Twisted Edwards Curves Research Articles

Elliptic Curve Cryptography with Efficiently Computable Endomorphisms and Its Hardware Implementations for the Internet of Things

Verification of an ECDSA signature requires a double scalar multiplication on an elliptic curve. In this work, we study the computation of this operation on a twisted Edwards curve with an efficiently computable endomorphism, which allows reducing the number of point doublings by approximately 50 percent compared to a conventional implementation. In particular, we focus on a curve defined over the 207-bit prime field F <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">p</sub> with p = 2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">207</sup> - 5,131. We develop several optimizations to the operation and we describe two hardware architectures for computing the operation. The first architecture is a small processor implemented in 0.13 μm CMOS ASIC and is useful in resource-constrained devices for the Internet of Things (IoT) applications. The second architecture is designed for fast signature verifications by using FPGA acceleration and can be used in the server-side of these applications. Our designs offer various trade-offs and optimizations between performance and resource requirements and they are valuable for IoT applications.

Efficient Elliptic Curve Cryptography for Embedded Devices

Many resource-constrained embedded devices, such as wireless sensor nodes, require public key encryption or a digital signature, which has induced plenty of research on efficient and secure implementation of elliptic curve cryptography (ECC) on 8-bit processors. In this work, we study the suitability of a special class of finite fields, called optimal prime fields (OPFs), for a “lightweight” ECC implementation with a view toward high performance and security. First, we introduce a highly optimized arithmetic library for OPFs that includes two implementations for each finite field arithmetic operation, namely a performance-optimized version and a security-optimized variant. The latter is resistant against simple power analysis attacks in the sense that it always executes the same sequence of instructions, independent of the operands. Based on this OPF library, we then describe a performance-optimized and a security-optimized implementation of scalar multiplication on the elliptic curve over OPFs at several security levels. The former uses the Gallant-Lambert-Vanstone method on twisted Edwards curves and reaches an execution time of 3.14M cycles (over a 160-bit OPF) on an 8-bit ATmega128 processor, whereas the latter is based on a Montgomery curve and executes in 5.53M cycles.

On Reduced Computation Cost for Edwards and Extended Twisted Edwards Curves

Background: Scalar multiplication is having the scope for gaining the computational efficiency for Elliptic Curve Cryptography (ECC). The security strength and effectiveness have been better reported on shorter key lengths. Methods: The Edwards curves are one of the form used in cryptography is showing one of advanced study for generating the more randomness and unpredictability behaviors. The numbers of researchers have shown the significant improvement to solve the same problem on two, four and eight processors and that are contributing the immense contribution in the field of security. Findings: The manuscript solves the Edwards Curves and twisted Edwards Curves problems on four and eight processors based on reduced computation cost from to on four processors and to on 8-processors, respectively. Our generalized computation cost on 8-processors for -bit scalar multiplication is reporting better than the cost for Montgomery Ladder method and for extended twisted Edwards curves on radix-8. Applications: The operation is performing on input scalar which multiplies with point-coordinates on curve, which has accumulated on reduced clock cycles with resistance to the simple side channel attack.

Compression for trace zero points on twisted Edwards curves

Abstract We propose two optimal representations for the elements of trace zero subgroups of twisted Edwards curves. For both representations, we provide efficient compression and decompression algorithms. The efficiency of the algorithm is compared with the efficiency of similar algorithms on elliptic curves in Weierstrass form.

Elliptic curve with Optimal mixed Montgomery-Edwards model for low-end devices

This paper introduces a special family of twisted Edwards curve named Optimal mixed Montgomery-Edwards (OME) curves. The OME curve is proposed by exploiting the fact that every twisted Edwards curve is birationally equivalent to some elliptic curve in Montgomery form. The OME curves achieve optimal group arithmetic for both of twisted Edwards model and Montgomery model. In particular, the Montgomery model of OME curves only requires 3M + 2S and 1M + 3S + 3C to perform the point addition and point doubling operations, while 7M and 3M + 4S are needed for executing a point addition and point doubling for the twisted Edwards model of them. We also make effort to carefully choose the curve parameters and the underlying implementation field to achieve high performance. An example of OME curve is \(\mathcal{E}/\mathbb{F}_p : - x^2 + y^2 = 1 - 2782^2 \cdot x^2 y^2\) over p = 2192 − 264 − 1. Our implementation results on the widely used 8-bit micro-controller platforms (i.e., AVR Atmega128) further demonstrate and highlight the practical benefits of proposed OME curve on low-end device. In particular, our implementation, performed in constant-time, reduces the execution time by up to 14% and 18% for fixed point and random point scalar multiplication, respectively, when comparing with the state-of-the-art implementation on the identical platform.

Selecting elliptic curves for cryptography: an efficiency and security analysis

We select a set of elliptic curves for cryptography and analyze our selection from a performance and security perspective. This analysis complements recent curve proposals that suggest (twisted) Edwards curves by also considering the Weierstrass model. Working with both Montgomery-friendly and pseudo-Mersenne primes allows us to consider more possibilities which help to improve the overall efficiency of base field arithmetic. Our Weierstrass curves are backwards compatible with current implementations of prime order NIST curves, while providing improved efficiency and stronger security properties. We choose algorithms and explicit formulas to demonstrate that our curves support constant-time, exception-free scalar multiplications, thereby offering high practical security in cryptographic applications. Our implementation shows that variable-base scalar multiplication on the new Weierstrass curves at the 128-bit security level is about 1.4 times faster than the recent implementation record on the corresponding NIST curve. For practitioners who are willing to use a different curve model and sacrifice a few bits of security, we present a collection of twisted Edwards curves with particularly efficient arithmetic that are up to 1.42, 1.26 and 1.24 times faster than the new Weierstrass curves at the 128-, 192- and 256-bit security levels, respectively. Finally, we discuss how these curves behave in a real-world protocol by considering different scalar multiplication scenarios in the transport layer security protocol. The proposed curves and the results of the analysis are intended to contribute to the recent efforts towards recommending new elliptic curves for Internet standards.

Performance evaluation of twisted Edwards‐form elliptic curve cryptography for wireless sensor nodes

AbstractWireless sensor networks (WSNs) pose a number of unique security challenges that demand innovation in several areas including the design of cryptographic primitives and protocols. Despite recent progress, the efficient implementation of Elliptic Curve Cryptography (ECC) for WSNs is still a very active research topic, and techniques to further reduce the time and energy cost of ECC are eagerly sought. This paper presents an optimized ECC implementation that we developed from scratch to comply with the severe resource constraints of 8‐bit sensor nodes such as the MICAz and IRIS motes. Our ECC software uses Optimal Prime Fields as underlying algebraic structure and supports two different families of elliptic curves, namely, Weierstraß‐form and twisted Edwards‐form curves. Due to the combination of efficient field arithmetic and fast group operations, we achieve an execution time of 5.3·106 clock cycles for a full 160‐bit scalar multiplication on an 8‐bit ATmega128 microcontroller, which is more than three times faster than the widely used TinyECC library. Our implementation also shows that the energy cost of scalar multiplication on a MICAz (or IRIS) mote amounts to just 17.34mJ when using a twisted Edwards curve over a 160‐bit Optimal Prime Field. This result further demonstrates the advantage of special family of elliptic curves for resource‐constrained environments. Copyright © 2015 John Wiley &amp; Sons, Ltd.

New Regular Radix-8 Scheme for Elliptic Curve Scalar Multiplication without Pre-Computation

The recent advances in mobile technologies have increased the demand for high performance parallel computing schemes. In this paper, we present a new algorithm for evaluating elliptic curve scalar multiplication that can be used on any abelian group. We show that the properties of the proposed algorithm enhance parallelism at both the point arithmetic and the field arithmetic levels. Then, we employ this algorithm in proposing a new hardware design for the implementation of an elliptic curve scalar multiplication on a prime extended twisted Edwards curve incorporating eight parallel operations. We further show that in comparison to the other simple side-channel attack protected schemes over prime fields, the proposed design of the extended twisted Edwards curve is the fastest scalar multiplication scheme reported in the literature.

Cryptography on twisted Edwards curves over local fields

Twisted Edwards curves over finite fields have attracted great interest for their efficient and unified addition formula. In this paper, we consider twisted Edwards curves over local fields and introduce a cryptosystem based on quotient groups of twisted Edwards curves over local fields. From the study of formal groups of twisted Edwards curves and twisted Edwards curves over local fields, we give the choice of cryptographic groups. An element in these groups can be uniformly represented by two n digit p-adic numbers, whereas an element in the elliptic curves in Weierstrass form over local fields is represented by a 3 n -2 digit p-adic number and a 4 n -3 digit p-adic number. In the cryptography on elliptic curves in Weierstrass form over local fields, five cases for different input point pairs in computing points addition have to be considered and sometimes points have to be lifted. In the cryptography on twisted Edwards curves over local fields, the addition formula is simple, unified, and complete, which is efficient, does not need lifting points, and is against the side channel analysis. Finally, a speedy point multiplication algorithm and some concrete instances are given.

Scalar multiplication for twisted Edwards curves using the extended double-base number system

Scalar multiplication for twisted Edwards curves using the extended double-base number system

Using Symmetries in the Index Calculus for Elliptic Curves Discrete Logarithm

In 2004, an algorithm is introduced to solve the DLP for elliptic curves defined over a non-prime finite field \(\mathbb{F}_{q^{n}}\). One of the main steps of this algorithm requires decomposing points of the curve \(E(\mathbb{F}_{q^{n}})\) with respect to a factor base, this problem is denoted PDP. In this paper, we will apply this algorithm to the case of Edwards curves, the well-known family of elliptic curves that allow faster arithmetic as shown by Bernstein and Lange. More precisely, we show how to take advantage of some symmetries of twisted Edwards and twisted Jacobi intersections curves to gain an exponential factor 2ω(n−1) to solve the corresponding PDP where ω is the exponent in the complexity of multiplying two dense matrices. Practical experiments supporting the theoretical result are also given. For instance, the complexity of solving the ECDLP for twisted Edwards curves defined over \(\mathbb{F}_{q^{5}}\), with q≈264, is supposed to be ∼ 2160 operations in \(E(\mathbb{F}_{q^{5}})\) using generic algorithms compared to 2130 operations (multiplications of two 32-bits words) with our method. For these parameters the PDP is intractable with the original algorithm.The main tool to achieve these results relies on the use of the symmetries and the quasi-homogeneous structure induced by these symmetries during the polynomial system solving step. Also, we use a recent work on a new algorithm for the change of ordering of a Gröbner basis which provides a better heuristic complexity of the total solving process.

The Pairing Computation on Edwards Curves

We propose an elaborate geometry approach to explain the group law on twisted Edwards curves which are seen as the intersection of quadric surfaces in place. Using the geometric interpretation of the group law, we obtain the Miller function for Tate pairing computation on twisted Edwards curves. Then we present the explicit formulae for pairing computation on twisted Edwards curves. Our formulae for the doubling step are a little faster than that proposed by Arène et al. Finally, to improve the efficiency of pairing computation, we present twists of degrees 4 and 6 on twisted Edwards curves.

Isomorphism classes of Edwards curves over finite fields

Edwards curves are an alternate model for elliptic curves, which have attracted notice in cryptography. We give exact formulas for the number of Fq-isomorphism classes of Edwards curves and twisted Edwards curves. This answers a question recently asked by R. Farashahi and I. Shparlinski.

Two kinds of division polynomials for twisted Edwards curves

This paper presents two kinds of division polynomials for twisted Edwards curves. Their chief property is that they characterise the n-torsion points of a given twisted Edwards curve. We present recursions for the division polynomials, which differ in their flavour. We prove a uniqueness form for elements of the function field of an Edwards curve. We also present results concerning the coefficients of these polynomials, which may aid computation.