Performance Analysis of the Postcomputation- Based Generic-Point Parallel Scalar Multiplication Method

Transcription

1 P a g e 3 Vol. 1 Issue 11 (Ver. 1.) October 1 Global Journal of Computer Scence and Technology Performance Analyss of the Postcomputaton- Based Generc-Pont Parallel Scalar Multplcaton Method Tur F. Al-Soman GJCST Classfcaton (FOR) F.3.1, F.1. Abstract- A Postcomputaton-based generc-pont parallel scalar multplcaton method has recently been proposed for hgh-performance end servers that employ parallel ellptc curve cryptoprocessors. The sequental precomputaton overheads, n the postcomputaton-based method, are replaced wth parallelzable postcomputatons. Ths paper analyzes the performance of the postcomputaton-based method wth 18 m 56 usng a number of parallel ellptc curve cryptoprocessors. The results show that the best performance s acheved when eght cryptoprocessors are used. Keywords- Ellptc Curve Cryptosystems, Parallel Scalar Multplcaton, Precomputatons, Postcomputatons, Generc-Pont Scalar Multplcaton. E I. INTRODUCTION llptc curve cryptosystems (ECCs), whch were ntally proposed by Nel Kobltz and Vctor Mller n 1985 [1], are seen as serous alternates to the RSA system but wth a much shorter word length. An ECC wth a ey sze of bts has been shown to offer equal securty to an RSA system wth a ey sze of 1 Kbts []. To date, no sgnfcant breathroughs have been made n determnng the weanesses of ECCs, whch are based on a dscrete logarthm problem over ponts on an ellptc curve. The fact that the problem appears so dffcult to crac means that ey szes can be consderably, and possbly even exponentally, reduced [3]. Ths advantage of ECCs has ganed recognton recently, and has resulted n ther ncorporaton n many standards such as IEEE, ANSI, NIST, SEC and WTLS.Scalar multplcaton s the basc operaton for ECCs. Scalar multplcaton of a group of ponts on an ellptc curve s analogous to the exponentaton of a multplcate group of ntegers modulo a fxed nteger m. The scalar multplcaton operaton, denoted as, where s an nteger and s a pont on the ellptc curve, represents the addton of copes of pont. Scalar multplcaton s then computed by a seres of pont doublng and pont addton operatons of the pont P that depends on the bt sequence that represents the scalar multpler. Several scalar multplcaton methods have been proposed [4]. However, for hgh-performance end servers, the current sequental scalar multplcaton methods are too slow to meet the demands of ncreasng number of customers. About-Tur F. Al-Soman s wth the Department of Computer Engneerng, Faculty of Engneerng, Al-Baha Unersty, Al-Baha, Saud Araba.Emal: tfsoman@bu.edu.sa Identfyng effcent scalar multplcaton methods for such servers has thus become crucal. Scalar multplcaton methods that can be parallelzed are often used for hghspeed mplementatons. Precomputatons [4-6] have also been appled to speed up scalar multplcaton, but requre sequental steps that cannot be parallelzed, and are prmarly advantageous bascally when the ellptc curve pont s fxed. However, durng secure communcaton sessons that use publc eys the ellptc curve pont changes, as t depends on the publc ey of the communcatng entty, that s, t s sesson dependant. Ths s also the case when dgtal sgnatures are used. Hence, the computaton of scalar multplcatons s generally performed wth a generc ellptc curve pont. Because the ellptc curve pont s lely to dffer n each sesson, the overheads resultng from the necessary precomputatons must be consdered when estmatng the total computatonal tme requred. Postcomputatons have recently been proposed [7] as an alternate method to speedup scalar multplcatons. In [7], the precomputaton overheads are replaced by postcomputatons that can be parallelzed. Ths paper shows that the concurrent precomputaton of several ponts outperforms the method proposed n [7] wth the same number of ponts and parallel processors. The remander of the paper s organzed as follows. Secton ntroduces the basc ECC. Secton 3 descrbes the postcomputaton-based generc-pont parallel scalar multplcaton method [7]. Secton 4 presents a performance analyss of the postcomputaton-based method. Secton 5 concludes. II. ELLIPTIC CURVE CRYPTO PRELIMINARIES Ellptc curve cryptosystems (ECCs) [4] have attracted much research attenton and have been ncluded n many standards. ECCs are evolvng as an attracte alternate to other publc-ey schemes such as RSA by offerng a smaller ey sze and a hgher strength per bt. Extense research has been conducted on the underlyng math, securty strength and effcent mplementatons of ECCs. Of the varous felds that can underle ellptc curves, prme felds GF(p) and bnary felds GF( m ) have proved to be best suted to cryptographc applcatons. An ellptc curve E over the fnte feld GF(p) defned by the parameters a, b GF(p) wth p > 3 conssts of the set of ponts P = (x, y), where x, y GF(p), that satsfes the equaton y x 3 ax where a, b GF(p) and 4a 3 + 7b mod p, together wth the addte dentty of the group pont O nown as the b (1)

2 Global Journal of Computer Scence and Technology Vol. 1 Issue 11 (Ver. 1.) October 1 P a g e 33 pont at nfnty [4]. The number of ponts #E on an ellptc curve over a fnte feld GF(q) s defned by Hasse s theorem [4]. The dscrete ponts on an ellptc curve form an abelan group, the group operaton of whch s nown as pont addton. Ellptc curve pont addton s defned accordng to the chord-tangent process. Pont addton over GF(p) can be descrbed as follows.let P and Q be two dstnct ponts on E defned over GF(p) wth Q P (Q s not the addte nverse of P). The addton of the ponts P and Q ges the pont R (R = P + Q), where R s the addte nverse of S and S s a thrd pont on E ntercepted by the straght lne through ponts P and Q. The addte nverse of (6) pont P = (x, y) E over GF(p) s the pont P = (x, y), whch s the mrror of pont P wth respect to the x-axs on E. When P = Q and P P, the addton of P and Q s the pont R (R = P), where R s the addte nverse of S and S s the thrd pont on E ntercepted by the straght lne tangental to the curve at pont P. Ths operaton s referred to as pont doublng. The fnte feld GF( m ) has partcular mportance n cryptography, as t leads to very effcent hardware mplementatons. Elements of the feld are represented n terms of a bass. Most mplementatons use ether a polynomal bass or a normal bass [8]. Lettng GF( m ) be a fnte feld of characterstc two, a nonsupersngular ellptc curve E over GF( m ) can be defned as the set of solutons (x, y) GF( m ) GF( m ) to the equaton y xy x 3 ax where a and b GF( m ), b, together wth the pont at nfnty. It s well nown that E forms a commutate fnte group, wth O as the group dentty, under the addton operaton nown as the tangent and chord method. Explct ratonal formulas for the addton rule nvolve several feld arthmetc operatons (addton, squarng, multplcaton and nverson) n the underlyng fnte feld. The group operatons n affne coordnate systems nvolve fnte feld nverson, whch s a very costly operaton, partcularly for prme felds. Projecte coordnate systems can be used to elmnate the need to perform nversons. Several projecte coordnate systems have been proposed n the lterature, ncludng the homogeneous, Jacoban, Chudnovsy- Jacoban, modfed Jacoban, Lopez-Dahab, Edwards and mxed coordnate systems [9][1].Several scalar multplcaton methods have been proposed n the lterature [4]. Computng P can be acheved wth a straghtforward bnary method the so-called double-and-add method based on the bnary expresson of the multpler. P can be computed usng a bnary method as follows. Let = ( m-1,, ), where m-1 s the most sgnfcant bt of, be the bnary representaton of. The multpler can be wrtten as m 1 m 1 1 (3) m Usng the Horner expanson, can be rewrtten as (( ) ) ) (4) Accordngly, ( m 1 m 1 b () P ( ( P P) P P (5) m 1 m 1 ) The algorthm for the bnary method s as follows. Algorthm 1: Bnary Method (1) Input P,. () Q O. (3) For from m 1 down to, perform a. Q Q, b. If = 1, then Q Q + P. (4) End for. (5) Output Q. The bnary scalar multplcaton method s the most straghtforward scalar multplcaton method. It nspects the bts of the scalar multpler. If the nspected bt =, then only pont doublng s performed. If, however, the nspected bt = 1, then both pont doublng and addton are performed. The bnary method requres m pont doublngs and an average of m/ pont addtons. Non-adjacent form (NAF) reduces the average number of pont addtons to m/3 [11]. Wth NAF, sgned-dgt representatons are used such that the scalar multpler s coeffcent {, ±1}. NAF has the property that no two consecute coeffcents are nonzero. It also has the property that every poste nteger has a unque NAF encodng, whch s denoted as NAF(). III. THE POSTCOMPUTATION-BASED METHOD The essental concept underlyng the method proposed n [7] s the replacement of sequental precomputatons wth parallelzable postcomputatons. Multpler n [7] s parttoned nto parttons that can be processed n parallel by processors usng the bnary method. Some of the postcomputatons are then dstrbuted on processors to be performed n parallel. The ponts that result from processng these ey parttons wth the postcomputatons are then assmlated to produce. Let, where s the most sgnfcant bt of, be the bnary representaton of multpler. Then, after parttonng nto parttons, multpler can be wrtten as Scalar multplcaton product where t P s defned as ( ( 1 ( t u v 1 P )) ( can then be computed as P ) ( v P ) ( A ey observaton s that Eq. (8) can be rewrtten as P )) (6) (7) (8)

3 P a g e 34 Vol. 1 Issue 11 (Ver. 1.) October 1 Global Journal of Computer Scence and Technology t ( )[ ( ( P P ) 1 P ) P ] v 1 v Eq. (9) mples that the requred precomputatons of Eq. (8) can be replaced by postcomputatons, whch are pont doublngs. Each partton requres pont doublngs to produce the correct partal product. To balance the number of pont operatons, we need to balance the total number of feld multplcatons, as feld multplcaton s the domnant type of operaton n ellptc curve pont operatons n projecte coordnates. Ths mples that multpler should be parttoned nto parttons of dfferent szes, as shown n Eq. (1). m u 1) u ) 1) ) (1) Accordngly, the number of bts n partton must be greater than the number of those n and fewer than the number of those n, as can be seen from Eq. (11). m ( 1) u ) 1) ) u (11) Assume that the double and add pont operatons requre and feld multplcatons, respectely. Then, let the total number of feld multplcatons n partton equal. Because partton s the only one to requre no postcomputatons, a balanced number of pont operatons can be reached by solvng Eqs. (1) and (11) together wth the followng equatons (1-14). j (9) ) M ( ) ) ( r ) ( s ) (1) ) M ( ) ) ( r) ( s) ( r) m j (13) M M M (14) ( ) ( 1) ( u 1) The computaton of n parallel wthout precomputatons can be performed effcently usng the followng algorthm. Algorthm : Postcomputaton-based Method 1. Inputs:. By paddng wth zeros f necessary, solve Eqs. (1)-(14) together, and wrte, where s a partton of length bts. 3. Intalsaton:. 4. Parallel Scalar Multplcaton: 4.1. For to do n parallel Bnary method ( (), P ) If ( ), then Output R for to (( m j j ) ) do Example: Let,, and. The szes of the ey parttons are,, and. The ey parttons are,,, and. The scalar multplcaton of these parttons s then computed n parallel accordng to the followng =451, Fnally, s computed as IV. PERFORMANCE ANALYSIS The tme complexty of the proposed method n [7] equal to ( ) pont doublngs + pont addtons and ( ) pont doublngs + pont addtons usng bnary and NAF encodng, respectely. However, the proposed method n [7] has not been analyzed when dfferent values of and are used. Table 1 shows the lengths, n number of bts, of each ey partton. Table 1 also shows that no more than 8 processors should be used wth the proposed method n [7]. Ths s clearly shown when 1 processors are used and only 8 of the processors are utlzed. Table shows the results for the method proposed n [7]. In Table, the frst two columns show the ey sze and the number of parallel processors. The thrd column shows the length of the frst ey partton. The number of pont doublngs, addtons and accumulaton addtons are shown n the followng columns. It s assumed here that the requred computaton tme for pont addton s twce that requred for pont doublng. Accordngly, columns 8 and 9 show the total number of pont doublngs and addtons for the pont doublngs for bnary and NAF encodng, respectely. The results of Table are depcted n Fgure 1 and for bnary and NAF encodng, respectely. Clearly, the results show that the best performance s acheved when eght processors are used. Increasng the number of processors, however, does not mean better performance. V. CONCLUSION Sequental scalar multplcaton methods are too slow for hgh-performance end servers because of the demand resultng from ncreasng numbers of customers. Exstng parallel methods, however, requre sequental precomputatons for each new sesson. Recently, the frst generc-pont parallel scalar multplcaton method has been proposed. In the proposed method, the precomputaton overhead s replaced by postcomputatons that can be

4 Global Journal of Computer Scence and Technology Vol. 1 Issue 11 (Ver. 1.) October 1 P a g e 35 parallelzed. In ths paper we have analyzed the performance of the postcomputaton-based method wth 18 m 56 usng a number of parallel ellptc curve cryptoprocessors. The results show that the best performance s acheved when eght cryptoprocessors are used. VI. REFERENCES 1) Kobltz, N. (1987) Ellptc curve cryptosystems, Mathematcs of Computaton, 48, 3-9. ) Rest, R., Shamr, A. and Adleman, L. (1978) A method for obtanng dgtal sgnatures and publc ey cryptosystems, Communcatons of the ACM, 1,, ) Blae, I., Serouss, G. and Smart, N. (1999) Ellptc Curves n Cryptography, Cambrdge Unersty Press, New Yor. 4) Hanerson, D., Menezes, A. J. and Vanstone, S. (4), Gude to Ellptc Curve Cryptography, Sprnger-Verlag. 5) Brcell, E. F., Gordon, D. M., McCurley, K. S. and Wlson, D. B. (1993) Fast exponentaton wth precomputaton, Advances n Cryptology Eurocrypt 9, LNCS 658, pp. -7. Sprnger- Verlag. 6) Lm, C. H. and Lee, P. J. (1994) More flexble exponentaton wth precomputatons. Proc. CRYPTO 94, pp ) Al-Soman, T. F. and Ibrahm, M. K. (9) Genercpont parallel scalar multplcaton wthout precomputatons, IEICE Electroncs Express, 6, 4, ) Ldl, R. and Nederreter, H. (1994) Introducton to Fnte Felds and ther Applcatons. Cambrdge Unersty Press, Cambrdge, UK. 9) Cohen, H., Ono, T. and Myaj, A. (1998) Effcent ellptc curve exponentaton usng mxed coordnates. Advances n Cryptology SIACRYPT '98, LNCS 1514, pp Sprnger-Verlag. 1) Washngton, L. C. (8), Ellptc Curves: Number Theory and Cryptography, nd ed., CRC Press. 11) Joye, M. and Tymen, C. (1) Compact encodng of non-adjacent forms wth applcatons to ellptc curve cryptography, Publc Key Cryptography, LNCS 199, pp Sprnger-Verlag. Table 1: Results of the method proposed n [7] wth and

5 P a g e 36 Vol. 1 Issue 11 (Ver. 1.) October 1 Global Journal of Computer Scence and Technology Table : Results of the method proposed n [7] wth and. DBLs Bnary ADDs NAF ADDs Acc ADDs Bnary Total (DBLs) NAF Total (DBLs) Scalar Multplcaton (DBLs) No. of Processors m=18 m=16 m= m=56 Scalar Multplcaton (DBLs) No. of Processors m=18 m=16 m= m=56 Fgure 1: Bnary encodng results of the method proposed n [7] wth and. Fgure : NAF encodng results of the method proposed n [7] wth and.

6 Global Journal of Computer Scence and Technology Vol. 1 Issue 11 (Ver. 1.) October 1 P a g e 37 ) S.Ganapathy and S.Velusam, Desgn of MOEA based Decentralzed Load-Frequency Controllers for Interconnected Power Systems wth AC-DC Parallel Te-lnes, Internatonal Journal of Recent Trends n Engneerng, Vol., No. 5,.p: , November 9. 3) Goldberg, Genetc Algorthms n search, optmzaton and machne learnng Addson- Wesly, ) Ahmed A. A. Radwan, Bahgat A. Abdel Latef, Abdel Mged A. Al and Osman A. Sade, "Usng Genetc Algorthm to Improve Informaton Retreval Systems", World Academy of Scence and Engneerng Technology, Vol.17, No.,pp.6-13, May 6 5) Zheng and Kyooa, Genetc Algorthms Applcatons: Assgnment # for Dr. Z. Dong, November ) Tomoyu Hroyasu, "Desel Engne Desgn usng Mult-Objecte Genetc Algorthm", Techncal Report, 4 7) Hazra, J. Phulpn, Y. Ernst, D., HVDC control strateges to mprove transent stablty n nterconnected power systems, Power Tech, 9, IEEE Bucharest p.p. 1-6 DOI: 1.119/PTC