Short Weierstrass Research Articles

Exp function for Edwards curves over local fields

We extend the map Exp for elliptic curves in short Weierstrass form over $ \mathbb{C} $ to Edwards curves over local fields. Subsequently, we compute the map Exp for Edwards curves over the local field $ \mathbb{Q}_{p} $ of $ p $-adic numbers.

A Novel JSF-Based Fast Implementation Method for Multiple-Point Multiplication

ECC is a popular public-key cryptographic algorithm, but it lacks an effective solution to multiple-point multiplication. This paper proposes a novel JSF-based fast implementation method for multiple-point multiplication. The proposed method requires a small storage space and has high performance, making it suitable for resource-constrained IoT application scenarios. This method stores and encodes the required coordinates in the pre-computation phase and uses table lookup operations to eliminate the conditional judgment operations in JSF-5, which improves the efficiency by about 70% compared to the conventional JSF-5 in generating the sparse form. This paper utilizes Co-Z combined with safegcd to achieve low computational complexity for curve coordinate pre-computation, which further reduces the complexity of multiple-point multiplication in the execution phase of the algorithm. The experiments were performed with two short Weierstrass elliptic curves, nistp256r1 and SM2. In comparison to the various CPU architectures used in the experiments, our proposed method showed an improvement of about 3% over 5-NAF.

A Comparative Analysis of the Computation Cost and Energy Consumption of Relevant Curves of ECC Presented in Literature

With the Internet of Things (IoT) becoming expo-nentially more prevalent, the need for lightweight cryptography functions increases simultaneously. Namely, IoT end devices are mostly limited by their resource-constrained capabilities and therefore cannot rely on heavyweight cryptographic algorithms such as Rivest-Shamir-Adleman (RSA) or Diffie-Hellman (DH) for security. Elliptic Curve Cryptography (ECC) offers a more lightweight alternative by being based on a mathematical prob-lem named the Elliptic Curve Discrete Logarithm Problem (ECDLP) which is not known to be solvable in sub-exponential time. Within the field of ECC, many different curve types exist following various standards for this protocol. In this paper, the energy consumption and time consumption for key generation, encryption, and decryption are measured within the ElGamal protocol using ECC for the various curves. To measure this, a Raspberry Pi 4B and a Personal Computer are used to conclude the disproval of the hypothesis that the Twisted Edwards curve performs most efficient to achieve its security strength. Namely, Brainpool curves function most efficient within this benchmark, after which Short Weierstrass curves follow. Moreover, it is concluded the performance pattern for both data processors and data providers is equal to each other for all message sizes.

Quadratic fields admitting elliptic curves with rational j-invariant and good reduction everywhere

Clemm and Trebat-Leder (2014) proved that the number of quadratic number fields with absolute discriminant bounded by x over which there exist elliptic curves with good reduction everywhere and rational j-invariant is ≫xlog−12⁡(x). In this paper, we assume the abc-conjecture to show the sharp asymptotic ∼cxlog−12⁡(x) for this number, obtaining formulae for c in both the real and imaginary cases. Our method has three ingredients:(1)We make progress towards a conjecture of Granville: Given a fixed elliptic curve E/Q with short Weierstrass equation y2=f(x) for reducible f∈Z[x], we show that the number of integers d, |d|≤D, for which the quadratic twist dy2=f(x) has an integral non-2-torsion point is at most D23+o(1), assuming the abc-conjecture.(2)We apply the Selberg–Delange method to obtain a Tauberian theorem which allows us to count integers satisfying certain congruences while also being divisible only by certain primes.(3)We show that for a polynomially sparse subset of the natural numbers, the number of pairs of elements with least common multiple at most x is O(x1−ϵ) for some ϵ>0. We also exhibit a matching lower bound. If instead of the abc-conjecture we assume a particular tail bound, we can prove all the aforementioned results and that the coefficient c above is greater in the real quadratic case than in the imaginary quadratic case, in agreement with an experimentally observed bias.

Evaluation of Computational Approaches of Short Weierstrass Elliptic Curves for Cryptography

Abstract The survey presents the evolution of Short Weierstrass elliptic curves after their introduction in cryptography. Subsequently, this evolution resulted in the establishment of present elliptic curve computational standards. We discuss the chronology of attacks on Elliptic Curve Discrete Logarithm Problem (ECDLP) and investigate their countermeasures to highlight the evolved selection criteria of cryptographically safe elliptic curves. Further, two popular deterministic and random approaches for selection of Short Weierstrass elliptic curve for cryptography are evaluated from computational, security and trust perspectives and a trend in existent computational standards is demonstrated. Finally, standard and non-standard elliptic curves are analysed to add a new insight into their usability. There is no such survey conducted in past to the best of our knowledge.

Implementation of Elliptic Net Scalar Multiplication Computation for NIST P-192 Curve using Python

Elliptic curve cryptography is one of the most efficient public-key cryptosystems compared to the Rivest-Shamir-Addleman scheme. One of the methods to compute elliptic curve scalar multiplication is division polynomials which utilize the non-linear recurrence relation also known as the elliptic net. Previous studies were related to elliptic curve scalar multiplication via elliptic net which implemented the use of C++, GP/PARI or Java programming. This study aims to implement the Python programming in the SageMath compiler for computing elliptic net scalar multiplication based on the National Institute of Standards and Technology curve of the type P-192. The implementation could be seen at three main processes which are the scalar decomposition, the blocks of elliptic net generation namely the initial and final blocks, as well as scalar multiplication computation. The base point and prime field of the short Weierstrass curve with a large scalar are the parameters used in the process. The results showed that the implemented programming was easier while working with a large prime number field, vulnerable to errors and can be easily verified. The implemented programming can also be used to compute scalar multiplication on other standardizations of elliptic curve cryptography such as Brainpool 384-bit prime field or NUMS 256-bit prime field curves.

Computation of Trusted Short Weierstrass Elliptic Curves for Cryptography

Abstract Short Weierstrass elliptic curves with underlying hard Elliptic Curve Discrete Logarithm Problem (ECDLP) are widely used in cryptographic applications. A notion of security called Elliptic Curve Cryptography (ECC) security is also suggested in literature to safeguard the elliptic curve cryptosystems from their implementation flaws. In this paper, a new security notion called the “trusted security” is introduced for computational method of elliptic curves for cryptography. We propose three additional “trusted security acceptance criteria” which need to be met by the elliptic curves aimed for cryptography. Further, two cryptographically secure elliptic curves over 256 bit and 384 bit prime fields are demonstrated which are secure from ECDLP, ECC as well as trust perspectives. The proposed elliptic curves are successfully subjected to thorough security analysis and performance evaluation with respect to key generation and signing/verification and hence, proven for their cryptographic suitability and great feasibility for acceptance by the community.

Construction of metrics on the set of elliptic curves over a finite field

We consider metrics on the set of elliptic curves in short Weierstrass form over a finite field of characteristic greater than three. The metrics have been first found by Mishra and Gupta (2008). Vetro (2011) constructs other metrics which are independent on the choice of a generator of the multiplicative group of the underlying finite field, whereas the metrics found by Mishra and Gupta, are dependent on the choice of a generator of the multiplicative group of the underlying finite field. Hakuta (2015, 2018) constructs metrics on the set of non-supersingular elliptic curves in shortWeierstrass form over a finite field of characteristic two and three, respectively. The aim of this paper is to point out that the metric found by Mishra and Gupta is in fact not a metric. We also construct new metrics which are slightly modified versions of the metric found by Mishra and Gupta.

Faster Montgomery and double-add ladders for short Weierstrass curves

The Montgomery ladder and Joye ladder are well-known algorithms for elliptic curve scalar multiplication with a regular structure. The Montgomery ladder is best known for its implementation on Montgomery curves, which requires 5M+4S+1m+8A per scalar bit, and 6 field registers. Here (M, S,m,A) represent respectively field Multiplications, Squarings, multiplications by a curve constant, and Additions or subtractions. This ladder is also complete, meaning that it works on all input points and all scalars. Many protocols do not use Montgomery curves, but instead use prime-order curves in short Weierstrass form. These have historically been much slower, with ladders costing at least 14 multiplications or squarings per bit: 8M + 6S + 27A for the Montgomery ladder and 8M+ 6S + 30A for the Joye ladder. In 2017, Kim et al. improved the Montgomery ladder to 8M+ 4S + 12A + 1H per bit using 9 registers, where the H represents a halving. Hamburg simplified Kim et al.’s formulas to 8M+ 4S + 8A + 1H per bit using 6 registers. Here we present improved formulas which compute the Montgomery ladder on short Weierstrass curves using 8M+ 3S + 7A per bit, and requiring 6 registers. We also give formulas for the Joye ladder that use 9M+3S+7A per bit, requiring 5 registers. One of our new formulas supports very efficient 4-way vectorization. We also discuss curve invariants, exceptional points, side-channel protection and how to set up and finish these ladder operations. Finally, we show a novel technique to make these ladders complete when the curve order is not divisible by 2 or 3, at a modest increase in cost. A sample implementation of these techniques is given in the supplementary material, also posted at https://github.com/bitwiseshiftleft/ladder_formulas

Faster Montgomery and double-add ladders for short Weierstrass curves

Faster Montgomery and double-add ladders for short Weierstrass curves

Uniform encodings to elliptic curves and indistinguishable point representation

Many cryptographic protocols which are based on elliptic curves require to efficiently encode bit-strings into the points of a given elliptic curve such that the encoding function satisfies computability, regularity, and samplability, or generally admissibility. All the admissible encoding functions from the finite field $$\mathbb {F}_q$$ are restricted to the class of elliptic curves with a non-trivial l-torsion $$\mathbb {F}_q$$ -rational point, where $$l\in \{2,3\}$$ . Therefore, there is no admissible encoding function to the class of many cryptographically interesting elliptic curves of prime order. In this paper, we present an admissible 2:1 encoding function from the set $$\{0,1,\ldots , \frac{q-1}{2}\}$$ to the $$\mathbb {F}_q$$ -rational points of arbitrary elliptic curves. We also propose an injective encoding function to elliptic curves with a non-trivial $$\mathbb {F}_q$$ -rational point of order two, that acts the same as the Bernstein et al.’s injective encoding function. Conversely, occasionally we have to transmit points of a known curve through an insecure channel. Traditional methods for transferring points enable an adversary to recognize patterns in the transmitted data. Consequently, one finds valuable information to attack the cryptosystem using the network traffic. By the help of the inverse of the injective encoding functions, Bernstein et al. introduced an interesting solution to this problem, namely Elligator. In this paper, we present an indistinguishable elliptic curve point representation using our given encoding function, which unlike the previous well-known encoding functions is not injective but covers almost all of elliptic curves over odd characteristic finite fields. Indeed, since we proposed a 2:1 encoding function to elliptic curves in short Weierstrass form, we have to select one pre-image randomly and transmit its corresponding bit-string instead of the point.

Speeding up regular elliptic curve scalar multiplication without precomputation

This paper presents a series of Montgomery scalar multiplication algorithms on general short Weierstrass curves over fields with characteristic greater than 3, which need only 12 field multiplications per scalar bit using 8 $ \sim $ 9 field registers, thus outperform the binary NAF method on average. Over binary fields, the Montgomery scalar multiplication algorithm which was presented at the first CHES workshop by López and Dahab has been a favorite of ECC implementors, due to its nice properties such as high efficiency (outperforming the binary NAF), natural SPA-resistance, generality (coping with all ordinary curves) and implementation easiness. Over odd characteristic fields, the new scalar multiplication algorithms are the first ones featuring all these properties. Building-blocks of our contribution are new efficient differential addition-and-doubling formulae and a novel conception of on-the-fly adaptive coordinates which varies in accordance with not only the base point but also the bits of the given scalar.

Scalar Multiplication via Elliptic Net using Generalized Equivalent Sequences

Chord and tangent is a classical method to calculate the elliptic curve scalar multiplication. Alternatively, the scalar multiplication can be calculated by dividing polynomials over certain finite fields and the first elliptic net scalar multiplication was implemented on a short Weierstrass curve. The net was originated from non-linear recurrence sequences, namely as elliptic divisibility sequence. It is well known that the linear recurrence sequences have been applied in the cryptosystem as a cipher in the encryption and decryption process. From the perspective of cryptographic application, the elliptic divisibility sequence is used generally for integer factorization, solving elliptic curve discrete logarithm problem and computation of pairing or scalar multiplication. But there is a lack of contribution of these non-linear recurrence sequences in scalar multiplication. Therefore, this paper aims to discuss a generalization of the equivalent sequence of elliptic divisibility for computing scalar multiplication. The experimental results of scalar multiplication via the net and its coding in computer programming are presented. The future direction of scalar multiplication via the elliptic net is also discussed.

High-Speed Implementation of ECC Scalar Multiplication in GF(p) for Generic Montgomery Curves

Elliptic curve-based cryptography (ECC) has become the automatic choice for public key cryptography due to its lightweightness compared to Rivest–Shamir–Adleman (RSA). The most important operation in ECC is elliptic curve scalar multiplication, and its efficient implementation has gathered significant attention in the research community. Fast implementation of ECC scalar multiplication is often desired for speed-critical applications such as runtime authentication in automated cars, web server certification, and so on. Such fast architectures are achieved by implementing ECC scalar multiplication in fields with pseudo-Mersenne prime or Solinas prime. In this paper, we aim to implement a fast implementation of ECC scalar multiplication for any generic Montgomery curve in Galois Field in p [GF(p)] without having the constraint of using any specialized modulus. We will show that the proposed ECC scalar multiplication architecture is as fast as scalar multiplication in special curves like Curve25519, albeit with little area overhead. The proposed architecture can be modified to support ECC scalar multiplication in both Montgomery and short Weierstrass curves.

Secure elliptic curves and their performance

Elliptic Curve Cryptography (ECC) is a branch of public-key cryptography based on the arithmetic of elliptic curves. In the short life of ECC, most standards have proposed curves defined over prime finite fields satisfying the curve equation in the short Weierstrass form. However, some researchers have started to propose as a securer alternative the use of Edwards and Montgomery elliptic curves, which could have an impact in current ECC deployments. This contribution evaluates the performance of the three types of elliptic curves using some of the examples provided by the initiative SafeCurves and a Java implementation developed by the authors, which allows us to offer some conclusions about this topic.

Distance functions on the sets of ordinary elliptic curves in short Weierstrass form over finite fields of characteristic three

Abstract We study distance functions on the set of ordinary (or non-supersingular) elliptic curves in short Weierstrass form (or simplified Weierstrass form) over a finite field of characteristic three. Mishra and Gupta (2008) firstly construct distance functions on the set of elliptic curves in short Weierstrass form over any prime field of characteristic greater than three. Afterward, Vetro (2011) constructs some other distance functions on the set of elliptic curves in short Weierstrass form over any prime field of characteristic greater than three. Recently, Hakuta (2015) has proposed distance functions on the set of ordinary elliptic curves in short Weierstrass form over any finite field of characteristic two. However, to our knowledge, no analogous result is known in the characteristic three case. In this paper, we shall prove that one can construct distance functions on the set of ordinary elliptic curves in short Weierstrass form over any finite field of characteristic three. A cryptographic application of our distance functions is also discussed.

An optimal Tate pairing computation using Jacobi quartic elliptic curves

This research paper proposes new explicit formulas to compute the Tate pairing on Jacobi quartic elliptic curves. We state the first geometric interpretation of the group law on Jacobi quartic curves by presenting the functions which arise in the addition and doubling. We draw together the best possible optimization that can be used to efficiently evaluate the Tate pairing using Jacobi quartic curves. They are competitive with all published formulas for Tate pairing computation using Short Weierstrass or Twisted Edwards curves. Finally we present several examples of pairing-friendly Jacobi quartic elliptic curves which provide optimal Tate pairing.

Using Montgomery curve arithmetic over F2p for point scalar multiplication on short Weierstrass curve over Fp with exactly one 2-torsion point and order not divisible by 4

Montgomery curves are well known because of their efficiency and side channel attacks vulnerability. In this article it is showed how Montgomery curve arithmetic may be used for point scalar multiplication on short Weierstrass curve ESW over Fp with exactly one 2-torsion point and #ESW (Fp) not divisible by 4. If P ∈ ESW (Fp) then also P ∈ ESW (Fp2). Because ESW (Fp2) has three 2-torsion points (because ESW (Fp) has one 2-torsion point) it is possible to use 2-isogenous Montgomery curve EM (Fp2) to the curve ESW (Fp2) for counting point scalar multiplication on ESW (Fp). However arithmetic in (Fp2) is much more complicated than arithmetic in Fp, in hardware implementations this method may be much more useful than standard methods, because it may be nearly 45% faster.

SOME REMARKS ON A DISTANCE BETWEEN TWO ORDINARY ELLIPTIC CURVES OVER THE FINITE FIELD F_{2^5}

Rishivarman and Parthasarathy (2013) have constructed a map from the direct product of two copies of the set of ordinary elliptic curves with short Weierstrass equation over F25 to non-negative real numbers (plus infinity), and they have claimed that the map is a metric. In this paper we point out that the proof of the claim contains several flaws. Even worse, we shall show that the map is not a metric.

Faster Point Scalar Multiplication on Short Weierstrass Elliptic Curves over Fp using Twisted Hessian Curves over Fp2

This article shows how to use fast Fp2 arithmetic and twisted Hessian curves to obtain faster point scalar multiplication on elliptic curve ESW in short Weierstrass form over Fp. It is assumed that p and #ESW(Fp) are different large primes, #E(Fq) denotes number of points on curve E over field Fq and #Et SW (Fp) Fp), where Et is twist of E, is divisible by 3. For example this method is suitable for two NIST curves over Fp: NIST P-224 and NIST P-256. The presented solution may be much faster than classic approach. Presented solution should also be resistant for side channel attacks and information about Y coordinate should not be lost (using for example Brier-Joye ladder such information may be lost). If coefficient A in equation of curve ESW : y2 =x3+Ax+B in short Weierstrass curve is not of special form, presented solution is up to 30% faster than classic approach. If A=−3, proposed method may be up to 24% faster.