Non-adjacent Form Research Articles

Maximum and Minimum Norms for τ-NAF Expansion on Koblitz Curve

Background/Objectives: The scalar multiplication in Elliptic Curve Cryptosystem (ECC) is the dominant operation of computing integer multiple for an integer n and a point P on elliptic curve. In 1997, Solinas 4 introduced the τ-adic non-adjacent form (τ-NAF) expansion of an element n of ring Z(τ) on Koblitz Curve. However in 2000, Solinas estimated the length of τ-NAF expansion by using maximum and minimum norms that obtained by direct evaluation method. In 2014, Yunos et al.9 introduced the formula of norm for every τ-NAF to improve this method. However, a lot of combination of norm should be considered when length of expansion is more than 15. So, the objective of this paper is to built the formulas to calculate the number of maximum and minimum norms for τ-NAF occurring among of all elements in Z(τ). Application/Improvement: With these formulas, we can estimate the length of τ-NAF expansion more accurately.

Variance and Covariance of Several Simultaneous Outputs of a Markov Chain

The partial sum of the states of a Markov chain or more generally a Markov source is asymptotically normally distributed under suitable conditions. One of these conditions is that the variance is unbounded. A simple combinatorial characterization of Markov sources which satisfy this condition is given in terms of cycles of the underlying graph of the Markov chain. Also Markov sources with higher dimensional alphabets are considered. Furthermore, the case of an unbounded covariance between two coordinates of the Markov source is combinatorically characterized. If the covariance is bounded, then the two coordinates are asymptotically independent. The results are illustrated by several examples, like the number of specific blocks in $0$-$1$-sequences and the Hamming weight of the width-$w$ non-adjacent form.

Non-commutative digit expansions for arithmetic on supersingular elliptic curves

We study non-commutative digit expansions in quaternion rings that arise in the context of supersingular elliptic curves. These digit expansions can be used in a \({\tau}\)-and-add method to speed up arithmetic (scalar multiplication and pairing) on certain families of supersingular elliptic curves in characteristic \({p \geqq 5}\). The basis \({\tau}\) is a quadratic algebraic integer that represents the Frobenius endomorphism of the curve, which is a very fast operation to evaluate. We prove the existence of a finite expansion for every element of the quaternion ring, as well as the equivalence between right and left digit expansions (i.e. the basis \({\tau}\) is placed right, resp. left, to the digit); this expansion turns out to be a non-adjacent form (NAF) for integers, i.e. in every two consecutive digits there is at least one 0.

Speeding up Pairing Computation Using Non-adjacent Form and ELM Method

The bilinear pairings such as Weil pairing and Tate pairing on elliptic curves have recently found many applications in cryptography. The first efficient algorithm for computing pairing was originally proposed by Miller and much subsequent research has been directed at many different aspects in order to improve efficiency. In 2003, Eisentrager, Lauter and Montgomery proposed a new point-double-addition method to speed up elliptic curve arithmetic computation and obtained a 7.8% performance improvement of the Miller algorithm of a general elliptic curve. In 2006, Blake et al. proposed a new concept based on the conjugate of a line to reduce the total number of lines in the Miller algorithm. In this paper we propose an enhancement of Eisentrager et al.'s algorithm for computing pairings. Our enhancement can further speed up the pairing computation by 5.9%.

Speeding up the Elliptic Curve Scalar Multiplication Using Non Adjacent Form

Improvement in the implementation of elliptic curves cryptography and reducing its complexity are still being actively researched. The representation of integers in non adjacent form has been the subject of various investigations in slightly different contexts. The n -digit Non Adjacent Form (NAF) representation of an integer has no two consecutive non zero digits. Fewer non zero elements mean fewer point additions and therefore more efficient when we need to compute the most popular operation: elliptic curve scalar multiplication. In the present paper we reduce the number of required operations using this representation.

Variances and covariances in the Central Limit Theorem for the output of a transducer

We study the joint distribution of the input sum and the output sum of a deterministic transducer. Here, the input of this finite-state machine is a uniformly distributed random sequence.We give a simple combinatorial characterization of transducers for which the output sum has bounded variance, and we also provide algebraic and combinatorial characterizations of transducers for which the covariance of input and output sum is bounded, so that the two are asymptotically independent.Our results are illustrated by several examples, such as transducers that count specific blocks in the binary expansion, the transducer that computes the Gray code, or the transducer that computes the Hamming weight of the width-w non-adjacent form digit expansion. The latter two turn out to be examples of asymptotic independence.

{0, 1, 3}-NAF Representation and Algorithms for Lightweight Elliptic Curve Cryptosystem in Lopez Dahab Model

Elliptic curve scalar multiplications is the most time-consuming and costly operation in elliptic curve cryptosystem. The scalar multiplication involves computation of Q = kP where k is a scalar multiplier, and P and Q are points on an elliptic curve. This computation can be improved by reducing the Hamming weight of the scalar multiplier k. The Hamming weight of k represents the number of nonzero digits in the scalar multiplier. This paper proposes a new scalar representation in non-adjacent form (NAF) using the digits 0, 1 and 3. This paper also proposes an algorithm for converting from a binary to {0,1,3}-NAF representation. Comparative analysis between the proposed NAF and the traditional NAF with digit {-1,0,1} is carried out. At average case, the proposes {0,1,3}-NAF representation has a lower Hamming weight than the traditional NAF. In our analysis, we use the {0,1,3}-NAF representation in the scalar multiplication operation. The average number of point addition operations in the scalar multiplication is considerably reduced compared to the addition-subtraction scalar multiplication algorithm.

Elliptic‐curve scalar multiplication algorithm using ZOT structure

AbstractThe computation of kP over elliptic curves is the dominant operation. It depends on the representation of the scalar k. The binary method is the standard unsigned method that is used to compute the elliptic‐curve (EC) point Q = kP. Researchers found that it is not the most efficient way for implementing EC computations. Other recoding methods such as complementary recoding (CR), nonadjacent form (NAF), and mutual opposite form (MOF) were presented in order to enhance the efficiency of EC computations. Our ZOTEC method that is based on ZOT recoding method was proposed to accelerate the EC computations. ZOTEC can be computed right‐to‐left or left‐to‐right. The recoding process is also faster than NAF and as fast as CR and MOF if the binary conversion is included or excluded. ZOTEC method is more efficient than BIN, CR, MOF, and NAF methods in terms of field complexity and time complexity whenever a field inversion is more expensive than six multiplications for BIN, CR, and MOF, and 8.3 for NAF. Copyright © 2014 John Wiley & Sons, Ltd.

Symmetric digit sets for elliptic curve scalar multiplication without precomputation

We describe a method to perform scalar multiplication on two classes of ordinary elliptic curves, namely E:y2=x3+Ax in prime characteristic p≡1mod4, and E:y2=x3+B in prime characteristic p≡1mod3. On these curves, the 4-th and 6-th roots of unity act as (computationally efficient) endomorphisms. In order to optimise the scalar multiplication, we consider a width-w-NAF (Non-Adjacent Form) digit expansion of positive integers to the complex base of τ, where τ is a zero of the characteristic polynomial x2−tx+p of the Frobenius endomorphism associated to the curve. We provide a precomputationless algorithm by means of a convenient factorisation of the unit group of residue classes modulo τ in the endomorphism ring, whereby we construct a digit set consisting of powers of subgroup generators, which are chosen as efficient endomorphisms of the curve.

Dynamic AES Extending the Lifetime?

AES (Advanced Encryption Standard) is a worldwide used standard for symmetric encryption and decryption. AES is for instance used in LTE (Long-Term Evolution) and in Wi-Fi. AES is based on operations of permutations and substitutions. Furthermore, AES is using a key scheduling algorithm. It has been proven that AES is vulnerable to side-channel attacks, related sub-key attacks and biclicque attacks. This paper introduces a new dynamic version of AES where the main flow is depending on the TNAF (τ-adic Non-Adjacent Form) value. This new approach can prevent side-channel attacks, related sub-key attacks and biclique attacks.

Some Explicit Formulae of NAF and its Left-to-Right Analogue Based on Booth Encoding

Non-Adjacent Form (NAF) is a canonical form of signed binary representa- tion of integers. Joye-Yen proposed a left-to-right analogue of NAF (FAN). It is known that NAF and FAN can be generated by applying a sliding window method with width-2 to the Booth encoding in right-to-left and left-to-right direction, respectively. In this arti- cle, we derive some properties of Booth encoding such as pattern, classication, extension, adjacency, and length. 1

Fixed-Base Comb with Window-Non-Adjacent Form (NAF) Method for Scalar Multiplication

Elliptic curve cryptography (ECC) is one of the most promising public-key techniques in terms of short key size and various crypto protocols. For this reason, many studies on the implementation of ECC on resource-constrained devices within a practical execution time have been conducted. To this end, we must focus on scalar multiplication, which is the most expensive operation in ECC. A number of studies have proposed pre-computation and advanced scalar multiplication using a non-adjacent form (NAF) representation, and more sophisticated approaches have employed a width-w NAF representation and a modified pre-computation table. In this paper, we propose a new pre-computation method in which zero occurrences are much more frequent than in previous methods. This method can be applied to ordinary group scalar multiplication, but it requires large pre-computation table, so we combined the previous method with ours for practical purposes. This novel structure establishes a new feature that adjusts speed performance and table size finely, so we can customize the pre-computation table for our own purposes. Finally, we can establish a customized look-up table for embedded microprocessors.

Analysis of the width-[formula omitted] non-adjacent form in conjunction with hyperelliptic curve cryptography and with lattices

In this work the number of occurrences of a fixed non-zero digit in the width-w non-adjacent forms of all elements of a lattice in some region (e.g. a ball) is analysed. As bases, expanding endomorphisms with eigenvalues of the same absolute value are allowed. Applications of the main result are on numeral systems with an algebraic integer as base. Those come from efficient scalar multiplication methods (Frobenius-and-add methods) in hyperelliptic curves cryptography, and the result is needed for analysing the running time of such algorithms.The counting result itself is an asymptotic formula, where its main term coincides with the full block length analysis. In its second order term a periodic fluctuation is exhibited. The proof follows Delange’s method.

Existence and optimality of w-non-adjacent forms with an algebraic integer base

We consider digital expansions in lattices with endomorphisms acting as base. We focus on the $w$-non-adjacent form ($w$-NAF), where each block of $w$ consecutive digits contains at most one non-zero digit. We prove that for sufficiently large $w$ and an expanding endomorphism, there is a suitable digit set such that each lattice element has an expansion as a $w$-NAF. If the eigenvalues of the endomorphism are large enough and $w$ is sufficiently large, then the $w$-NAF is shown to minimise the weight among all possible expansions of the same lattice element using the same digit system.

Optimality of the Width-w Non-adjacent Form: General Characterisation and the Case of Imaginary Quadratic Bases

Efficient scalar multiplication in Abelian groups (which is an important operation in public key cryptography) can be performed using digital expansions. Apart from rational integer bases (double-and-add algorithm), imaginary quadratic integer bases are of interest for elliptic curve cryptography, because the Frobenius endomorphism fulfils a quadratic equation. One strategy for improving the efficiency is to increase the digit set (at the prize of additional precomputations). A common choice is the width\nbd-$w$ non-adjacent form (\wNAF): each block of $w$ consecutive digits contains at most one non-zero digit. Heuristically, this ensures a low weight, i.e.\ number of non-zero digits, which translates in few costly curve operations. This paper investigates the following question: Is the \wNAF{}-expansion optimal, where optimality means minimising the weight over all possible expansions with the same digit set? The main characterisation of optimality of \wNAF{}s can be formulated in the following more general setting: We consider an Abelian group together with an endomorphism (e.g., multiplication by a base element in a ring) and a finite digit set. We show that each group element has an optimal \wNAF{}-expansion if and only if this is the case for each sum of two expansions of weight 1. This leads both to an algorithmic criterion and to generic answers for various cases. Imaginary quadratic integers of trace at least 3 (in absolute value) have optimal \wNAF{}s for $w\ge 4$. The same holds for the special case of base $(\pm 3\pm\sqrt{-3})/2$ and $w\ge 2$, which corresponds to Koblitz curves in characteristic three. In the case of $\tau=\pm1\pm i$, optimality depends on the parity of $w$. Computational results for small trace are given.

A Novel Elliptic Curve Scalar Multiplication Algorithm against Power Analysis

Nowadays, power analysis attacks are becoming more and more sophisticated. Through power analysis attacks, an attacker can obtain sensitive data stored in smart cards or other embedded devices more efficiently than with any other kind of physical attacks. Among power analysis, simple power analysis (SPA) is probably the most effective against elliptic curve cryptosystem, because an attacker can easily distinguish between point addition and point doubling in a single execution of scalar multiplication. To make elliptic curve scalar multiplication secure against SPA attacks, many methods have been proposed using special point representations. In this paper, a simple but efficient SPA-resistant multiscalar multiplication is proposed. The method is to convert the scalar into a nonadjacent form (NAF) representation at first and then constitute it in a new signed digit representation. This new representation is undertaken at a small precomputation cost, as each representation needs just one doubling and 1/2 additions for each bit. In addition, when combined with randomization techniques, the proposed method can also guard against differential power analysis (DPA) attack.

Cryptography with fast point multiplication by using ASCII codes and its implementation

This paper describes the point multiplication through addition-subtraction method and its implementation through MATLAB to speed up the operations in elliptic curve cryptography ECC with ASCII codes under limited hardware resources. To further decrease the computation time, we employed the non-adjacent form of a binary sequence to decrease the total number of additions in ECC encryption/decryption. This paper implements ASCII code table for convenient manipulation of characters, and addition-subtraction method for point multiplication with less time and space complexity with its implementation in MATLAB. We can fully use the idle time of hardware resources by relaxing the data dependency on those arithmetic operations performed to accomplish the point multiplication. As a result, hardware utilisation increases. ECC is the most applicable and suitable algorithm for mobile devices due to its compact shape and size.

A Fast Hardware Architecture for Integer to \tauNAF Conversion for Koblitz Curves

Scalar multiplication in elliptic curve cryptography is the most computational intensive operation. Efficiency of this operation can be significantly improved in hardware implementations by using Frobenius endomorphisms which require integer to <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">τ</sub> -adic nonadjacent form conversion. Because conversion is one of the limiting factors in some of Koblitz curve-based cryptosystems, it has become an interesting problem. In this paper, we propose two algorithms and a novel hardware architecture to double the speed of integer to <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">τ</sub> -adic nonadjacent form conversion.

Redundant τ-adic expansions I: non-adjacent digit sets and their applications to scalar multiplication

This paper investigates some properties of τ-adic expansions of scalars. Such expansions are widely used in the design of scalar multiplication algorithms on Koblitz curves, but at the same time they are much less understood than their binary counterparts. Solinas introduced the width-wτ-adic non-adjacent form for use with Koblitz curves. This is an expansion of integers $${z = \sum_{i=0}^\ell z_i \tau^i}$$, where τ is a quadratic integer depending on the curve, such that z i ? 0 implies z w+i-1 = . . . = z i+1 = 0, like the sliding window binary recodings of integers. It uses a redundant digit set, i.e., an expansion of an integer using this digit set need not be uniquely determined if the syntactical constraints are not enforced. We show that the digit sets described by Solinas, formed by elements of minimal norm in their residue classes, are uniquely determined. Apart from this digit set of minimal norm representatives, other digit sets can be chosen such that all integers can be represented by a width-w non-adjacent form using those digits. We describe an algorithm recognizing admissible digit sets. Results by Solinas and by Blake, Murty, and Xu are generalized. In particular, we introduce two new useful families of digit sets. The first set is syntactically defined. As a consequence of its adoption we can also present improved and streamlined algorithms to perform the precomputations in τ-adic scalar multiplication methods. The latter use an improvement of the computation of sums and differences of points on elliptic curves with mixed affine and Lopez---Dahab coordinates. The second set is suitable for low-memory applications, generalizing an approach started by Avanzi, Ciet, and Sica. It permits to devise a scalar multiplication algorithm that dispenses with the initial precomputation stage and its associated memory space. A suitable choice of the parameters of the method leads to a scalar multiplication algorithm on Koblitz Curves that achieves sublinear complexity in the number of expensive curve operations.

Efficient arithmetic on subfield elliptic curves over small finite fields of odd characteristic

In elliptic curve cryptosystems, scalar multiplications performed on the curves have much effect on the efficiency of the schemes, and many efficient methods have been proposed. In particular, recoding methods of the scalars play an important role in the performance of the algorithm used. For integer radices, the non-adjacent form (NAF) and its generalizations (e.g., the generalized non-adjacent form (GNAF) and the radix- r non-adjacent form ( r NAF)) have been proposed for minimizing the non-zero densities in the representations of the scalars. On the other hand, for subfield elliptic curves, the Frobenius expansions of the scalars can be used for improving efficiency. Unfortunately, there are only a few methods apply the techniques of NAF or its analogue to the Frobenius expansion, namely τ -adic NAF techniques on Koblitz curves and hyperelliptic Koblitz curves. In this paper, we try to combine these techniques, namely recoding methods for reducing non-zero density and the Frobenius expansion, and propose two new efficient recoding methods of scalars on more general family of subfield elliptic curves in odd characteristic. We also prove that the non-zero densities for the new methods are same as those for the original GNAF and r NAF. We estimate scalar multiplication costs on the above subfield elliptic curves in terms of elliptic curve operations and finite field operations for several previous methods and the proposed methods. In addition, we implement scalar multiplication on an subfield elliptic curve belonging to the above family, for the previous methods and a proposed method. As a result, our estimation and implementation show that the speed of the proposed methods improve between 8% and 50% over that for the Frobenius expansion method.