FPGA Implementation of Point Multiplication on Koblitz Curves Using Kleinian Integers

Transcription

1 FPGA Ipleentation of Point Multiplication on Koblitz Curves Using Kleinian Integers V.S. Diitrov 1 K.U. Järvinen 2 M.J. Jacobson, Jr. 3 W.F. Chan 3 Z. Huang 1 February 28, 2012 Diitrov et al. (Univ. Calgary) February 28, / 15

2 Introduction Introduction to Elliptic Curve Cryptography Public-key cryptography ethod which uses a group of points on an elliptic curve, E, defined over a finite field, F q Faster and shorter keys than, e.g., RSA Diitrov et al. (Univ. Calgary) February 28, / 15

3 Introduction Introduction to Elliptic Curve Cryptography Public-key cryptography ethod which uses a group of points on an elliptic curve, E, defined over a finite field, F q Faster and shorter keys than, e.g., RSA Elliptic Curve Point Multiplication Q = kp where k is a positive integer and P =(x, y) is a point on E Coputed with point additions, P 1 + P 2,and point doublings, 2P 1 Diitrov et al. (Univ. Calgary) February 28, / 15

4 Introduction Point Multiplication on Koblitz Curves Koblitz curves Frobenius aps, φ(p 1 ), instead of point doublings faster coputation k ust be converter to τ-adic representation Diitrov et al. (Univ. Calgary) February 28, / 15

5 Introduction Point Multiplication on Koblitz Curves Koblitz curves Frobenius aps, φ(p 1 ), instead of point doublings faster coputation k ust be converter to τ-adic representation Point ultiplication Frobenius ap for all bits of k Point addition if the bit is 1 Diitrov et al. (Univ. Calgary) February 28, / 15

6 Introduction Point Multiplication on Koblitz Curves Koblitz curves Frobenius aps, φ(p 1 ), instead of point doublings faster coputation k ust be converter to τ-adic representation Point ultiplication Exaple Frobenius ap for all bits of k Point addition if the bit is A AAA A AAAA A 10 Diitrov et al. (Univ. Calgary) February 28, / 15

7 Introduction Point Multiplication on Koblitz Curves Koblitz curves Frobenius aps, φ(p 1 ), instead of point doublings faster coputation k ust be converter to τ-adic representation Point ultiplication Exaple Frobenius ap for all bits of k Point addition if the bit is 1, point subtraction if A AAA A AAAA A A A S A A S A 7 Diitrov et al. (Univ. Calgary) February 28, / 15

8 Introduction Koblitz Curves Koblitz curves (defined over F 2 ): E a : y 2 + xy = x 3 + ax 2 +1, a {0, 1} E a (F 2 ) easily coputed for any integer > 0 Frobenius endoorphis τ(x, y) =(x 2, y 2 ): alost free to copute satisfies inial polynoial x 2 µx +2=0whereµ =( 1) 1 a can view τ as a root, i.e., τ =(µ + 7)/2 leads to efficient τ-adic point ultiplication algoriths (eg. τ NAF) Diitrov et al. (Univ. Calgary) February 28, / 15

9 Theoretical Results Double Base Expansions Diitrov, Jullien, Miller (1998): copute kp using k = ±2 a 3 b requires only O(log k/(log log k)) (2, 3)-integers find closest ±2 a 3 b to k, subtract and repeat Our contribution: efficient point ultiplication on Koblitz curves first provably sublinear point ultiplication algorith (3 coplex bases) efficient ethod using bases τ and τ 1 (no proof, conjectural sublinearity) no precoputations based on k or P efficient FPGA ipleentation Diitrov et al. (Univ. Calgary) February 28, / 15

10 Theoretical Results Kleinian Integer Expansions Kleinian integers: x + yτ Z[τ] (τ,τ 1)-Kleinian integers: ±τ a (τ 1) b (τ,τ 1,τ 2 τ 1)-Kleinian integers: ±τ a (τ 1) b (τ 2 τ 1) c Theore: k Z[τ] can be represented by a su of O(log N(k)/(log log N(k))) (τ,τ 1,τ 2 τ 1)-Kleinian integers Conjecture: sae for (τ,τ 1)-Kleinian integers Proof for bases 2 and 3 doesn t generalize (only for real bases) Greedy algorith doesn t generalize well: hard to find closest (τ,τ 1)-Kleinian integer to k Diitrov et al. (Univ. Calgary) February 28, / 15

11 Algoriths Conversion Algorith Copute k = d ±τ a i (τ 1) b i for k Z[τ] i=1 Precoputation: inial representation for every q = 1 Copute unsigned τ-adic expansion of k. 2 Divide τ-adic expansion into blocks of length w. w 1 i=0 d i τ i, d i {0, 1} 3 Substitute each block with inial (τ,τ 1)-expansion ties appropriate power of τ Assuing the conjecture, d and ax(b i ) are both sublinear in log N(k) Diitrov et al. (Univ. Calgary) February 28, / 15

12 Algoriths Exaple k = 6465, E 1 (F 2 163), τ=(1+ 7)/2 partial reduction odulo (τ 163 1)/(τ 1) k ξ = τ Using block size 7 we have: ξ = τ 13 + τ 12 + τ 11 + τ 9 + τ 5 + τ 2 Diitrov et al. (Univ. Calgary) February 28, / 15

13 Exaple Algoriths k = 6465, E 1 (F 2 163), τ=(1+ 7)/2 partial reduction odulo (τ 163 1)/(τ 1) k ξ = τ Using block size 7 we have: ξ = τ 13 + τ 12 + τ 11 + τ 9 + τ 5 + τ 2 = τ 7 τ 6 + τ 5 + τ 4 + τ 2 + τ 5 + τ 2 Diitrov et al. (Univ. Calgary) February 28, / 15

14 Exaple Algoriths k = 6465, E 1 (F 2 163), τ=(1+ 7)/2 partial reduction odulo (τ 163 1)/(τ 1) k ξ = τ Using block size 7 we have: ξ = τ 13 + τ 12 + τ 11 + τ 9 + τ 5 + τ 2 = τ 7 τ 6 + τ 5 + τ 4 + τ 2 + τ 5 + τ 2 = τ 7 τ(τ 1) + τ(τ 1) 6 Diitrov et al. (Univ. Calgary) February 28, / 15

15 Exaple Algoriths k = 6465, E 1 (F 2 163), τ=(1+ 7)/2 partial reduction odulo (τ 163 1)/(τ 1) k ξ = τ Using block size 7 we have: ξ = τ 13 + τ 12 + τ 11 + τ 9 + τ 5 + τ 2 = τ 7 τ 6 + τ 5 + τ 4 + τ 2 + τ 5 + τ 2 = τ 7 τ(τ 1) + τ(τ 1) 6 + τ 2 (τ 1) 2 Diitrov et al. (Univ. Calgary) February 28, / 15

16 Exaple Algoriths k = 6465, E 1 (F 2 163), τ=(1+ 7)/2 partial reduction odulo (τ 163 1)/(τ 1) k ξ = τ Using block size 7 we have: ξ = τ 13 + τ 12 + τ 11 + τ 9 + τ 5 + τ 2 = τ 7 τ 6 + τ 5 + τ 4 + τ 2 + τ 5 + τ 2 = τ 7 τ(τ 1) + τ(τ 1) 6 + τ 2 (τ 1) 2 = τ 8 (τ 1) + τ 8 (τ 1) 6 + τ 2 (τ 1) 2 Diitrov et al. (Univ. Calgary) February 28, / 15

17 Algoriths Point Multiplication Algorith Given k = d s i τ a i (τ 1) b i can write i=1 k = ax(b i ) (τ 1) j ax(a i,j ) j=0 i=1 s i,j τ a i,j Copute kp using ax(b i ) τ-adic expansions Cost: ultiply by (τ 1) : one τ, one point subtraction overall: ax(b i )+d 1 point adds/subs nuber of point additions required is sublinear in N(k) Diitrov et al. (Univ. Calgary) February 28, / 15

18 Algoriths Nuerical Evidence Avg nuber of point adds to copute kp on E a (F 2 ) Blocking τnaf Greedy w =5 w = 10 w = Fewer point adds than τnaf in all cases w =5requires< 1 KB ROM (no points need to be stored) Diitrov et al. (Univ. Calgary) February 28, / 15

19 FPGA ipleentation Preliinaries Coputation of Algoriths Specifications NIST curve K-163 F 2 163, noralbasis Diitrov et al. (Univ. Calgary) February 28, / 15

20 FPGA ipleentation Preliinaries Coputation of Algoriths Specifications NIST curve K-163 F 2 163, noralbasis Coputed one row, i.e. ( j k i,jτ j )(τ 1) i P,atatie Each row is coputed as a τ NAF point ultiplication Point ultiplication algorith Input: k, P Output: Q = kp P 0 P; Q O for i =0toax(b i ) do S r i (k)p i P i+1 τp i P i Q Q + S end for Diitrov et al. (Univ. Calgary) February 28, / 15

21 FPGA ipleentation Preliinaries Coputation of Algoriths Specifications NIST curve K-163 F 2 163, noralbasis Point ultiplication algorith Input: k, P Output: Q = kp P 0 P; Q O for i =0toax(b i ) do S r i (k)p i P i+1 τp i P i Q Q + S end for Coputed one row, i.e. ( j k i,jτ j )(τ 1) i P,atatie Each row is coputed as a τ NAF point ultiplication Point addition in ixed coordinates (LD/A) and Frobenius ap in LD S S ± P i ; S τs Diitrov et al. (Univ. Calgary) February 28, / 15

22 FPGA ipleentation Preliinaries Coputation of Algoriths Specifications NIST curve K-163 F 2 163, noralbasis Point ultiplication algorith Input: k, P Output: Q = kp P 0 P; Q O for i =0toax(b i ) do S r i (k)p i P i+1 τp i P i Q Q + S end for Coputed one row, i.e. ( j k i,jτ j )(τ 1) i P,atatie Each row is coputed as a τ NAF point ultiplication Point addition in ixed coordinates (LD/A) and Frobenius ap in LD S S ± P i ; S τs Frobenius ap and point subtraction in A P i+1 τp i P i Diitrov et al. (Univ. Calgary) February 28, / 15

23 FPGA ipleentation Preliinaries Coputation of Algoriths Specifications NIST curve K-163 F 2 163, noralbasis Point ultiplication algorith Input: k, P Output: Q = kp P 0 P; Q O for i =0toax(b i ) do S r i (k)p i P i+1 τp i P i Q Q + S end for Coputed one row, i.e. ( j k i,jτ j )(τ 1) i P,atatie Each row is coputed as a τ NAF point ultiplication Point addition in ixed coordinates (LD/A) and Frobenius ap in LD S S ± P i ; S τs Frobenius ap and point subtraction in A P i+1 τp i P i Point addition in LD Q Q + S Diitrov et al. (Univ. Calgary) February 28, / 15

24 FPGA ipleentation Preliinaries Coputation of Algoriths Specifications NIST curve K-163 F 2 163, noralbasis Point ultiplication algorith Input: k, P Output: Q = kp P 0 P; Q O for i =0toax(b i ) do S r i (k)p i P i+1 τp i P i Q Q + S end for Coputed one row, i.e. ( j k i,jτ j )(τ 1) i P,atatie Each row is coputed as a τ NAF point ultiplication Point addition in ixed coordinates (LD/A) and Frobenius ap in LD S S ± P i ; S τs Frobenius ap and point subtraction in A P i+1 τp i P i Point addition in LD Q Q + S LD A apping Diitrov et al. (Univ. Calgary) February 28, / 15

25 FPGA ipleentation Architecture Field arithetic processor (FAP) DATA IN Storage RAM DATA OUT 512 -bit dual-port Adder Multiplier Squarer ADDRA ADDRB 9 9 RAM OPER 4 Control logic SHIFT 6 Diitrov et al. (Univ. Calgary) February 28, / 15

26 FPGA ipleentation Architecture Field arithetic processor (FAP) DATA IN Storage RAM DATA OUT 512 -bit dual-port Adder Multiplier Squarer ADDRA ADDRB 9 9 RAM OPER 4 Control logic SHIFT 6 Multiplier Digit-serial Massey-Oura ultiplier Latency: 9 clock cycles Diitrov et al. (Univ. Calgary) February 28, / 15

27 FPGA ipleentation Architecture Field arithetic processor (FAP) DATA IN Storage RAM DATA OUT 512 -bit dual-port Adder Multiplier Squarer ADDRA ADDRB 9 9 RAM OPER 4 Control logic SHIFT 6 Adder and squarer Adder: bitwise exclusive-or (xor) Squarer: shifter (ax shift 2 6 1) Diitrov et al. (Univ. Calgary) February 28, / 15

28 FPGA ipleentation Architecture Field arithetic processor (FAP) DATA IN Storage RAM DATA OUT 512 -bit dual-port Adder Multiplier Squarer ADDRA ADDRB 9 9 RAM OPER 4 Control logic SHIFT 6 Storage RAM Dual-port RAM ipleented in BlockRAMs 5 BlockRAMs needed (One B-RAM: bits) Diitrov et al. (Univ. Calgary) February 28, / 15

29 FPGA ipleentation Architecture Syste architecture {τ,τ 1}-converter Converts k into {τ,τ 1}-expansion Partial reduction (Solinas, 2000), coputation of τ-adic expansion and blocking algorith (w = 10) Control logic and FAP FAP controlled by hand-optiized control sequences stored in a ROM (BlockRAM) k parsed and the ROM controlled by an FSM Converter and the rest of the design use different clocks Latency of a point ultiplication (excluding conversion): L kp = 104 d ax(b i ) + 84 Diitrov et al. (Univ. Calgary) February 28, / 15

30 FPGA ipleentation Results Results Xilinx Virtex-II XC2V Maxiu clock frequency: 128 MHz Resource requireents: 6,494 slices and 6 BlockRAMs Converter: 88 MHz, 2,251 slices, 2 BlockRAMs and 2 ultipliers One conversion requires 3.81 µs ax(b i ) d LD/A A LD L kp Tie (µs) Diitrov et al. (Univ. Calgary) February 28, / 15

31 Future Work Future work Copare with ASIACRYPT 2006 (Avanzi, Diitrov, Doche, Sica): proof of sublinear density for 2 coplex bases eory-free conversion algorith: Window ethod analogues (fixed base point): two-diensional windows? Analogue for hyperelliptic curves? Ipleentation iproveents: Coputing rows in parallel leads to shorter latency Polynoial basis ipleentation Diitrov et al. (Univ. Calgary) February 28, / 15