Représentation RNS des nombres et calcul de couplages
|
|
- Ambrose Anderson
- 6 years ago
- Views:
Transcription
1 Représentation RNS des nombres et calcul de couplages Sylvain Duquesne Université Rennes 1 Séminaire CCIS Grenoble, 7 Février 2013 Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 1 / 29
2 Outline Standard prime eld arithmetic RNS (Residue Number System) arithmetic Application to standard elliptic curve arithmetic (Joint work with JC. Bajard and M. Ercegovac) RNS arithmetic in extension elds Application to pairing computations Practical implementation (FPGA) (Joint work with N. Guillermin and Cheung-Fan-Verbauwhede-Yao) Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 2 / 29
3 Basic arithmetic over large prime elds Context p a large prime of size β n with β the size of a word (β = 2 32 ) A, B in [0, p 1] All numbers are represented in base β We want to compute A B modulo p Usual method Multiplication Reduction : Schoolbook method (quadratic) or better if n large : Euclidean division Advanced methods for reduction Use Mersenne or pseudo-mersenne primes, p = β n c with c small Use Montgomery reduction Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 3 / 29
4 Montgomery reduction algorithm Assume that integers are given in Montgomery representation, i.e. an integer A is represented by Aβ n mod p. Algorithm Data Compute Result R = AB < β 2n and p 1 mod β n (precomputed) q= R p 1 mod β n r=(r + q p)/β n r < 2p and r = Rβ n mod p Either r or r p is the reduction of R modulo p in Montgomery representation Finally, we replace a computation modulo p by a computation modulo β n Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 4 / 29
5 Practical use of Montgomery reduction Example : compute x 5 mod p 1 Compute x = xβ n modulo p 2 Compute y = x 2 and "reduce" it modulo β n 3 Compute z = y 2 and "reduce" it modulo β n 4 Compute t = z x and "reduce" it modulo β n 5 Recover x 5 = t β n mod p Use in cryptography : RSA-1024 decryption requires 1200 to 1500 modular multiplications time for changing the representation is negligible. Complexity of Montgomery modular multiplication Operations : q = R p 1 mod β n and r = (R + q p)/β n. The cost of each multiplication is n 2 /2 because we are only interested by a part of the result n 2 + n. Overall cost of modular multiplication : 2n 2 + n Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 5 / 29
6 The Residue Number System representation First approach Let m 1, m 2,..., m n 1, m n relatively prime numbers and M = We can represent X [0, M] with (x 1, x 2,..., x n ) such that : n i=1 m i x 1 = X mod m 1. x n = X mod m n (m 1, m 2,..., m n ) is named RNS base, we denote it B n. Operations X RNS + Y RNS = ((x 1 + y 1 ) mod m 1,..., (x n + y n ) mod m n ) RNS X RNS Y RNS = ((x 1 y 1 ) mod m 1,..., (x n y n ) mod m n ) RNS Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 6 / 29
7 Advantages Advantages No carry propagation Multiplication becomes linear in n If the m i are chosen like pseudo-mersenne primes i.e. m i = β c i with c i small, reducing modulo m i is very fast Easy parallelization with n processors Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 7 / 29
8 Advantages and disadvantages Advantages No carry propagation Multiplication becomes linear in n If the m i are chosen like pseudo-mersenne primes i.e. m i = β c i with c i small, reducing modulo m i is very fast Easy parallelization with n processors Drawback p prime, so p n i=1 m i Question : is it possible to perform prime eld arithmetic using RNS? Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 7 / 29
9 From Montgomery reduction to RNS reduction Representation A is represented by Aβ n mod p Algorithm Data Compute Result R = AB < β 2n p 1 mod β n q= R p 1 mod β n r=(r + q p)/β n r < 2p r = Rβ n mod p Computation modulo p replaced by computation modulo β n Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 8 / 29
10 From Montgomery reduction to RNS reduction Representation A is represented by Aβ n mod p A is represented by AM mod p Algorithm Data R = AB < β 2n Data R = AB in B n p 1 mod β n p 1 in B n Compute q= R p 1 mod β n Compute q= R p 1 in B n r=(r + q p)/β n r=(r + q p)m 1 in B n Result r < 2p Result r < 2p r = Rβ n mod p r = RM 1 mod p Computation modulo p replaced by computation modulo β n computation modulo M Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 8 / 29
11 From Montgomery reduction to RNS reduction Representation A is represented by Aβ n mod p A is represented by AM mod p Algorithm Data R = AB < β 2n Data R = AB in B n p 1 mod β n p 1 in B n Compute q= R p 1 mod β n Compute q= R p 1 in B n r=(r + q p)/β n r=(r + q p)m 1 in B n Result r < 2p Result r < 2p r = Rβ n mod p r = RM 1 mod p Computation modulo p replaced by computation modulo β n computation modulo M Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 8 / 29
12 RNS reduction Introduce a new RNS basis to handle M 1 (Bajard, Didier, Kornerup, 2001) Algorithm Data Two coprime RNS basis B n and B n R = AB in B n and B n p 1 in B n and M 1 in B n (precomputations) Compute q= R p 1 in B n q in B n ˆq in B n (change of basis) ˆr=(R + ˆq p)m 1 in B n ˆr in B n r in B n (change of basis) Result r < 2p r = RM 1 mod p Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 9 / 29
13 Complexity The RNS reduction requires 2n 2 + 3n small (word size) operations. Overall cost of modular RNS multiplication : 2n 2 + 5n Is RNS really interesting? (2n 2 + n for Montgomery arithmetic...) Other advantages of the RNS Easy to parallelize High exibility Leak-resistant arithmetic A B + C D require only 2n 2 + 7n operations Gap between complexity of multiplication and complexity of reduction. Try to optimize ECC formulas to take advantage of this. Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 10 / 29
14 Elliptic curve cryptography Group law An elliptic curves is dened over F p by an equation y 2 = x 3 + ax + b. It has an explicit group law given by the chord and tangent rule Cryptography based on discrete logarithm Security parameters Best discrete log algorithms in O( p). 80 bits security 160 bits elliptic curve (RSA 1024) 128 bits security 256 bits elliptic curve (RSA 3072) Scalar multiplication (computation of np) T P for each bit of n do T 2T if the bit is 1 do T T + P Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 11 / 29
15 Application to standard elliptic curve arithmetic Doubling formulas in Jacobian coordinates We want to compute 2T if T = (X T, Y T, Z T ) is a point on the elliptic curve dened by the equation Y 2 = X 3 + axz 4 + bz 6. Let A = 3X 2 + az 4 and C = 4X T T T Y 2, then T X 2T = A 2 2C, Y 2T = A(C X 2T ) 8Y 4 T, Z 2T = 2Y T Z T This requires 4M and 6S but 2 reductions can be saved (in A and Y 2T ) Assuming (for simplicity) that S=M, usual Montgomery arithmetic requires 20n n operations. But RNS arithmetic requires only 10 2n + 8 (2n 2 + 3n) = 16n n Better asymptotical complexity but not interesting for cryptographic sizes. Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 12 / 29
16 F p k arithmetic Usually quadratic (schoolbook) or subquadratic (Karatsuba,...) in k but Example of F p 3 linear in k in RNS representation arithmetic Assume F p 3 = F p [z]/(z 3 β) with β small. let f = f 0 + f 1 z + f 2 z 2 and g = g 0 + g 1 z + g 2 z 2 in F p 3, then fg = (f 0 g 0 + f 1 g 2 β + f 2 g 1 β) + (f 0 g 1 + f 1 g 0 + f 2 g 2 β)z + (f 0 g 2 + f 2 g 0 + f 1 g 1 )z 2 requires 9 multiplications in F p but only 3 reductions. This can be reduced to 6M and 3R using Karatsuba's method. The gain is less important if computing f 2 since ecient methods (Chung-Hasan) require 5M and 3R. Devegili, O heigeartaigh, Scott and Dahab study in full details F p k arithmetic for k 6 detailed comparison. Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 13 / 29
17 F p 6 arithmetic F p 6 is seen as a cubic extension of a quadratic one so that f.g requires 18M and 6R f 2 requires 12M and 6R RNS Montgomery Word-complexity for f.g 12n n 36n n n= n= Word-complexity for f 2 12n n 24n n n= n= Security level r p k p n Better asymptotical complexity and interesting for cryptographic sizes. Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 14 / 29
18 Let us be a little more objective Lazy reduction The accumulation of product before reduction can also be done in Montgomery arithmetic. f.g requires 18 multiplications (18n 2 ) and 6 reductions (6n 2 + 6n) overall complexity : 24n 2 + 6n (630 for n = 5) Cost of basic operation Most expensive in RNS (word-multiplication and reduction) than in Montgomery (word-multiplication). Additional cost estimated to 10% in the literature 627 for n = 5 More advantageous for RNS if n = 16, but less for f 2. Improvement of RNS complexity Bajard et al. recently prove that RNS change of basis can be done in only 7 5 n n 9n2 + 50n for f.g F p 6(475 for n = 5) Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 15 / 29
19 Size of the basis Lazy reduction larger input in the reduction step. Example 1 : AB + CD has size 2p 2. Example 2 : In f.g F p 6, each component has size 372p 2. Montgomery reduction Use an additional word to handle this factor costly especially in cryptography. RNS reduction Choose RNS basis such that m i suciently large same remark In some cases (FPGA), cryptographic sizes are less disadvantaged. Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 16 / 29
20 Pairings in cryptography Denition Let (G 1, +), (G 2, +) and (G 3, ) be 3 groups. A pairing is an application e : G 1 G 2 G 3 which is bilinear, ie e(p + P, Q) = e(p, Q)e(P, Q) non degenerate, ie P G 1, Q G 2 s.t. e(p, Q) 1 easily computable Use in cryptography Destructive : Decisionnal Die-Hellman is easy, transfer of discrete log Constructive : Tripartite key-exchange, short signature, ID-based cryptography Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 17 / 29
21 Realization of pairings Context E elliptic curve dened over F p (p prime). P E(F p ) of prime order r. k = 2d the embedding degree (smallest integer such that r p k 1). Q = (x, yα) E(F p k ) with x, y F p d and F p k = F p d [α] Denition Let f P be the function on the curve such that Div(f P ) = rp r. e(p, Q) = f P (Q) p k 1 r F p k Examples Supersingular curves (k 2 in large characteristic) MNT curves (k = 6), optimal for 80 bits security Barreto-Naherig curves (k = 12), optimal for 128 bits security Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 18 / 29
22 Fast Tate pairing computation The Miller loop (computation of f P (Q)) T P, f 1 for each bit of r do f f 2.l T,T (Q) and T 2T if the bit is 1 do f f.l T,P (Q) and T T + P where l A,B is the equation of the line passing through A and B. The nal exponentiation (computation of f p k 1 r ) Split in an easy part (use of Frobenius) and a dicult part. Dicult part is roughtly f s with s p and even p 1 2 (MNT) or p 3 4 (BN). Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 19 / 29
23 Computation of l T,T (Q) in Jacobian coordinates Let A = 3X 2 T + az 4 T and C = 4X T Y 2 T. Computation of 2T requires 10M and 8R. X 2T = A 2 2C, Y 2T = A(C X 2T ) 8Y 4 T, Z 2T = 2Y T Z T It is easy to prove that l T,T (Q) = 2Y T Z T.Z 2 T.y Qα A.Z 2 T.x Q + A.X T 2Y 2 T and that its computation requires k + 3 multiplications in F p k + 2 reductions (accumulate AX T before reducing) and the constant term of AZ 2 T x Q No more exciting than standard elliptic curve arithmetic for RNS. Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 20 / 29
24 Application to MNT curves with k = 6 Miller loop : step complexity if the bit of r is zero 10M and 8R for the computation of 2T 9M and 8R for the computation of l T,T (Q) 12M and 6R for the squaring of f 18M and 6R for the multiplication of f 2 and l T,T (Q) RNS Montgomery Gain Word-complexity 43n n 77n n n= % n= % Final exponentiation : step complexity if the bit is zero RNS Montgomery Gain Word-complexity 9n n 18n 2 + 6n n= % n= % Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 21 / 29
25 F p 12 arithmetic F p 12 is seen as a quadratic extension of a cubic extension of a quadratic one so that f.g requires 54M and 12R f 2 requires 36M and 12R RNS Montgomery Word-complexity for f.g 18.5n n 66n n n= Word-complexity for f n n 48n n n= Security level r p k p n Better asymptotical complexity and interesting for cryptographic sizes. Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 22 / 29
26 Application to BN curves (k = 12) Miller loop : step complexity if the bit of r is zero 10M and 8R for the computation of 2T 9M and 8R for the computation of l T,T (Q) 36M and 12R for the squaring of f 39M and 12R for the multiplication of f 2 and l T,T (Q) RNS Montgomery Gain Word-complexity 61.5n n 134n n n= % Final exponentiation : step complexity if the bit is zero RNS Montgomery Gain Word-complexity 18.5n n 48n n n= % Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 23 / 29
27 Some remarks RNS gain is essentially on F p k arithmetic, then Choosing other systems of coordinate (ane, projective,...) Using Ate pairing or other way to have shorter Miller loop will not change our conclusion that RNS arithmetic is interesting for pairing computations. Using curves with ρ > 1 will benet to RNS since n takes larger values. Similar results are expected with Freeman curves (k = 10). Supersingular curves (k = 2) take also advantage of RNS arithmetic since n = 16 for 80 bits security level. Remember advantages of the RNS arithmetic become evident when a parallel architecture is used. A practical implementation is missing to take into account the neglected operations (important because n an k are small), to eectively compare with other implementations in the BN case. Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 24 / 29
28 Practical implementation FPGA Programmable hardware device Xilinx and Altera 2 categories : "low cost" and "high end" Includes many logic modules containing LUT (Look-Up-Table) and some additional functions (allowing fast carry propagation or shift register for instance) An interconnecting array between logic modules DSP block for multiplication (9 bit words) Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 25 / 29
29 The Cox-Rower architecture Used in mot of RNS FPGA implementation based on parallelism Well adapted to RNS change of basis Need adjustments depending on the goal (RSA, ECC, pairings) The Cox computes λ A Rower computes modulo m i Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 26 / 29
30 Our choices Optimal Ate pairing on BN curves dened by x = ( ) 126 bits of security x = ( ) 128 bits of security x = ( ) 192 bits of security with almost all recent algorithmic improvements. Projective coordinates 36 bits words (allowing more than 192p 2 as input of the reduction) No Karatsuba methods (addition have essentially the same cost as multiplications) Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 27 / 29
31 Results Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 28 / 29
32 Thank you Thank you for your attention Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 29 / 29
Faster F p -arithmetic for Cryptographic Pairings on Barreto-Naehrig Curves
Faster F p -arithmetic for Cryptographic Pairings on Barreto-Naehrig Curves Junfeng Fan, Frederik Vercauteren and Ingrid Verbauwhede Katholieke Universiteit Leuven, COSIC May 18, 2009 1 Outline What is
More informationEfficient Implementation of Cryptographic pairings. Mike Scott Dublin City University
Efficient Implementation of Cryptographic pairings Mike Scott Dublin City University First Steps To do Pairing based Crypto we need two things Efficient algorithms Suitable elliptic curves We have got
More informationEfficient Implementation of Cryptographic pairings. Mike Scott Dublin City University
Efficient Implementation of Cryptographic pairings Mike Scott Dublin City University First Steps To do Pairing based Crypto we need two things l Efficient algorithms l Suitable elliptic curves We have
More informationA FPGA pairing implementation using the Residue Number System. Sylvain Duquesne, Nicolas Guillermin
A FPGA pairing implementation using the Residue Number System Sylvain Duquesne, Nicolas Guillermin IRMAR, UMR CNRS 6625 Université Rennes 1 Campus de Beaulieu 35042 Rennes cedex, France sylvain.duquesne@univ-rennes1.fr,
More informationCombining leak resistant arithmetic for elliptic curves defined over F p and RNS representation
Combining leak resistant arithmetic for elliptic curves defined over F p and RNS representation JC Bajard a, S. Duquesne b, M Ercegovac c a LIP6, UPMC Paris, France, and LIRMM, CNRS, France; b IRMAR, CNRS
More informationElliptic Curve Cryptography and Security of Embedded Devices
Elliptic Curve Cryptography and Security of Embedded Devices Ph.D. Defense Vincent Verneuil Institut de Mathématiques de Bordeaux Inside Secure June 13th, 2012 V. Verneuil - Elliptic Curve Cryptography
More informationREDUNDANT TRINOMIALS FOR FINITE FIELDS OF CHARACTERISTIC 2
REDUNDANT TRINOMIALS FOR FINITE FIELDS OF CHARACTERISTIC 2 CHRISTOPHE DOCHE Abstract. In this paper we introduce so-called redundant trinomials to represent elements of nite elds of characteristic 2. The
More informationArithmetic Operators for Pairing-Based Cryptography
Arithmetic Operators for Pairing-Based Cryptography Jean-Luc Beuchat Laboratory of Cryptography and Information Security Graduate School of Systems and Information Engineering University of Tsukuba 1-1-1
More informationImplementing Pairing-Based Cryptosystems
Implementing Pairing-Based Cryptosystems Zhaohui Cheng and Manos Nistazakis School of Computing Science, Middlesex University White Hart Lane, London N17 8HR, UK. {m.z.cheng, e.nistazakis}@mdx.ac.uk Abstract:
More informationPairings for Cryptography
Pairings for Cryptography Michael Naehrig Technische Universiteit Eindhoven Ñ ÐÖÝÔØÓ ºÓÖ Nijmegen, 11 December 2009 Pairings A pairing is a bilinear, non-degenerate map e : G 1 G 2 G 3, where (G 1, +),
More informationPairings at High Security Levels
Pairings at High Security Levels Michael Naehrig Eindhoven University of Technology michael@cryptojedi.org DoE CRYPTODOC Darmstadt, 21 November 2011 Pairings are efficient!... even at high security levels.
More informationArithmetic operators for pairing-based cryptography
7. Kryptotag November 9 th, 2007 Arithmetic operators for pairing-based cryptography Jérémie Detrey Cosec, B-IT, Bonn, Germany jdetrey@bit.uni-bonn.de Joint work with: Jean-Luc Beuchat Nicolas Brisebarre
More informationSome Efficient Algorithms for the Final Exponentiation of η T Pairing
Some Efficient Algorithms for the Final Exponentiation of η T Pairing Masaaki Shirase 1, Tsuyoshi Takagi 1, and Eiji Okamoto 2 1 Future University-Hakodate, Japan 2 University of Tsukuba, Japan Abstract.
More informationResidue systems efficiency for modular products summation: Application to Elliptic Curves Cryptography
Residue systems efficiency for modular products summation: Application to Elliptic Curves Cryptography JC Bajard a,s.duquesne b, M Ercegovac c and N Meloni ab a ARITH-LIRMM, CNRS Université Montpellier2,
More informationKatherine Stange. ECC 2007, Dublin, Ireland
in in Department of Brown University http://www.math.brown.edu/~stange/ in ECC Computation of ECC 2007, Dublin, Ireland Outline in in ECC Computation of in ECC Computation of in Definition A integer sequence
More informationOne can use elliptic curves to factor integers, although probably not RSA moduli.
Elliptic Curves Elliptic curves are groups created by defining a binary operation (addition) on the points of the graph of certain polynomial equations in two variables. These groups have several properties
More informationOptimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves
CT-RSA 2012 February 29th, 2012 Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves Joint work with: Nicolas Estibals CARAMEL project-team, LORIA, Université de Lorraine / CNRS / INRIA,
More informationCombining leak resistant arithmetic for elliptic curves defined over F p and RNS representation
Combining leak resistant arithmetic for elliptic curves defined over F p and RNS representation JC Bajard a, S. Duquesne b, M Ercegovac c a ARITH-LIRMM, CNRS Université Montpellier2, France; b I3M, CNRS
More informationImplementing the Weil, Tate and Ate pairings using Sage software
Sage days 10, Nancy, France Implementing the Weil, Tate and Ate pairings using Sage software Nadia EL MRABET LIRMM, I3M, Université Montpellier 2 Saturday 11 th October 2008 Outline of the presentation
More informationSM9 identity-based cryptographic algorithms Part 1: General
SM9 identity-based cryptographic algorithms Part 1: General Contents 1 Scope... 1 2 Terms and definitions... 1 2.1 identity... 1 2.2 master key... 1 2.3 key generation center (KGC)... 1 3 Symbols and abbreviations...
More informationEfficient Finite Field Multiplication for Isogeny Based Post Quantum Cryptography
Efficient Finite Field Multiplication for Isogeny Based Post Quantum Cryptography Angshuman Karmakar 1 Sujoy Sinha Roy 1 Frederik Vercauteren 1,2 Ingrid Verbauwhede 1 1 COSIC, ESAT KU Leuven and iminds
More informationConstructing Abelian Varieties for Pairing-Based Cryptography
for Pairing-Based CWI and Universiteit Leiden, Netherlands Workshop on Pairings in Arithmetic Geometry and 4 May 2009 s MNT MNT Type s What is pairing-based cryptography? Pairing-based cryptography refers
More informationAnalysis of Optimum Pairing Products at High Security Levels
Analysis of Optimum Pairing Products at High Security Levels Xusheng Zhang and Dongdai Lin Institute of Software, Chinese Academy of Sciences Institute of Information Engineering, Chinese Academy of Sciences
More information8 Elliptic Curve Cryptography
8 Elliptic Curve Cryptography 8.1 Elliptic Curves over a Finite Field For the purposes of cryptography, we want to consider an elliptic curve defined over a finite field F p = Z/pZ for p a prime. Given
More informationA Dierential Power Analysis attack against the Miller's Algorithm
A Dierential Power Analysis attack against the Miller's Algorithm Nadia El Mrabet (1), G. Di Natale (2) and M.L. Flottes (2) (1) Team Arith, (2) Team CCSI/LIRMM, Université Montpellier 2 Prime 2009, UCC,
More informationTampering attacks in pairing-based cryptography. Johannes Blömer University of Paderborn September 22, 2014
Tampering attacks in pairing-based cryptography Johannes Blömer University of Paderborn September 22, 2014 1 / 16 Pairings Definition 1 A pairing is a bilinear, non-degenerate, and efficiently computable
More informationPower Consumption Analysis. Arithmetic Level Countermeasures for ECC Coprocessor. Arithmetic Operators for Cryptography.
Power Consumption Analysis General principle: measure the current I in the circuit Arithmetic Level Countermeasures for ECC Coprocessor Arnaud Tisserand, Thomas Chabrier, Danuta Pamula I V DD circuit traces
More informationDefinition of a finite group
Elliptic curves Definition of a finite group (G, * ) is a finite group if: 1. G is a finite set. 2. For each a and b in G, also a * b is in G. 3. There is an e in G such that for all a in G, a * e= e *
More informationConstructing Pairing-Friendly Elliptic Curves for Cryptography
Constructing Pairing-Friendly Elliptic Curves for Cryptography University of California, Berkeley, USA 2nd KIAS-KMS Summer Workshop on Cryptography Seoul, Korea 30 June 2007 Outline 1 Pairings in Cryptography
More informationOrdinary Pairing Friendly Curve of Embedding Degree 3 Whose Order Has Two Large Prime Factors
Memoirs of the Faculty of Engineering, Okayama University, Vol. 44, pp. 60-68, January 2010 Ordinary Pairing Friendly Curve of Embedding Degree Whose Order Has Two Large Prime Factors Yasuyuki NOGAMI Graduate
More informationSubquadratic Computational Complexity Schemes for Extended Binary Field Multiplication Using Optimal Normal Bases
1 Subquadratic Computational Complexity Schemes for Extended Binary Field Multiplication Using Optimal Normal Bases H. Fan and M. A. Hasan March 31, 2007 Abstract Based on a recently proposed Toeplitz
More informationAte Pairing on Hyperelliptic Curves
Ate Pairing on Hyperelliptic Curves R. Granger, F. Hess, R. Oyono, N. Thériault F. Vercauteren EUROCRYPT 2007 - Barcelona Pairings Pairings Let G 1, G 2, G T be groups of prime order l. A pairing is a
More informationArithmetic Operators for Pairing-Based Cryptography
Arithmetic Operators for Pairing-Based Cryptography J.-L. Beuchat 1 N. Brisebarre 2 J. Detrey 3 E. Okamoto 1 1 University of Tsukuba, Japan 2 École Normale Supérieure de Lyon, France 3 Cosec, b-it, Bonn,
More informationCyclic Groups in Cryptography
Cyclic Groups in Cryptography p. 1/6 Cyclic Groups in Cryptography Palash Sarkar Indian Statistical Institute Cyclic Groups in Cryptography p. 2/6 Structure of Presentation Exponentiation in General Cyclic
More informationIntroduction to Elliptic Curve Cryptography. Anupam Datta
Introduction to Elliptic Curve Cryptography Anupam Datta 18-733 Elliptic Curve Cryptography Public Key Cryptosystem Duality between Elliptic Curve Cryptography and Discrete Log Based Cryptography Groups
More informationCombining Montgomery Ladder for Elliptic Curves Defined over _p and RNS Representation
Combining Montgomery Ladder for Elliptic Curves Defined over _p and RNS Representation Jean-Claude Bajard, Sylvain Duquesne, Nicolas Méloni To cite this version: Jean-Claude Bajard, Sylvain Duquesne, Nicolas
More informationFaster Pairings on Special Weierstrass Curves
craig.costello@qut.edu.au Queensland University of Technology Pairing 2009 Joint work with Huseyin Hisil, Colin Boyd, Juanma Gonzalez-Nieto, Kenneth Koon-Ho Wong Table of contents 1 Introduction The evolution
More informationAn Analysis of Affine Coordinates for Pairing Computation
An Analysis of Affine Coordinates for Pairing Computation Michael Naehrig Microsoft Research mnaehrig@microsoft.com joint work with Kristin Lauter and Peter Montgomery Microsoft Research Pairing 2010,
More informationABHELSINKI UNIVERSITY OF TECHNOLOGY
Identity-Based Cryptography T-79.5502 Advanced Course in Cryptology Billy Brumley billy.brumley at hut.fi Helsinki University of Technology Identity-Based Cryptography 1/24 Outline Classical ID-Based Crypto;
More informationEfficient Computation of Tate Pairing in Projective Coordinate Over General Characteristic Fields
Efficient Computation of Tate Pairing in Projective Coordinate Over General Characteristic Fields Sanjit Chatterjee, Palash Sarkar and Rana Barua Cryptology Research Group Applied Statistics Unit Indian
More informationA new algorithm for residue multiplication modulo
A new algorithm for residue multiplication modulo 2 521 1 Shoukat Ali and Murat Cenk Institute of Applied Mathematics Middle East Technical University, Ankara, Turkey shoukat.1983@gmail.com mcenk@metu.edu.tr
More informationNon-generic attacks on elliptic curve DLPs
Non-generic attacks on elliptic curve DLPs Benjamin Smith Team GRACE INRIA Saclay Île-de-France Laboratoire d Informatique de l École polytechnique (LIX) ECC Summer School Leuven, September 13 2013 Smith
More informationAsymmetric Pairings. Alfred Menezes (joint work with S. Chatterjee, D. Hankerson & E. Knapp)
Asymmetric Pairings Alfred Menezes (joint work with S. Chatterjee, D. Hankerson & E. Knapp) 1 Overview In their 2006 paper "Pairings for cryptographers", Galbraith, Paterson and Smart identified three
More informationCo-Z Addition Formulæ and Binary Ladders on Elliptic Curves. Raveen Goundar Marc Joye Atsuko Miyaji
Co-Z Addition Formulæ and Binary Ladders on Elliptic Curves Raveen Goundar Marc Joye Atsuko Miyaji Co-Z Addition Formulæ and Binary Ladders on Elliptic Curves Raveen Goundar Marc Joye Atsuko Miyaji Elliptic
More informationAsymmetric Encryption
-3 s s Encryption Comp Sci 3600 Outline -3 s s 1-3 2 3 4 5 s s Outline -3 s s 1-3 2 3 4 5 s s Function Using Bitwise XOR -3 s s Key Properties for -3 s s The most important property of a hash function
More informationFast arithmetic and pairing evaluation on genus 2 curves
Fast arithmetic and pairing evaluation on genus 2 curves David Freeman University of California, Berkeley dfreeman@math.berkeley.edu November 6, 2005 Abstract We present two algorithms for fast arithmetic
More informationOutline. Computer Arithmetic for Cryptography in the Arith Group. LIRMM Montpellier Laboratory of Computer Science, Robotics, and Microelectronics
Outline Computer Arithmetic for Cryptography in the Arith Group Arnaud Tisserand LIRMM, CNRS Univ. Montpellier 2 Arith Group Crypto Puces Porquerolles, April 16 18, 2007 Introduction LIRMM Laboratory Arith
More informationAspects of Pairing Inversion
Applications of Aspects of ECC 2007 - Dublin Aspects of Applications of Applications of Aspects of Applications of Pairings Let G 1, G 2, G T be groups of prime order r. A pairing is a non-degenerate bilinear
More informationFrequency Domain Finite Field Arithmetic for Elliptic Curve Cryptography
Frequency Domain Finite Field Arithmetic for Elliptic Curve Cryptography Selçuk Baktır, Berk Sunar {selcuk,sunar}@wpi.edu Department of Electrical & Computer Engineering Worcester Polytechnic Institute
More informationOptimised versions of the Ate and Twisted Ate Pairings
Optimised versions of the Ate and Twisted Ate Pairings Seiichi Matsuda 1, Naoki Kanayama 1, Florian Hess 2, and Eiji Okamoto 1 1 University of Tsukuba, Japan 2 Technische Universität Berlin, Germany Abstract.
More informationElliptic Curves Spring 2013 Lecture #12 03/19/2013
18.783 Elliptic Curves Spring 2013 Lecture #12 03/19/2013 We now consider our first practical application of elliptic curves: factoring integers. Before presenting the elliptic curve method (ECM) for factoring
More informationHardware Acceleration of the Tate Pairing in Characteristic Three
Hardware Acceleration of the Tate Pairing in Characteristic Three CHES 2005 Hardware Acceleration of the Tate Pairing in Characteristic Three Slide 1 Introduction Pairing based cryptography is a (fairly)
More informationThe Elliptic Curve in https
The Elliptic Curve in https Marco Streng Universiteit Leiden 25 November 2014 Marco Streng (Universiteit Leiden) The Elliptic Curve in https 25-11-2014 1 The s in https:// HyperText Transfer Protocol
More informationassume that the message itself is considered the RNS representation of a number, thus mapping in and out of the RNS system is not necessary. This is p
Montgomery Modular Multiplication in Residue Arithmetic Jean-Claude Bajard LIRMM Montpellier, France bajardlirmm.fr Laurent-Stephane Didier Universite de Bretagne Occidentale Brest, France laurent-stephane.didieruniv-brest.fr
More informationSelecting Elliptic Curves for Cryptography Real World Issues
Selecting Elliptic Curves for Cryptography Real World Issues Michael Naehrig Cryptography Research Group Microsoft Research UW Number Theory Seminar Seattle, 28 April 2015 Elliptic Curve Cryptography 1985:
More informationOn the complexity of computing discrete logarithms in the field F
On the complexity of computing discrete logarithms in the field F 3 6 509 Francisco Rodríguez-Henríquez CINVESTAV-IPN Joint work with: Gora Adj Alfred Menezes Thomaz Oliveira CINVESTAV-IPN University of
More informationElliptic Curve Cryptography
Elliptic Curve Cryptography Elliptic Curves An elliptic curve is a cubic equation of the form: y + axy + by = x 3 + cx + dx + e where a, b, c, d and e are real numbers. A special addition operation is
More informationLecture 1: Introduction to Public key cryptography
Lecture 1: Introduction to Public key cryptography Thomas Johansson T. Johansson (Lund University) 1 / 44 Key distribution Symmetric key cryptography: Alice and Bob share a common secret key. Some means
More informationFast, twist-secure elliptic curve cryptography from Q-curves
Fast, twist-secure elliptic curve cryptography from Q-curves Benjamin Smith Team GRACE INRIA Saclay Île-de-France Laboratoire d Informatique de l École polytechnique (LIX) ECC #17, Leuven September 16,
More informationFaster Explicit Formulas for Computing Pairings over Ordinary Curves
Faster Explicit Formulas for Computing Pairings over Ordinary Curves Diego F. Aranha 2, Koray Karabina 1, Patrick Longa 1, Catherine H. Gebotys 1, Julio López 2 1 University of Waterloo, {kkarabin,plonga,cgebotys}@uwaterloo.ca
More informationMontgomery Algorithm for Modular Multiplication with Systolic Architecture
Montgomery Algorithm for Modular Multiplication with ystolic Architecture MRABET Amine LIAD Paris 8 ENIT-TUNI EL MANAR University A - MP - Gardanne PAE 016 1 Plan 1 Introduction for pairing Montgomery
More informationOn A Large-scale Multiplier for Public Key Cryptographic Hardware
1,a) 1 1 1 1 1 Wallace tree n log n 64 128 Wallace tree,, Wallace tree,, VHDL On A Large-scale Multiplier for Public Key Cryptographic Hardware Masaaki Shirase 1,a) Kimura Keigo 1 Murayama Hiroyuki 1 Kato
More informationElliptic curves: Theory and Applications. Day 4: The discrete logarithm problem.
Elliptic curves: Theory and Applications. Day 4: The discrete logarithm problem. Elisa Lorenzo García Université de Rennes 1 14-09-2017 Elisa Lorenzo García (Rennes 1) Elliptic Curves 4 14-09-2017 1 /
More informationAn FPGA-based Accelerator for Tate Pairing on Edwards Curves over Prime Fields
. Motivation and introduction An FPGA-based Accelerator for Tate Pairing on Edwards Curves over Prime Fields Marcin Rogawski Ekawat Homsirikamol Kris Gaj Cryptographic Engineering Research Group (CERG)
More informationA Remark on Implementing the Weil Pairing
A Remark on Implementing the Weil Pairing Cheol Min Park 1, Myung Hwan Kim 1 and Moti Yung 2 1 ISaC and Department of Mathematical Sciences, Seoul National University, Korea {mpcm,mhkim}@math.snu.ac.kr
More informationImplementing Cryptographic Pairings over Barreto-Naehrig Curves
Implementing Cryptographic Pairings over Barreto-Naehrig Curves Augusto Jun Devegili 1, Michael Scott 2, and Ricardo Dahab 1 1 Instituto de Computação, Universidade Estadual de Campinas Caixa Postal 6176,
More informationNumber Theory in Cryptology
Number Theory in Cryptology Abhijit Das Department of Computer Science and Engineering Indian Institute of Technology Kharagpur October 15, 2011 What is Number Theory? Theory of natural numbers N = {1,
More informationBabai round-off CVP method in RNS: application to latice based cryptographic protocols
University of Wollongong Research Online Faculty of Engineering and Information Sciences - Papers: Part A Faculty of Engineering and Information Sciences 2015 Babai round-off CVP method in RNS: application
More informationIntroduction to Cryptology. Lecture 20
Introduction to Cryptology Lecture 20 Announcements HW9 due today HW10 posted, due on Thursday 4/30 HW7, HW8 grades are now up on Canvas. Agenda More Number Theory! Our focus today will be on computational
More informationModular Multiplication in GF (p k ) using Lagrange Representation
Modular Multiplication in GF (p k ) using Lagrange Representation Jean-Claude Bajard, Laurent Imbert, and Christophe Nègre Laboratoire d Informatique, de Robotique et de Microélectronique de Montpellier
More informationImproving Modular Inversion in RNS using the Plus-Minus Method
Author manuscript, published in "CHES - 15th Workshop on Cryptographic Hardware and Embedded Systems - 2013 8086 (2013) 233-249" DOI : 10.1007/978-3-642-40349-1_14 Improving Modular Inversion in RNS using
More informationInternational Journal of Advanced Computer Technology (IJACT)
AN EFFICIENT DESIGN OF LOW POWER,FAST EL- LIPTIC CURVE SCALAR MULTIPLIER IN ECC USING S Jayalakshmi K R, M.Tech student, Mangalam college of engineering,kottayam,india; Ms.Hima Sara Jacob, Assistant professor,
More informationA High Speed Pairing Coprocessor Using RNS and Lazy Reduction
A High Speed Pairing Coprocessor Using RNS and Lazy Reduction Gavin Xiaoxu Yao 1, Junfeng Fan 2, Ray C.C. Cheung 1, and Ingrid Verbauwhede 2 1 Department of Electronic Engineering City University of Hong
More informationA note on López-Dahab coordinates
A note on López-Dahab coordinates Tanja Lange Faculty of Mathematics, Matematiktorvet - Building 303, Technical University of Denmark, DK-2800 Kgs. Lyngby, Denmark tanja@hyperelliptic.org Abstract López-Dahab
More informationCPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer 1 Lecture 13 October 16, 2017 (notes revised 10/23/17) 1 Derived from lecture notes by Ewa Syta. CPSC 467, Lecture 13 1/57 Elliptic Curves
More informationSingle Base Modular Multiplication for Efficient Hardware RNS Implementations of ECC
Single Base Modular Multiplication for Efficient Hardare RNS Implementations of ECC Karim Bigou and Arnaud Tisserand CNRS, IRISA, INRIA Centre Rennes - Bretagne Atlantique and University Rennes 1, 6 rue
More informationPairing-Friendly Elliptic Curves of Prime Order
Pairing-Friendly Elliptic Curves of Prime Order Paulo S. L. M. Barreto 1 Michael Naehrig 2 1 University of São Paulo pbarreto@larc.usp.br 2 RWTH Aachen University mnaehrig@ti.rwth-aachen.de SAC 2005 Outline
More informationSide-Channel Analysis on Blinded Regular Scalar Multiplications
Side-Channel Analysis on Blinded Regular Scalar Multiplications Extended Version Benoit Feix 1 and Mylène Roussellet 2 and Alexandre Venelli 3 1 UL Security Transactions, UK Security Lab benoit.feix@ul.com
More informationElliptic Curves Cryptography and factorization. Part VIII. Elliptic curves cryptography and factorization. Historical Remarks.
Elliptic Curves Cryptography and factorization Part VIII Elliptic curves cryptography and factorization Cryptography based on manipulation of points of so called elliptic curves is getting momentum and
More informationAn Algorithm for the η T Pairing Calculation in Characteristic Three and its Hardware Implementation
An Algorithm for the η T Pairing Calculation in Characteristic Three and its Hardware Implementation Jean-Luc Beuchat 1 Masaaki Shirase 2 Tsuyoshi Takagi 2 Eiji Okamoto 1 1 Graduate School of Systems and
More informationScalar multiplication in compressed coordinates in the trace-zero subgroup
Scalar multiplication in compressed coordinates in the trace-zero subgroup Giulia Bianco and Elisa Gorla Institut de Mathématiques, Université de Neuchâtel Rue Emile-Argand 11, CH-2000 Neuchâtel, Switzerland
More informationKatherine Stange. Pairing, Tokyo, Japan, 2007
via via Department of Mathematics Brown University http://www.math.brown.edu/~stange/ Pairing, Tokyo, Japan, 2007 Outline via Definition of an elliptic net via Definition (KS) Let R be an integral domain,
More informationCPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Instructor: Michael Fischer Lecture by Ewa Syta Lecture 13 March 3, 2013 CPSC 467b, Lecture 13 1/52 Elliptic Curves Basics Elliptic Curve Cryptography CPSC
More informationA High Speed Coprocessor for Elliptic Curve Scalar Multiplications over F p
A High Speed Coprocessor for Elliptic Curve Scalar Multiplications over F p Nicolas Guillermin 1,2 1 DGA Information Superiority, Bruz, France 2 IRMAR, Université Rennes 1, France Abstract. We present
More informationHyperelliptic-curve cryptography. D. J. Bernstein University of Illinois at Chicago
Hyperelliptic-curve cryptography D. J. Bernstein University of Illinois at Chicago Thanks to: NSF DMS 0140542 NSF ITR 0716498 Alfred P. Sloan Foundation Two parts to this talk: 1. Elliptic curves; modern
More informationLecture Notes, Week 6
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467b: Cryptography and Computer Security Week 6 (rev. 3) Professor M. J. Fischer February 15 & 17, 2005 1 RSA Security Lecture Notes, Week 6 Several
More informationEfficient random number generation on FPGA-s
Proceedings of the 9 th International Conference on Applied Informatics Eger, Hungary, January 29 February 1, 2014. Vol. 1. pp. 313 320 doi: 10.14794/ICAI.9.2014.1.313 Efficient random number generation
More informationThe only method currently known for inverting nf-exp requires computing shortest vectors in lattices whose dimension is the degree of the number eld.
A one way function based on ideal arithmetic in number elds Johannes Buchmann Sachar Paulus Abstract We present a new one way function based on the diculty of nding shortest vectors in lattices. This new
More informationIntroduction to Modern Cryptography. Benny Chor
Introduction to Modern Cryptography Benny Chor RSA Public Key Encryption Factoring Algorithms Lecture 7 Tel-Aviv University Revised March 1st, 2008 Reminder: The Prime Number Theorem Let π(x) denote the
More informationThéorie de l'information et codage. Master de cryptographie Cours 10 : RSA. 20,23 et 27 mars Université Rennes 1
Théorie de l'information et codage Master de cryptographie Cours 10 : RSA 20,23 et 27 mars 2009 Université Rennes 1 Master Crypto (2008-2009) Théorie de l'information et codage 20,23 et 27 mars 2009 1
More informationSelecting Elliptic Curves for Cryptography: An Eciency and Security Analysis
Selecting Elliptic Curves for Cryptography: An Eciency and Security Analysis Joppe W. Bos, Craig Costello, Patrick Longa and Michael Naehrig Microsoft Research, USA Abstract. We select a set of elliptic
More informationEfficient Pairings Computation on Jacobi Quartic Elliptic Curves
Efficient Pairings Computation on Jacobi Quartic Elliptic Curves Sylvain Duquesne 1, Nadia El Mrabet 2, and Emmanuel Fouotsa 3 1 IRMAR, UMR CNRS 6625, Université Rennes 1, Campus de Beaulieu 35042 Rennes
More informationCryptography IV: Asymmetric Ciphers
Cryptography IV: Asymmetric Ciphers Computer Security Lecture 7 David Aspinall School of Informatics University of Edinburgh 31st January 2011 Outline Background RSA Diffie-Hellman ElGamal Summary Outline
More informationLow-Weight Polynomial Form Integers for Efficient Modular Multiplication
1 Low-Weight Polynomial Form Integers for Efficient Modular Multiplication Jaewook Chung and M. Anwar Hasan February 9, 2006 Abstract In 1999, Jerome Solinas introduced families of moduli called the generalized
More informationFast point multiplication algorithms for binary elliptic curves with and without precomputation
Fast point multiplication algorithms for binary elliptic curves with and without precomputation Thomaz Oliveira 1 Diego F. Aranha 2 Julio López 2 Francisco Rodríguez-Henríquez 1 1 CINVESTAV-IPN, Mexico
More informationFPGA Implementation of Pairings using Residue Number System and Lazy Reduction
FPGA Implementation of Pairings using Residue Number System and Lazy Reduction Ray C.C. Cheung 1, Sylvain Duquesne 2, Junfeng Fan 4, Nicolas Guillermin 2,3, Ingrid Verbauhede 4, and Gavin Xiaoxu Yao 1
More informationConstructing Tower Extensions of Finite Fields for Implementation of Pairing-Based Cryptography
Constructing Tower Extensions of Finite Fields for Implementation of Pairing-Based Cryptography Naomi Benger and Michael Scott, 1 School of Computing, Dublin City University, Ireland nbenger@computing.dcu.ie
More informationOptimal TNFS-secure pairings on elliptic curves with even embedding degree
Optimal TNFS-secure pairings on elliptic curves with even embedding degree Georgios Fotiadis 1 and Chloe Martindale 2 1 University of the Aegean, Greece gfotiadis@aegean.gr 2 Technische Universiteit Eindhoven,
More informationLecture 6: Cryptanalysis of public-key algorithms.,
T-79.159 Cryptography and Data Security Lecture 6: Cryptanalysis of public-key algorithms. Helsinki University of Technology mjos@tcs.hut.fi 1 Outline Computational complexity Reminder about basic number
More informationMathematics of Cryptography
UNIT - III Mathematics of Cryptography Part III: Primes and Related Congruence Equations 1 Objectives To introduce prime numbers and their applications in cryptography. To discuss some primality test algorithms
More information