Parallelized Side-Channel Attack Resisted Scalar Multiplication Using q-based Addition-Subtraction k-chains

Transcription

1 Parallelized Side-Channel Atta Resisted Salar Multipliation Using -Based Addition-Subtration -hains Kittiphop Phalaarn Department of Computer Engineering Chulalongorn University Kittiphon Phalaarn Department of Computer Engineering Chulalongorn University Vorapong Suppaitpaisarn Department of Computer Siene The University of Toyo Abstrat This paper presents parallel salar multipliation tehniues for ellipti urve ryptography using -based additionsubtration -hain whih an also effetively resist side-hannel atta. Many tehniues have been disussed to improve salar multipliation, for example, double-and-add, NAF, w-naf, addition hain and addition-subtration hain. However, these tehniues annot resist side-hannel atta. Montgomery ladder, random w-naf and uniform operation tehniues are also widely used to prevent side-hannel atta, but their operations are not effiient enough omparing to those with no side-hannel atta prevention. We have found a new way to use -hain for this purpose. In this paper, we extend the definition of -hain to -based addition-subtration -hain and modify an algorithm proposed by Jarvinen et al. to generate the -based additionsubtration -hain. We show the upper and lower bounds of its length whih lead to the omputation time using the new hain tehniues. The hain tehniues are used to redue the ost of salar multipliation in parallel ways. Comparing to w- NAF, whih is faster than double-and-add and Montgomery ladder tehniue, the maximum omputation time of our - based addition-subtration -hain tehniues an have up to 5.9% less addition osts using only 3 parallel omputing ores. We also disuss on the optimization for multiple operand point addition using hybrid-double multiplier whih is proposed by Azarderahsh and Reyhani-Masoleh. The proposed parallel hain tehniues an also tolerate side-hannel atta effiiently. eywords Information and Communiation Seurity; Effiient Implementations; Parallel Algorithms; Ellipti Curve Cryptography; Salar Multipliation; -Chain; Side-Channel Atta Countermeasure I. INTRODUCTION Today s ryptosystem reuires faster omputation for more seurity. The ost of salar multipliation is very important for ellipti urve ryptography. Many wors try to derease this alulation ost, for example, double-and-add tehniue f. [] whih uses simple binary representation. It an be alulated faster using NAF [] and w-naf [3] tehniue. NAF tehniue uses binary representation with digit set {, 0, } and w-naf representation uses larger digit set. Another tehniue used today is wr-naf [4] whih generalizes w-naf using base r representation. There is another ind of tehniues whih is different from double-and-add. Addition hain f. [5] and additionsubtration hain a/s hain [6] tehniues are used for the This paper has been aepted for publiation at proeedings of the Fourth International Symposium on Computing and Networing CANDAR 06, whih is published by IEEE. It has been further edited by IEEE, and the final version is appearing at same purpose as the general ases for double-and-add and NAF [7], [8]. There are many variations on the addition hain and a/s hain suh as addition-multipliation hain [9], - addition hain [0] and -hain []. Currently, -hain is only used to improve finite field element inversion [] and we are interested in using this -hain to improve salar multipliation. One important problem for salar multipliation is sidehannel atta. The power used in eah alulation step an be measured and give information on whih type of operation is being alulated. This is alled power atta []. Time of eah omputation step an also be measured for the same purpose. The latter atta is alled timing atta [3]. The seuenes of the monitored operations an tell whih salar has been used to multiply. The multipliation tehniues mentioned earlier are not tolerate side-hannel atta. Some studies try to add some random dummy operations to hide the real power and time used, but these operations inrease the alulation osts whih are now lose to the worst ase of eah tehniue. Montgomery ladder [4], random w-naf [5] and uniform operation tehniues [6] are widely used to prevent side-hannel atta, but their operations are not effiient enough omparing to those with no side-hannel atta prevention. A. Contribution of this paper To effiiently resist the side-hannel atta, we have found a new way to use -hain for salar multipliation. In this paper, we generalize the definition of -hain to addition-subtration -hain a/s -hain and -based addition-subtration -hain -based a/s -hain. We modify the algorithm from [] to generate the -based a/s -hain. From the algorithms, we found that summation of all digits in the number representation affets the length of the hain. This summation is alled relaxed ost [7]. We use the relaxed redued representation s properties from [7] to prove the theorem of the maximum relaxed ost of the representation. This leads to the upper and lower bounds of the hain s length and the worst ase of the omputation time for salar multipliation using -based a/s -hain tehniue. We propose a parallel tehniue of -based a/s 4-hain and generalize to -based a/s -hain for any positive integers and greater than. We also propose an optimization tehniue for multiple operand point addition for twisted

2 Edwards urves [8] by using hybrid-double multiplier [9], [0]. We ompare eah tehniue using worst ase omputation time due to the properties of side-hannel atta. Comparing to the best w-naf with w = 5 [4], whih is faster than doubleand-add and Montgomery ladder tehniue, the maximum omputation time of our -based addition-subtration -hain tehniue using 8-bit salar is slightly smaller with omputing ores. For large salar, our hain tehniue an have up to 5.9% less additions using only 3 parallel omputing ores, but if using omputing ores, our tehniue an have up to.% more additions. Finally, we disuss on the appropriate value of in -based a/s -hain and have some seurity analysis of the proposed hain tehniues on side-hannel atta. B. Paper Organization The paper is strutured as follows: In Setion II, we present some previous wors on this topi, inluding relaxed redued representation, -hain, double-and-add tehniue, w-naf tehniue and how to alulate the ost of salar multipliation. In Setion III, we give definitions on a/s -hain and -based a/s -hain. We also modify the -hain algorithm to generate -based a/s -hain. In Setion IV, we prove the maximum relaxed ost of signed digit representations and propose a theorem on the upper and lower bounds of -based a/s -hain length. This theorem leads us to the omputation time using the hain tehniues. In Setion V, we propose some parallel tehniues and give an optimization on multiple operand point addition using hybrid-double multiplier [9], [0]. We ompare the osts of our tehniues in Setion VI and ompare to other well-nown tehniues, w-naf and Montgomery ladder. In the same setion, we also disuss on the value of and give some seurity analysis of the proposed hain tehniues on side-hannel atta. Finally, we onlude our paper in Setion VII. II. PRELIMINARIES In this setion, we present some previous wors, inluding relaxed redued representation [7], -hain [], double-andadd tehniue f. [] and w-naf tehniue [3] for salar multipliation. A. Relaxed Redued Representation We use the definitions and theorems from [7], and we will fous on relaxed ost beause they are more ompatible with our appliations. Definition set of all representations [7]. The set of all representations of an integer n in base is defined as { R n := ε = ε 0,..., ε l l N, ε i Z, ε l 0, n = } l ε i i and for eah ε R n, l is alled the length of the representation ε and written as ε. Example. Given n = 5 and = 4, we have some representations 3, 3 4,, 0, 4,, 4 R 4 5 with length, and, respetively. Definition 3 relaxed ost of the representation [7]. The relaxed ost of representation ε R n is defined as ε = ε 0,..., ε l := l ε i. Definition 4 relaxed redued representation. The representation ε R n is relaxed redued if ε arg min ε. ε R n Example 5. From Example, the relaxed osts of the example representations are 6, and, respetively. It is easy to see that, 0, 4 is relaxed redued representation of R 4 5. Definition 6 redution rules [7]. Given ε R n, f : R n R n is defined as follows. The rules are applied in this order at the first ourrene from the left side until ε first hanges and return the result. If there is no math, fε = ε. For η 0 >, η η Z, and u := 0 : η 0, η η 0 u signη 0, η + u signη 0. For η 0 < 0 and :, η 0, η 0 +. For η 0 > 0 and :, η 0, η 0. For η 0 < and :,, η 0 For < η 0 and :,, η 0, +, η 0 +.,, η 0. Theorem 7 [7]. The redution rules an be applied to the representation ε R n many times until there is no hange. The representation ε is relaxed redued if and only if fε = ε. Theorem 8 Average Relaxed Cost of Relaxed Redued Representation [7]. Given positive integer m and base, the average relaxed ost of the relaxed redued representations of the integer 0,..., m is m ε R i m = m + O if, m + O if. Algorithm has been proposed in [7] to generate relaxed redued representation of an integer.

3 Algorithm [7] generating base relaxed redued representation of positive integer n Input: n > 0, Output: relaxed redued representation ε R n : ε : m n 3: while m > 0 do 4: a m mod 5: if a > / or a = / and m mod / then 6: a a 7: end if 8: m m a/ 9: onatenate a to the right end of ε 0: end while : return ε To generate redued representation the relaxed redued representation with the shortest length, hange the ondition in the if statement in line 5 to not a < / or a = / and m mod < / or m = + / or m = / + /. B. -Chain We give the definition of -hain from []. Previous wors on addition hain, a/s hain and -hain an be found in [5], [6], []. Definition 9 -hain []. Given positive integer and n, a -hain for n is defined as v = [v0,..., vs] with v0 =, vs = n, and vi = h=0 vi h for all 0 < i s and i h < i with v = 0. The length of the hain is eual to s. The algorithm for generating -hain from traditional base representation is given in [] and we show it below. The same paper also proved the upper and lower bounds of the length of the optimal -hain by using the given algorithm. We state it in Theorem 0. Remar: At line 3 of Algorithm, the length of the output -hain will be the same regardless to the order of x i being hosen. Theorem 0 bound of -hain s length []. Given positive integers and n, The upper and lower bounds of the optimal length s of -hain for n are ε log n s log n + where ε R n is a traditional base representation, i.e., using digit set {0,,..., }. C. Current Tehniues on Salar Multipliation To alulate np from the given integer n and ellipti urve point P, the most simple tehniue used is double-and-add f. []. Assume that we have the traditional binary representation Algorithm [] Algorithm for generating -hain for integer n Input:, n = l n i i = n 0,..., n l traditional representation Output: -hain for n : vi i for 0 i l : j 0 3: for all x i 0 in x = {n 0, n,..., n l, n l } do 4: t j, t j+,..., t j+ xi i,...i 5: j j + x i 6: end for 7: t j, t j+,..., t j/,,..., 8: for i = 0 to j/ do 9: vl + i + vl + i + vt i+ + vt i++ 0: + + vt i++ : end for : return v of n, n 0,..., n l, we an ompute np from n l P + n l P + + n 0 P Example. The binary representation of 0 is 0,, 0,. Thus, we an alulate 0P from P +0P +P +0P. To see the alulation ost of this tehniue, we define the ost of point doubling as D and point addition as A. Given positive integer n and traditional binary representation ε R n, the ost for salar multipliation with double-and-add tehniue is defined as Cost n,double = D ε + A ε. Remar: For twisted Edwards urves [8], whih is the urrent fastest urve, the ost for point addition A is now reorded at M where M is the ost for field elements multipliation. The ost for point doubling D is reorded at 7M. Given n as an m-bit integer where m := log n +, We define average and maximum osts for salar multipliation as follows. Avg m,tehniue = m Cost i,tehniue m Max m,tehniue = max 0 i m Cost i,tehniue Given a positive integer n with m bits, the length of its binary representation is exatly m. From Subsetion II-A, we have average relaxed ost euals to m + O and it is easy to see that the maximum relaxed ost euals to m + O. Thus, the final average and maximum osts for double-andadd tehniue are Avg m,double = D m + A m + O, Max m,double = D m + A m + O. Another tehniue widely used is w-naf tehniue. The w-naf tehniue was introdued in [3] and generalized to wr-naf in [4]. The paper stated that given the window size

4 r wr + w and base r, the nonzero density of the base r representation is and the number of points that have to be preomputed is rw r w. It is easy to see that the worst ase for nonzero density is w. With wr-naf, we use number of nonzero digits instead of relaxed ost. To alulate np, we define m := log n +. The average and maximum osts for wr-naf tehniue are similar to those for double-and-add and an be written as follows. Avg m,wr-naf = R m log r r m +A wr + log r + rw r w Max m,wr-naf = R m log r + A m w log r + rw r w, when R is the alulation ost for multiplying the point by r. III. -BASED ADDITION-SUBTRACTION -CHAIN We generalize the definition of -hain to a/s -hain and we will extend the definition to -based a/s -hain. Definition addition-subtration -hain. Given positive integer and n, an addition-subtration -hain a/s -hain for n is defined as v = [v0,..., vs] with v0 =, vs = n, and vi = h=0 ±vi h for all 0 < i s and i h < i with v = 0. Example 3. An a/s 3-hain for 8 is [, 3, 9, 8] 3 beause 3 = v+v+v = ++, 9 = v+v+v = and 8 = v3 v + v = Other examples are [, 3, 7, 8] 3 and [,, 6, 0, 8] 3. Definition 4 -based addition-subtration -hain. An addition-subtration -hain v is a -based additionsubtration -hain -based a/s -hain, if and only if, and there exists an integer j suh that for all 0 < i j, vi = i. The [v0,..., vj] part is alled power part and [vj +,..., vs] part is alled addition part. Example 5. A -based a/s 3-hain for 0 is [,, 4, 8, 0] 3. The power part is [,, 4, 8] 3 = [ 0,,, 3 ] 3 and the addition part is [0] 3 where 0 = v3 + v + v = Other examples are [,, 4, 0] 3, [,, 3, 9, 0] 3 and [,, 4, 8, 6, 0] 3. You should notie that [, 3, 9, 0] 3 is an a/s 3-hain but not a -based a/s 3-hain. Next, we modify Algorithm to Algorithm 3 for generating -based a/s -hain. If the desired output is just a/s -hain, you an use =., Algorithm 3 Modified algorithm for generating -based addition-subtration -hain for an integer n Input:,, n = l n i i = n 0,..., n l Output: -based addition-subtration -hain for n : vi i for 0 i l : j 0 3: for all x i 0 in x = {n 0, n,..., n l, n l } do 4: t j, t j+,..., t j+ xi i + signx i,..., 5: i + signx i 6: j j + x i 7: end for 8: t j, t j+,..., t j/ 0, 0,..., 0 9: for i = 0 to j/ do 0: vl + i + vl + i + vt i+ signt i+ : +vt i++ signt i++ : + 3: +vt i++ signt i++ 4: end for 5: return v There are some differenes between Algorithm and Algorithm 3. In Algorithm 3, the input is a base signed digit representation instead of traditional representation. We will use relaxed redued representation as an input here. In line 3-5 and 0-3, we use sign funtion to separate addition and subtration operations. We have to use + in line 3-5, use 0 in line 8 and use on line 0-3 to mae the index values not eual to zero. Example 6. We will follow Algorithm 3 to generate 4-based a/s 5-hain for n = 977. From Algorithm, the relaxed redued representation in base 4 for 977 is,, 0,, 0, 4 and we will use it as an input. Following Algorithm 3, in line, we will have v = [, 4, 6, 64, 56, 04] 5. By hoosing x i from left to right, at the end of line 7 we will have t =,,, 4, 6, 0, 0, 0. In line 9 to 4, the next element in the hain is alulated from the first 4 elements of t, v6 = v5 + v0 v v v3 = 953. Then, the last element is alulated from the last 4 elements of t, v7 = v6 + v5 + v + v + v = 977. The algorithm returns the 4-based a/s 5-hain for 977, [, 4, 6, 64, 56, 04, 953, 977] 5. We show the flow of the algorithm in Fig.. From Algorithms and 3, you an see that relaxed ost of the representation affets the length of the hain. In the next setion, we will disuss on the relaxed ost, the bound of the length of the hain and show proofs on this. These will lead to the omputation time of salar multipliation using -based a/s -hain tehniue. IV. WORST CASE OF COMPUTATION TIME USING -BASED ADDITION-SUBTRACTION -CHAIN TECHNIQUE Before showing the omputation time, we give some disussions on the relaxed redued representations and its maximum

5 = ε b = ε m > m Fig.. Generating 4-based a/s 5-hain of 977 using Algorithm 3 relaxed osts. We will use these relaxed redued representations as inputs for Algorithm 3. They also diretly affet the length of our -based a/s -hain and the omputation time. A. Worst Case of Relaxed Cost of Relaxed Redued Representation Lemmas and theorems disussed in Subsetion II-A show many properties of the relaxed redued representations and we will use these properties to prove our wors. We then onlude the worst ase of relaxed ost of relaxed redued representation in Theorem. Lemma 7. For all natural number m and odd base 3, there exists an integer 0 w m with its relaxed redued representation ε R w suh that ε = + m. Proof. Let b := and w := m +. The relaxed redued representation of w is ε = ε 0,..., ε m = b,..., b, R w. You an see that 0 w = m ε i i m and ε = + bm = + m. Lemma 8. For all natural number m and odd base 3, ε is at most + m for relaxed redued representation ε R w, 0 w m. Proof. Let b :=. We assume that there exists an integer 0 w m with a relaxed redued representation ε = ε 0,..., ε R w suh that ε > + m = + bm. Case the length > m, from relaxed redued representation s properties in [] that ε i b, we an derive the ineualities as follows. From the assumption, we now that ε > 0. w = ε i i = ε + ε i i ε + b i and this ontradits the fat that w m. Case the length < m, relaxed redued representation s properties in [] show that ε i b, so it is impossible to have < m with ε > + bm. Case the length = m and = 3, the relaxed ost of relaxed redued representation is maximized when w = m + whih has relaxed redued representation ε = ε 0,..., ε =,...,,. We have ε = + bm and this is a ontradition. Case the length = m and 3, if ε =, we have ε i + bm. From ε i b, this is impossible. Thus, the lowest ε we an have is and we get lowest w with relaxed ost of its relaxed redued representation greater than + bm is w = 3m + with its relaxed redued representation ε 0,..., ε = b,..., b, R w. You an see that w > m and this is a ontradition. Lemma 9. For all natural number m and even base, there exists an integer 0 w m with its relaxed redued representation ε R w suh that { + m if m is odd ε = + m if m is even Proof. Let b := and a :=. Case m is odd, let w odd := m a m a + b m with its representation ε = ε 0,..., ε m = a, b,..., a, b, a, R w odd. The redution rules in Definition 6 an be applied to show that ε is relaxed redued. You an see that 0 w odd = m ε i i m and ε = + a + a + b m = + m. Case m is even, let w even := m m + with its representation ε = ε 0,..., ε m = b, a,..., b, a, R w even. The redution rules in Definition 6 an be applied to show that ε is relaxed redued. You an see that 0 w even = m ε i i m and ε = +a+b m = + m. Lemma 0. For all natural number m and even base, ε is at most { ε + m if m is odd + m if m is even for relaxed redued representation ε R w, 0 w m. Proof. Let b := and a :=.

6 Case m is odd, we assume that there exists an integer 0 w m with its relaxed redued representation ε = ε 0,..., ε R w suh that ε > + m Case the length > m, using the argument similar to Lemma 8 for the ase when the length > m and some relaxed redued representation s properties, we have ε i i > m. We have a ontradition. Case the length < m, relaxed redued representation s properties in [] show that ε i b and there should be no two adjaent digits eual to b or b, so it is impossible to have < m with ε > + m. Case the length = m and =, using the properties on adjaent digits and the argument similar to Lemma 8 for the ase when the length = m and = 3, we will have a ontradition. Case the length = m and, using the argument similar to Lemma 8 for the ase when the length = m and 3, the lowest w we an have with relaxed ost of its relaxed redued representation greater than + m is w = 3 m + m + m + with relaxed redued representation ε 0,..., ε = a, b,..., a, b, a, R w. You an see that w > m and this is a ontradition. Case m is even, the proof an be ompleted using the similar argument. Finally, we onlude all lemmas in this theorem. Theorem maximum relaxed ost of relaxed redued representation. Given a natural number m and base, the maximum relaxed ost of relaxed redued representation ε R w for 0 w m, ε, an be desribed as follows. + ε m if is odd + m if is even and m is odd + m if is even and m is even B. Worst Case of Computation Time Using -Based Addition- Subtration -Chain Tehniue From Theorems 0, and Algorithm 3, we an propose a bound of the length of -based a/s -hain as follows. Theorem bound of the length of -based addition-subtration -hain. Given positive integer, and n, the bound of the optimal length s of -based addition-subtration -hain for an integer n an be desribed as follows. log n s log n + log n Note that log n is the length of the power part and log n is the length of the addition part. This an be alulated straightforward from Theorem 0 and Theorem. This theorem leads to the worst ase of the omputation time using -based a/s -hain tehniue with no parallel omputation. Refer to Subsetion II-C, the osts from using -based a/s -hain of n to alulate np are written in the following notation. We define m := log n + as number of bits for n. Avg m,, = Q m log + A avg m log +O, Max m,, = Q m m log + A max log +O, where Q is the ost of multiplying the point by. The onstants avg and max are the average and maximum relaxed osts for bit representation in base whih are explained in this setion and Subsetion II-A. V. PARALLEL SCALAR MULTIPLICATION USING -BASED ADDITION-SUBTRACTION -CHAIN TECHNIQUE In [], -hain is used to improve the inversion operation of an element in GF m. In this paper, we will use the proposed -based a/s -hain to improve salar multipliation in parallel way. We first introdue the most basi tehniue with no parallel omputation, namely -based a/s -hain tehniue. We then propose a -based a/s 4-hain parallel tehniue whih leads to our main ontribution, -based a/s - hain parallel tehniue. We also disuss an optimization for multiple operand point addition using hybrid-double multiplier [9], [0]. A. -Based Addition-Subtration 4-Chain Parallel Tehniue We start by introduing -based a/s -hain tehniue whih is the most simple tehniue. We an alulate np by following the way -based a/s -hain of n is onstruted. We alulate point doubling in power part and point addition in the addition part of the hain. From Theorem 8, Theorem, Algorithms and Algorithm 3, the length of the power part is at most m := log n +. The length of the addition part is at average 3 m + O and at most m + O. Thus, the average and maximum osts for -based a/s -hain tehniue an be written with the following notations. Avg m,, = D m + A 3 m + O, Max m,, = D m + A m + O. This is the most simple tehniue using -based a/s -hain. You may notie that using NAF tehniue will have the same ost. Next, we will move to the parallel tehniue by using parallel point addition. We start with -based a/s 4 hain, and then generalize to -based a/s hain in the next subsetion. The idea is that, to alulate P + P + P 3 + P 4, parallel point addition will firstly do P = P + P and P = P 3 + P 4 simultaneously with omputing ores. Then the final answer is P +P. Thus, this osts only A instead of 3A. We define 4-operand parallel point addition A whih euals to A.

7 Remar: Given ellipti points P i and positive integer x, x- operand point addition is the alulation of P +P + +P x. To use -based a/s 4-hain parallel tehniue to alulate np, we do point doubling in power part and then do 4-operand parallel point addition in addition part. The length of the power part is at most m := log n +. By Theorems 8 and, the length of the addition part is 3 3 m + O at average and, by Theorems and, at most 3 m + O. Thus, the average and maximum osts for -based a/s 4-hain parallel point addition tehniue with omputing ores an be written with the following notations. Avg m,,4, = D m + A 9 m + O = D m + A 9 m + O, Max m,,4, = D m + A 6 m + O = D m + A 3 m + O. Another easy way to alulate the ost is to multiply a fator of 3 from the parallel point addition to the addition part of -based a/s -hain. B. Generalize to -Based Addition-Subtration -Chain Tehniue with Computing Cores If you have enough omputing resoures, this tehniue an be generalized by using -based a/s -hain with omputing ores an exeute point additions at the same time. Start with operands points, beause it is a -hain, we assume that number of the operands are redued by half eah round with -operand addition, thus we have log rounds. The number of point additions in eah round is the number of the operands remaining in eah round divides by times the number of omputing ores, rounding up. Similar to the last subsetion, the average and maximum osts for the generalized tehniue an be written as follows. Avg m,odd,, = Q m log + A log Avg m,even,, = Q m Max m,,, = Q m + 4 log + A log + A m log + O log m log + O m log + O log Another easy way to approximate the ost is to multiply a fator of from the parallel omputing ores to the addition part. Remar: To get the minimum ost, we found that we should use = -based and have the highest as possible. The hoies for have only small effet. We will disuss on this topi in the next setion. Moreover, using = is also effiient in GF m beause the doubling operation is fast. The value of an be hosen depending on the finite field used. C. Optimizing Multiple Operand Point Addition for Twisted Edwards Curves In this subsetion, we disuss an optimization tehniue for -based a/s -hain. Although we an use any for -based a/s -hain tehniue, the last subsetion, Subsetion V-B, show that = will lead to the minimum ost and we will use this value through this subsetion as an example on how to apply the optimization. Other values of are also possible for this tehniue. Firstly, we give some explanations about the finite field elements multipliation. The -operand finite field elements multipliation is an operation that an give a multipliation result of two field elements, while the 3-operand finite field elements multipliation is an operation that an give a multipliation result of three field elements. For example, when λ, λ, λ 3 are elements of a field, the -operand finite field elements multipliation an give a value of λ λ, while 3- operand finite field elements multipliation an give a value of λ λ λ 3. In [9], [0], a iruit for the 3-operand finite field elements multipliation alled hybrid-double multiplier is given. The alulation time of the iruit is almost eual to that of the fastest -operand finite field elements multipliation. Remar: The finite field elements multipliation is a part of the ellipti point addition. They are not the same operations. We will fous on twisted Edwards urves [8], ax + y = + dx y, beause they are the urrently fastest urves []. Cost for -operand point addition an operation that alulate P + P when P and P are points on an ellipti urve using hybrid-double multiplier is A = 9M. We define A as the ost for 3-operand point addition an operation that alulate P + P + P 3 when P, P, and P 3 are points on an ellipti urve. We an rearrange some part of the point addition euations from [8] and have 7M as the ost for A. The rearranged euations for A are explained as follows. Let X i, Y i and Z i be finite field elements. Given ellipti points P X, Y, Z, P X, Y, Z and P 3 X 3, Y 3, Z 3 in projetive oordinate where the x-y oordinate x i, y i = X i /Z i, Y i /Z i. We use most euations from [8] beause they are the urrently fastest formulas reorded in []. First, we alulate X and Y from P and P. λ = Z Z λ = λ λ 3 = X X λ 4 = Y Y λ 5 = dλ 3 λ 4 λ 6 = λ λ 5 λ 7 = λ + λ 5

8 X = λ λ 6 X + Y X + Y λ 3 λ 4 Y = λ λ 7 λ 4 aλ 3 The alulation ost is now 8M using hybrid-double multiplier. Notie that we do not alulate Z here. Calulate Z = λ 6 λ 7 will finish the -operand point addition with the ost of 9M. We ontinue to alulate P 4 X 4, Y 4, Z 4 = P + P + P 3 as follows and you an see that the total ost is 7M. λ 8 = λ 6 λ 7 Z 3 λ 9 = λ 8 λ 0 = X X 3 λ = Y Y 3 λ = dλ 0 λ λ 3 = λ 9 λ λ 4 = λ 9 + λ X 4 = λ 8 λ 3 X + X 3 Y + Y 3 λ 0 λ Y 4 = λ 8 λ 4 λ aλ 0 Z 4 = λ 3 λ 4 It is important to note that with the hybrid-double multiplier, we have 7M = A < A = 8M. The lower ost omes from the λ 8 euation. To alulate np from -based a/s - hain, we do point doubling in the power part and then do 3-operand point addition in the addition part. In this way, the average and maximum osts for -based a/s -hain tehniue with ores are Avg m,optimize,, = D m + A 3 log 3 7 m + O 54 3 log 3 Max m,optimize,, = D m + A 7 36 m + O Another easy way to alulate the ost is to multiply a fator of 7 8 from the 3-operand point addition to the addition part. We an generalize this optimization to x-operand point addition for any positive integer x 3. Calulating the summation of x ellipti points with hybrid-double multiplier but no multiple operand point addition will ost 9x M. For eah operand higher than, if we use the hybriddouble multiplier, we an redue the finite field multipliation by one. This is beause we do not have to alulate the intermediate value of Z i. Refer to the rearrange euations earlier, you an see that we an alulate λ 8 = λ 6 λ 7 Z 3 with only one 3-operand field elements multipliation instead of Z = λ 6 λ 7 and λ 8 = Z Z 3 separately. You an apply this 3-operand field element multipliation to every point operand added. This means that, using x-operand point addition will redue x M from the ost. This will give a fator of to the addition part. 9x x 9x = 8x 7 9x 9 Reall that the number of points we want to add using ores is from the property of -based a/s -hain. We now that the omputation time is optimized when eah ore has almost the same number of points to add. Beause of that, eah ore has the point to alulate the summation at most. Having x > will not give any more improvements. Thus, the value of x that minimize our ost is. If we an rearrange the euations in other ways and redue more field element multipliations, we an similarly apply the tehniue to lower the alulation ost. However, we found during the ourse of this wor that the further redution is very diffiult. D. Side Channel Atta Prevention In previous tehniues inluding double-and-add, NAF, w- NAF, addition hain and addition-subtration hain, we an now the seuene of addition and doubling steps by monitoring the power power atta [] or time used timing atta [3]. These inds of attas are alled side-hannel atta. Some tehniues, inluding Montgomery ladder [4], deploy dummy operations or use uniform operations to enounter this, however, the alulation osts beome worse. In -based a/s -hain tehniues, all alulations begin with some numbers of multiplying and then follow with some additions. The n in np annot be distinguished using these ind of seuenes. Thus, we do not need any dummy operations. This is how we resist power atta. For timing atta in -based a/s -hain, one an measure the time used in the addition part and tell how many times the addition are exeuted. Some n may have short addition part, thus, it is easy to guess this integer n. We an add some dummy operations and mae all exeutions eual to the maximum omputation time. Even though the alulation ost beomes worse, we have proved that the maximum omputation time is still effiient. In this way, we an prevent timing atta and also power atta. VI. COMPARISONS AND PARAMETER SETTINGS A. Comparisons with Tehniues without Windows Defining m := log n +, from Setions V, the osts Avg m and Max m of all tehniues using base representations are in the form D m + A oeff. m + O. Table I summarizes the oeffiient values of Am for average and worst ase. w-naf and wr-naf are not inluded in the table beause their alulation osts are affeted from the preomputation osts. Note that the multiple operand point addition optimization is now speifi to twisted Edwards urves due to the rearranged euations. The other tehniues an be generally applied to any urves. Aording to Table I, among the proposed tehniue, hoosing -based a/s -hain with large number of ores,, and a multiple operand point addition optimization will lead to the minimum ost.

9 TABLE I COEFFICIENT VALUE OF Am FOR EACH TECHNIQUE Tehniue used Average oeffiient Maximum oeffiient Double-and-add -based a/s -hain / NAF [] -based a/s 4-hain ores -based a/s -hain ores log = = log based a/s -hain ores with 3-operand addition and hybrid-double multiplier -based a/s -hain ores with x-operand addition and hybrid-double multiplier 3 log x log x 8x x log x log x 8x 7 4 9x B. Comparisons with w-naf and Montgomery Ladder We first preisely ompare the maximum ost between w-naf representation and our -based a/s -hain parallel tehniue. Beause of the pre-omputation ost in w-naf, we have to speify the number of bits used to represent an integer. We hoose 8 and 56 bit integers for this purpose []. The maximum ost should be onsidered in this ase due to the aims of side-hannel atta. For w-naf wr-naf with r =, [4] suggests the best w to be 5 and we will use these values in this subsetion. Aording to Subsetions II-C and V-B, the maximum ost for 8 bits would be Max 8,5-NAF = D 8 + A = 8 D A, Max 8,,, = D 8 + A log 8 + O In this ase, using -based a/s -hain tehniue with only omputing ores will have slightly smaller ost. You an improve the result by using more than omputing ores. Next, the maximum ost for 56 bits would be Max 56,5-NAF = D 56 + A = 56 D A, Max 56,,, = D 56 + A log 56 + O In 56-bit ase, using -based a/s hain tehniue with 3 omputing ores or more will have smaller ost. Approximately, for large m, our hain tehniue with 3 omputing ores will have up to /5 4/7 /5 = 5.9% less additions. but if using omputing ores, our tehniue an have up to 4/8 /5 /5 =.% more additions. Similarly, in base 3 representation and GF 3 m, [4] suggests w = 3 and r = 3 for wr-naf tehniue. Our 3-based a/s -hain tehniue an overome the urrent ost using only 3 omputing ores with 3-operand addition optimization and hybrid-double multiplier. We show the approximated osts as follows and use T as the ost for tripling. Max m,3,3-naf = T m log 3 + A m 3 log 3 +O Max m,opt3,, = T m 7 m log 3 + A 8 log 3 +O For Montgomery ladder [4], the tehniue uses addition for eah digit in the binary representation. Using the number of bits with the same notation m = log n +, the maximum ost for alulating np using this tehniue is Max m,mont = A m Beause the ost of addition A = M is more than doubling D = 7M with no hybrid-double multiplier, our -based a/s -hain tehniues an perform better with omputing ores and above. If the power part is already preomputed, our hain tehniue an perform better in any ase. C. Choie of in -Based Addition-Subtration -Chain Although, hoies for do not have muh effets on the ost, you an see that hoosing large for -based a/s -hain an lower the alulation ost owing to the ost euation, the

10 rounding up and the optimization tehniue. However, using smaller also has some benefits. In ellipti urve ryptography, we now P long before nowing n. The power part an be alulated before n is given. When n is given, it will go through Algorithm to generate its relaxed redued representation. After the algorithm produes some least signifiant digits, if we hoose small, we an alulate the next element of the hain immediately, not having to wait for the algorithm to finish. The smaller we hoose, the earlier we an start the alulation. Smaller also has another benefit. Some appliations need the results of np for the same P and some different n. Using smaller, some ommon digits between the different n an be alulated only one. See the example below. Example 3. To alulate 45P and 77P from -based a/s -hain, we have relaxed redued representation for 45 =, 0,, 0,, 0, and 77 =, 0,, 0,, 0,. From Algorithm 3, we an hoose x i eah digit in relaxed redued representation in order to have t for 45 =, 3, 5, 0 and t for 77 =, 3, 5, 0. If we hoose = 3 - based a/s 3-hain, we have [,, 4, 8, 6, 3, 64, 6, 45] for 45 and [,, 4, 8, 6, 3, 64, 6, 77] for 77. Notie that we an alulate the ommon 6P one. We an redue more addition if n is large. In this example, the tehniue annot be used if we hoose 4. From our experiments, we random 00,000 pairs of 8-bit integers and generate their base relaxed redued representations. At average, there are 3 ommon digits between eah pair. Changing to base 3 an inrease this value to 7. This means if we hoose the appropriate value for, at average, we an redue 3 and 7 additions, respetively. We may use this tehniue and onsider more than integers at the same time. A method for seleting whih digit to alulate, its effiieny and method to find the optimized are left for further studies. VII. CONCLUSIONS AND FUTURE WORKS Parallel tehniues have been used widely for effiient omputations, but not many parallel tehniues have been proposed to improve salar multipliation with side-hannel atta prevention. Our paper propose a parallel salar multipliation tehniue using -based a/s -hain. The proposed tehniue uses the omputing ores effiiently as we an see that using omputing ores an redue the addition osts to the fator of. This parallel tehniues an perform better than the urrent w-naf tehniue by using only 3 ores. We also have some optimization of multiple operand point addition whih an redue the addition osts up to the fator of 8 9. At the end, we show that our parallel -based a/s -hain tehniue an resist side-hannel atta effiiently. Some ellipti urve multiple operand addition euations rearrangements, method for seleting digits and the optimized value for are left for further studies. ACKNOWLEDGMENT This researh was mainly done while Kittiphop Phalaarn and Kittiphon Phalaarn did an internship at The University of Toyo. The authors would lie to than The University of Toyo, Assis. Prof. Athasit Surarers and Prof. Hiroshi Imai for failitating the internship. REFERENCES [] D. Hanerson, A. J. Menezes, and S. Vanstone, Guide to ellipti urve ryptography. Springer Siene & Business Media, 006. [] W. Bosma, Signed bits and fast exponentiation, Journal de théorie des nombres de Bordeaux, vol. 3, no., pp. 7 4, 00. [3] K. Oeya and T. Taagi, The width-w NAF method provides small memory and fast ellipti salar multipliations seure against side hannel attas, in Cryptographers Tra at the RSA Conferene, pp , Springer, 003. [4] T. Taagi, D. J. Reis, S.-M. Yen, and B.-C. Wu, Radix-r non-adjaent form and its appliation to pairing-based ryptosystem, IEICE Transations on Fundamentals of Eletronis, Communiations and Computer Sienes, vol. 89, no., pp. 5 3, 006. [5] D. E. Knuth, The Art of Computer Programming, Volume : Seminumerial Algorithms. Addison-Wesley, 997. [6] H. Volger, Some results on addition/subtration hains, Information Proessing Letters, vol. 0, no. 3, pp , 985. [7] N. Meloni, Fast and seure ellipti urve salar multipliation over prime fields using speial addition hains, IACR Cryptology eprint Arhive, vol , 006. [8] R. R. Goundar, K. Shiota, and M. Toyonaga, New strategy for doublingfree short addition-subtration hain, International Journal of Applied Mathematis, vol., no. 3, pp , 007. [9] H. M. Bahig, On a generalization of addition hains: Addition multipliation hains, Disrete Mathematis, vol. 308, no. 4, pp. 6 66, 008. [0] M. Nöer, Some remars on parallel exponentiation, in International Symposium on Symboli and Algebrai Computation, pp , ACM, 000. [] K. Järvinen, V. Dimitrov, and R. Azarderahsh, A generalization of addition hains and fast inversions in binary fields, IEEE Transations on Computers, vol. 64, no. 9, pp. 4 43, 05. [] P. Koher, J. Jaffe, and B. Jun, Differential power analysis, in Annual International Cryptology Conferene, pp , Springer, 999. [3] P. C. Koher, Timing attas on implementations of Diffie-Hellman, RSA, DSS, and other systems, in Annual International Cryptology Conferene, pp. 04 3, Springer, 996. [4] M. Joye and S.-M. Yen, The Montgomery powering ladder, in International Worshop on Cryptographi Hardware and Embedded Systems, pp. 9 30, Springer, 00. [5] N. Méloni and M. A. Hasan, Random digit representation of integers, in IEEE Symposium on Computer Arithmeti in press, 06. [6] B. Möller, Seuring ellipti urve point multipliation against sidehannel attas, in International Conferene on Information Seurity, pp , Springer, 00. [7] C. Heuberger and H. Prodinger, On minimal expansions in redundant number systems: Algorithms and uantitative analysis, Computing, vol. 66, no. 4, pp , 00. [8] D. J. Bernstein, P. Birner, M. Joye, T. Lange, and C. Peters, Twisted Edwards urves, in International Conferene on Cryptology in Afria AfriaCrypt 08, pp , Springer, 008. [9] R. Azarderahsh and A. Reyhani-Masoleh, Low-omplexity multiplier arhitetures for single and hybrid-double multipliations in Gaussian normal bases, IEEE Transations on Computers, vol. 6, no. 4, pp , 03. [0] R. Azarderahsh and A. Reyhani-Masoleh, Parallel and high-speed omputations of ellipti urve ryptography using hybrid-double multipliers, IEEE Transations on Parallel and Distributed Systems, vol. 6, no. 6, pp , 05. [] Expliit-formulas database. Aessed July, 06. [] A. Jivsov, Ellipti urve ryptography ECC in OpenPGP, 0.