptic curve cryptography (ECC). The architecture is built around Binary Edwards curves (BEC) to provide resistance against simple power analysis (SPA) attacks. Furthermore, the proposed architecture incorporates several optimizations to achieve efficient hardware resource utilization for the point multiplication process over GF(2m). This includes the use of a Montgomery radix-2 multiplier and the projective coordinate hybrid algorithm (combination of Montgomery ladder and double and add algorithm) for scalar multiplication. A two-stage pipelined architecture is employed to enhance throughput. The design is modeled in Verilog HDL and verified using Vivado and ISE design suites from Xilinx. The obtained results demonstrate that the proposed BEC accelerator offers significant performance improvements compared to existing solutions. The obtained throughput over area ratio for GF(2233) on Virtex-4, Virtex-5, Virtex-6, and Virtex-7 Xilinx FPGAs are 9.43, 14.39, 26.14, and 28.79, respectively. The computation time required for a single point multiplication operation on the Virtex-7 device is 19.61 µs. These findings indicate that the proposed architecture has the potential to address the challenges posed by resource-constrained embedded systems that require high throughput and efficient use of available resources.

Differential addition on binary elliptic curves

This paper presents new and fast differential addition (i.e., the addition of two points with the known difference) and doubling formulas, as the core step in Montgomery scalar multiplication, for various forms of elliptic curves over binary fields. The formulas are provided for binary Edwards, binary Hessian and binary Huff elliptic curves with cost of 5M+4S+1D when the given difference point is in affine form. Here, M,S,D denote the costs of a field multiplication, a field squaring and a field multiplication by a constant, respectively. In this paper, we show that every ordinary elliptic curve E over binary field F2n has Lopez and Dahab differential addition and doubling formulas with suitable function. This paper also presents, new complete differential addition formulas for binary Edwards curves with cost of 5M+4S+2D. Also, new complete Montgomery ladder and scalar multiplication algorithms are presented using the complete differential addition formulas.

Secure and Compact Elliptic Curve Scalar Multiplication with Optimized Inversion

Abstract Elliptic curve cryptography (ECC) is a typical public key cryptography technique that can ensure equivalent security with considerably smaller key sizes than Rivest-Shamir-Adleman (RSA). Hence, various implementations based on ECC are recommended for block chain and Internet of Things (IoT) devices. Because elliptic curve scalar multiplication (ECSM) is a fundamental computation in ECC, enhancing the security and efficiency of ECSM is important. ECSM specifies a scalar multiplication algorithm and elliptic curve addition formulae. Elliptic curve addition formulae on affine coordinates are compact from a memory cost perspective but weak against side channel attacks. Elliptic curve complete addition (CA) formulae can achieve secure ECSMs but are inefficient. A newly proposed secure ECSM, which uses a right-to-left (RL) scalar multiplication algorithm and (extended) affine coordinates, takes advantage of elliptic curve addition formulae on affine coordinates. However, it can only scan the input scalars from right to left. We propose new ECSMs, which can scan the input scalars from left to right (LR) based on (extended) affine coordinates. We also prove that our LR ECSMs satisfy secure generality without requiring exceptional computations. We enhance the efficiency of both LR and RL ECSMs with optimized inversion. Our LR ECSM with a memory of 12 field elements reduces that of the Montgomery ladder and Joye’s LR with CA formulae by 36.84% and that of 2-ary RL with (extended) affine coordinates by 14.29%, respectively. Our compact ECSMs are fit for applications on IoT devices and block chain, with a critical memory requirement.

Lightweight Architecture for Elliptic Curve Scalar Multiplication over Prime Field

In this paper, we present a novel lightweight elliptic curve scalar multiplication architecture for random Weierstrass curves over prime field Fp. The elliptic curve scalar multiplication is executed in Jacobian coordinates based on the Montgomery ladder algorithm with (X,Y)-only common Z coordinate arithmetic. At the finite field operation level, the adder-based modular multiplier and modular divider are optimized by the pre-calculation method to reduce the critical path while maintaining low resource consumption. At the group operation level, the point addition and point doubling methods in (X,Y)-only common Z coordinate arithmetic are modified to improve computation parallelism. A compact scheduling method is presented to improve the architecture’s performance, which includes appropriate scheduling of finite field operations and specific register connections. Compared with existing works, our design is implemented on the FPGA platform without using DSPs or BRAMs for higher portability. It utilizes 6.4~6.5k slices in Kintex-7, Virtex-7, and ZYNQ FPGA and executes an elliptic curve scalar multiplication for a field size of 256-bit in 1.73 ms, 1.70 ms, and 1.80 ms, respectively. Additionally, our design is resistant to timing attacks, simple power analysis attacks, and safe-error attacks. This architecture outperforms most state-of-the-art lightweight designs in terms of area-time products.

Improved Software Implementation for Montgomery Elliptic Curve Cryptosystem

The last decade witnessed rapid increase in multimedia and other applications that require transmitting and protecting huge amount of data streams simultaneously. For such applications, a high-performance cryptosystem is compulsory to provide necessary security services. Elliptic curve cryptosystem (ECC) has been introduced as a considerable option. However, the usual sequential implementation of ECC and the standard elliptic curve (EC) form cannot achieve required performance level. Moreover, the widely used Hardware implementation of ECC is costly option and may be not affordable. This research aims to develop a high-performance parallel software implementation for ECC. To achieve this, many experiments were performed to examine several factors affecting ECC performance including the projective coordinates, the scalar multiplication algorithm, the elliptic curve (EC) form, and the parallel implementation. The ECC performance was analyzed using the different factors to tune-up them and select the best choices to increase the speed of the cryptosystem. Experimental results illustrated that parallel Montgomery ECC implementation using homogenous projection achieves the highest performance level, since it scored the shortest time delay for ECC computations. In addition, results showed that NAF algorithm consumes less time to perform encryption and scalar multiplication operations in comparison with Montgomery ladder and binary methods. Java multi-threading technique was adopted to implement ECC computations in parallel. The proposed multithreaded Montgomery ECC implementation significantly improves the performance level compared to previously presented parallel and sequential implementations.

A High-Performance ECC Processor Over Curve448 Based on a Novel Variant of the Karatsuba Formula for Asymmetric Digit Multiplier

In this paper, we present a high-performance architecture for elliptic curve cryptography (ECC) over Curve448, which to the best of our knowledge, is the fastest implementation of ECC point multiplication over Curve448 to date. Firstly, we introduce a novel variant of the Karatsuba formula for asymmetric digit multiplier, suitable for typical DSP primitive with asymmetric input. It reduces the number of required DSPs compared to previous work and preserves the performance via full parallelization and pipelining. We then construct a 244-bit pipelined multiplier and interleaved fast reduction algorithm, yielding a total of 12 stages of pipelined modular multiplication with four stages of input delay. Additionally, we present an efficient Montgomery ladder scheduling with no additional register is required. The implementation on the Xilinx 7-series FPGA: Virtex-7, Kintex-7, Artix-7, and Zynq 7020 yields execution times of 0.12, 0.13, 0.24, and 0.24 ms, respectively. It increases the throughput by 242% compared to the best previous work on Zynq 7020 and by 858% compared to the best previous work on Virtex-7. Furthermore, the proposed architecture optimizes nearly 63% efficiency improvement in terms of Area×Time tradeoff. Lastly, we extend our architecture with well-known side-channel protections such as scalar blinding, base-point randomization, and continuous randomization.

Compression on the Twisted Jacobi Intersection

Formulas for doubling, differential addition and point recovery after compression were given for many standard models of elliptic curves, and allow for scalar multiplication after compression using the Montgomery ladder algorithm and point recovery on a curve after this multiplication. In this paper we give such formulas for the twisted Jacobi intersection au2 + v2 = 1, bu2 + w2 = 1. To our knowledge such formulas were not given for this model or for the Jacobi intersection. In projective coordinates these formulas have cost 2M +2S +6D for doubling and 5M + 2S + 6D for differential addition, where M; S; D are multiplication, squaring and multiplication by constants in a field, respectively, choosing suitable curve parameters cost of D may be small.

Resistance of the Montgomery Ladder Against Simple SCA: Theory and Practice

The Montgomery kP algorithm i.e. the Montgomery ladder is reported in literature as resistant against simple SCA due to the fact that the processing of each key bit value of the scalar k is done using the same sequence of operations. We implemented the Montgomery kP algorithm using Lopez-Dahab projective coordinates for the NIST elliptic curve B-233. We instantiated the same VHDL code for a wide range of clock frequencies for the same target FPGA and using the same compiler options. We measured electromagnetic traces of the kP executions using the same input data, i.e. scalar k and elliptic curve point P, and measurement setup. Additionally, we synthesized the same VHDL code for two IHP CMOS technologies, for a broad spectrum of frequencies. We simulated the power consumption of each synthesized design during an execution of the kP operation, always using the same scalar k and elliptic curve point P as inputs. Our experiments clearly show that the success of simple electromagnetic analysis attacks against FPGA implementations as well as the one of simple power analysis attacks against synthesized ASIC designs depends on the target frequency for which the design was implemented and at which it is executed significantly. In our experiments the scalar k was successfully revealed via simple visual inspection of the electromagnetic traces of the FPGA for frequencies from 40 to 100 MHz when standard compile options were used as well as from 50 MHz up to 240 MHz when performance optimizing compile options were used. We obtained similar results attacking the power traces simulated for the ASIC. Despite the significant differences of the here investigated technologies the designs’ resistance against the attacks performed is similar: only a few points in the traces represent strong leakage sources allowing to reveal the key at very low and very high frequencies. For the “middle” frequencies the number of points which allow to successfully reveal the key increases when increasing the frequency.

Stochastic methods defeat regular RSA exponentiation algorithms with combined blinding methods

Abstract Extra-reductions occurring in Montgomery multiplications disclose side-channel information which can be exploited even in stringent contexts. In this article, we derive stochastic attacks to defeat Rivest-Shamir-Adleman (RSA) with Montgomery ladder regular exponentiation coupled with base blinding. Namely, we leverage on precharacterized multivariate probability mass functions of extra-reductions between pairs of (multiplication, square) in one iteration of the RSA algorithm and that of the next one(s) to build a maximum likelihood distinguisher. The efficiency of our attack (in terms of required traces) is more than double compared to the state-of-the-art. In addition to this result, we also apply our method to the case of regular exponentiation, base blinding, and modulus blinding. Quite surprisingly, modulus blinding does not make our attack impossible, and so even for large sizes of the modulus randomizing element. At the cost of larger sample sizes our attacks tolerate noisy measurements. Fortunately, effective countermeasures exist.

Efficient 4-Way Vectorizations of the Montgomery Ladder

We propose two new algorithms for 4-way vectorization of the well known Montgomery ladder over elliptic curves of Montgomery form. The first algorithm is suitable for variable base scalar multiplication. In comparison to the previous work by Hisil et al. (2020), it eliminates a number of non-multiplication operations at the cost of a single multiplication by a curve constant. Implementation results show this trade-off to be advantageous. The second algorithm is suitable for fixed base scalar multiplication and provides clear speed improvement over a previous vectorization strategy due to Costigan and Schwabe (2009). The well known Montgomery curves Curve25519 and Curve448 are part of the TLS protocol, version~1.3. For these two curves we provide constant time assembly implementations of the new algorithms. Additionally, for the algorithm of Hisil et al. (2020), we provide improved implementations for Curve25519 and new implementation for Curve448. Timings results on the Haswell and Skylake processors indicate that in practice the new algorithms are to be preferred over previous methods for scalar multiplication on these curves.

High-Speed and Unified ECC Processor for Generic Weierstrass Curves over GF(p) on FPGA.

In this paper, we present a high-speed, unified elliptic curve cryptography (ECC) processor for arbitrary Weierstrass curves over , which to the best of our knowledge, outperforms other similar works in terms of execution time. Our approach employs the combination of the schoolbook long and Karatsuba multiplication algorithm for the elliptic curve point multiplication (ECPM) to achieve better parallelization while retaining low complexity. In the hardware implementation, the substantial gain in speed is also contributed by our n-bit pipelined Montgomery Modular Multiplier (pMMM), which is constructed from our n-bit pipelined multiplier-accumulators that utilizes digital signal processor (DSP) primitives as digit multipliers. Additionally, we also introduce our unified, pipelined modular adder/subtractor (pMAS) for the underlying field arithmetic, and leverage a more efficient yet compact scheduling of the Montgomery ladder algorithm. The implementation for 256-bit modulus size on the 7-series FPGA: Virtex-7, Kintex-7, and XC7Z020 yields 0.139, 0.138, and 0.206 ms of execution time, respectively. Furthermore, since our pMMM module is generic for any curve in Weierstrass form, we support multi-curve parameters, resulting in a unified ECC architecture. Lastly, our method also works in constant time, making it suitable for applications requiring high speed and SCA-resistant characteristics.

Innovative Dual-Binary-Field Architecture for Point Multiplication of Elliptic Curve Cryptography

High-performance Elliptic Curve Cryptography (ECC) implementation in encryption authentication severs has become a challenge due to the explosive growth of e-commerce’s demand for speed and security. Point multiplication (PM) is the most common and complex operation in ECC which directly determines the performance of the whole system. This article proposes a 6CC-6CC (clock cycle) dual-field PM architecture and a 6CC-4CC dual-field PM architecture based on maximizing utilization of Karatsuba multipliers and re-ordering schedule strategy in PM. The Montgomery Ladder algorithm used in PM is modified to a 4CC algorithm for better resource utilization and parallel computation. To solve the frequency drop problem while working on large finite field, the PM architectures for high and low field are carefully studied to have universal critical path length and balanced performance. Both of the architectures are implemented over GF(2571) and GF(2283) on Xilinx Virtex-5 and Virtex-7 FPGAs (Field-Programmable Gate Array) for comparison. The 6CC-6CC architecture is shown to have the best performance on GF(2571), which achieves one PM operation in $17.44~\mu s$ using 81549 LUTs (Look-Up-Table) with the frequency of 197.2 MHz on Virtex-5, and $12.55~\mu s$ using 80970 LUTs with the frequency of 274.1 MHz on Virtex-7. The 6CC-4CC architecture performs better on GF(2283) with the shortest computation time. It takes only $3.21~\mu s$ to finish one PM operation on Virtex-5 and $2.22~\mu s$ on Virtex-7, which are faster than all the previous designs. The implementation results prove that the proposed architectures have state-of-the-art performance as well as higher versatility for ECC designs.

Chosen base‐point side‐channel attack on Montgomery ladder with x ‐only coordinate: with application to secp256k1

This study revisits the side-channel security of the elliptic curve cryptography (ECC) scalar multiplication implemented with Montgomery ladder. Focusing on a specific implementation that does not use the y-coordinate for point addition (ECADD) and point doubling (ECDBL), the authors show that Montgomery ladder on Weierstrass curves is vulnerable to a chosen base-point attack. Unlike the normal implementation with y-coordinate, in the scenario of this study, the chosen base-point strategy will not lead to operations with two same inputs during the ECADD and/or ECDBL. Instead, by choosing a suitable base-point, one will find that there are operations that share a common operand; while it is not the case if the base-point is not chosen correctly. This results in the recovery of the secret (fixed) scalar. They also experiment the methods of shared operand detection on a real-world SoC, where a secp256k1 dedicated Montgomery ladder scalar multiplication with x-only coordinate is implemented, to show the efficiency of the scalar recovery attack. Naturally, the attack can be generalised to other Weierstrass curves when they contain special points.

Faster Montgomery and double-add ladders for short Weierstrass curves

The Montgomery ladder and Joye ladder are well-known algorithms for elliptic curve scalar multiplication with a regular structure. The Montgomery ladder is best known for its implementation on Montgomery curves, which requires 5M+4S+1m+8A per scalar bit, and 6 field registers. Here (M, S,m,A) represent respectively field Multiplications, Squarings, multiplications by a curve constant, and Additions or subtractions. This ladder is also complete, meaning that it works on all input points and all scalars. Many protocols do not use Montgomery curves, but instead use prime-order curves in short Weierstrass form. These have historically been much slower, with ladders costing at least 14 multiplications or squarings per bit: 8M + 6S + 27A for the Montgomery ladder and 8M+ 6S + 30A for the Joye ladder. In 2017, Kim et al. improved the Montgomery ladder to 8M+ 4S + 12A + 1H per bit using 9 registers, where the H represents a halving. Hamburg simplified Kim et al.’s formulas to 8M+ 4S + 8A + 1H per bit using 6 registers. Here we present improved formulas which compute the Montgomery ladder on short Weierstrass curves using 8M+ 3S + 7A per bit, and requiring 6 registers. We also give formulas for the Joye ladder that use 9M+3S+7A per bit, requiring 5 registers. One of our new formulas supports very efficient 4-way vectorization. We also discuss curve invariants, exceptional points, side-channel protection and how to set up and finish these ladder operations. Finally, we show a novel technique to make these ladders complete when the curve order is not divisible by 2 or 3, at a modest increase in cost. A sample implementation of these techniques is given in the supplementary material, also posted at https://github.com/bitwiseshiftleft/ladder_formulas

Towards Efficient FPGA Implementation of Elliptic Curve Crypto-Processor for Security in IoT and Embedded Devices

An Elliptic Curve Crypto-Processor (ECCP) is a favorite public-key cryptosystem due to its small key size and its high security arithmetic unit. It is applied in constrained devices which often run on batteries and have limited processing, storage capabilities and low power. This research work presents an effective ECCP architecture for security in IoT and embedded devices. A finite field polynomial multiplier takes the most implementation effort of an ECCP because it is the most consuming operation for time and area. So, the objective is to implement the main operation of Point Multiplication (PM) 𝑄=𝑘𝑃 using FPGA. The aim is to obtain the optimal registers number for an area optimization of ECCP architecture. Moreover, it proposes a time optimization of ECCP based on the liveness analysis and exploiting forward paths. Also, a comparison between sequential and parallel hardware design of PM based on Montgomery ladder algorithm is provided.The developed ECCP design is implemented over Galois Fields GF (2163) and GF (2409) on Xilinx Integrated Synthesizes Environment (ISE) Virtex 6 FPGA. In case of GF (2163), this work achieved an area saving that uses 2083 Flip Flops (FFs), 40876 Lookup Tables (LUTs) and 19824 occupied slices. The execution time is 1.963 s runs at a frequency of 369.529 MHz and consumes 5237.00 mW. In case of GF (2409), this work achieved an area saving that uses 8129 Flip Flops (FFs), 42300 Lookup Tables (LUTs) and 18807 occupied slices. The execution time is 29 s runs at a frequency of 253.770 MHz and consumes 2 W. The obtained results are highly comparable with other state-of-the-art crypto-processor designs. The developed ECCP is applied as a case study of a cryptography protocol in ATMs.

Implementation of Supersingular Isogeny-Based Diffie-Hellman and Key Encapsulation Using an Efficient Scheduling

Isogeny-based cryptography is one of the promising post-quantum candidates mainly because of its smaller public key length. Due to its high computational cost, efficient implementations are significantly important. In this paper, we have proposed a high-speed FPGA implementation of the supersingular isogeny Diffie-Hellman (SIDH) and key encapsulation (SIKE). To this end, we have adapted the algorithm of finding optimal large-degree isogeny computation strategy for hardware implementations. Using this algorithm, hardware-suited strategies (HSSs) can be devised. We have also developed a tool to schedule field arithmetic operations efficiently using constraint programming. This tool enables reducing the latency of SIDH and SIKE subroutines by up to 14% at NIST's highest security level, i.e., using the SIKEp751 parameter set. We have also improved the latency of field inversion, the most costly field operation in SIDH, by 23% using the Montgomery ladder technique. We have provided constant-time implementations of SIDH and SIKE on Virtex-7 using SIKEp751 utilizing 6 and 8 prime field multipliers to resemble the previous work. Experimental results show that using 8 multipliers SIDH and SIKE encapsulation and decapsulation can be performed in 24.66 ms and 24.10 ms, which is 1.37 and 1.12 times faster than the latest corresponding FPGA implementations, respectively.