COMPARISON OF ALGORITHMS FOR ELLIPTIC CURVE CRYPTOGRAPHY OVER FINITE FIELDS OF GF(2 m )

Transcription

1 COMPARISON OF ALGORITHMS FOR ELLIPTIC CURVE CRYPTOGRAPHY OVER FINITE FIELDS OF GF( m ) Mahias Schmalisch Dirk Timmerma Uiversiy of Rosock Isiue of Applied Microelecroics ad Compuer Sciece Richard-Wager-Sr Rosock Germay {mahiasschmalisch dirkimmerma}@eechikui-rosockde Absrac For ellipic curve cryposysems does exis may algorihms ha compues he scalar muliplicaio k P Some are beer for a sofware soluio ad ohers are beer for a hardware soluio I his paper we compare algorihms wihou precompuaio for he scalar muliplicaio o ellipic curves over a fiie field of GF( m ) A he ed we show which algorihm is he bes for a hardware or sofware soluio Key Words ellipic curve crypography scalar muliplicaio algorihms 1 Iroducio Ellipic curve crypography (ECC) based o he scalar muliplicaio k P where k is a ieger ad P a poi o a ellipic curve The scalar muliplicaio ca be compued wih poi addiio ad poi doublig o he ellipic curve These agai are based o compuaios i fiie fields I he fiie field GF( m ) he arihmeic operaios addiio muliplicaio squarig ad iversio have o be suppored To compue he scalar muliplicaios several algorihms wih differe umbers of fiie field operaios exis The algorihms are spli i wo grea groups Oe group which compue he coordiaes of he pois i he affie plae ad he oher group usig he projecive plae If we compue he scalar muliplicaio i affie coordiaes he we eed a iversio for each poi addiio ad poi doublig O he oher had if we compue he scalar muliplicaio i projecive coordiaes we eed oly oe iversio bu more muliplicaios ad squarigs The iversio is he operaio which is he hardes o compue So he choice for a algorihm depeds o he speed of he iversio To compue he iversio here exis wo mehods oe is he exeded Euclidia Algorihm ad he oher is Ferma s Theorem The iversio wih Ferma's Theorem ca be compued wih several muliplicaios ad squarigs so his mehod is very applicable for sofware compuig For he exeded Euclidia Algorihm is a hardware soluio ha compues a iversio as fas as a muliplicaio Therefore for hardware soluios are oher algorihms beer ha for sofware soluios Ellipic Curves Ellipic Curve Crypography (ECC) firs suggesed by N Kobliz [1] ad V Miller [] i 1987 ad 1986 is used i he meaime for differe kids of cryposysems for isace digial sigaure algorihm [3] ad key exchage proocols [4] The securiy of hese cryposysems is based o he problem o compue he discree logarihm o ellipic curves This problem is harder o compue ha oher rapdoor oe-way fucios ha used for public key cryposysems Therefore he key legh for ECC ca be cosidered shorer i compariso wih oher well kow public key cryposysems such as RSA wih he same level of securiy So oday RSA eeds a key legh of 104 bis where ECC oly eeds 160 bis For he implemeaio of ellipic curve cryposysems i hardware are he ellipic curves over fiie field GF( m ) bes suiably I his case he field has he characerisic ad he equaio for a o-supersigular ellipic curve has he form E/ K : y + xy = x + a x + a 3 6 wih a 6 0 To compue he scalar muliplicaio we have o compue he poi addiio ad poi doublig o his curve 1 Affie Coordiaes To compue he poi addiio of P = (x 1 y 1 ) ad Q = (x y ) we eed he sloop λ of he lie hrough P ad Q If P = Q ha we have a poi doublig i his case he lie is he age o he curve P Therefore he equaio for he slope λ of he lie has he followig form (1)

2 λ y x + y P Q + x 1 1 = y1 1 + = x1 x P Q The ew coordiaes for R = P + Q wih R = (x 3 y 3 ) ca be compued wih he equaio x = λ + λ+ x + x + a 3 1 ( ) y = λ x + x + x + y For he poi doublig his equaio ca be simplified o x 3 = λ + λ+ a y = λx + x + x Wih hese equaios we ca summarize he umber of operaios i he fiie field for compuaio i affie coordiaes Table 1 Number of Operaios i Affie Coordiaes Poi Operaio #Add #Mul #Sqr #Iv Addig Doublig 5 1 Coordiaes Aoher mehod o compue he poi addiio ad poi doublig is o use projecive coordiaes P = (X Y Z) This mehod has he advaage o save he iversio which is he hardes o compue operaio So we eed oly o iversio o back coversio I order o use his mehod he coordiaes mus be covered For his here exis several soluios which differ i he umber o field operaios for he poi operaios The coversio from affie o projekive coordiaes is for all he same X = x Y = y Z =1 Bu he back coversio is differe ad herefore he equaios for he poi addiio ad poi doublig Oe soluio is o fid i [4] where x X Z y Y Z () (3) (4) (5) 3 = / = / (6) Here a poi addiio eeds 7 addiios 15 muliplicaios ad 5 squarigs ad he poi doublig eeds 4 addiios 5 muliplicaios ad 5 squarigs Oher soluios for projecive coordiaes are o fid i [5] ad [6] The umber of field operaios for he poi addiio ad poi doublig for hese hree cases is summarized i Table Table Number of Operaios i Coordiaes Poi Operaio Coordiaes #Add #Mul #Sqr (X/Z Y/Z) [6] Addiio (X/Z Y/Z ) [5] (X/Z Y/Z 3 ) [4] (X/Z Y/Z) [6] Doublig (X/Z Y/Z ) [5] (X/Z Y/Z 3 ) [4] Algorihms for Scalar Muliplicaios 31 Sadard Algorihm The easies ad mos aive way o compue he scalar muliplicaio k P is he lef o righ biary algorihm also kow as he Double-ad-Add (DaA) algorihm I his algorihm k is i a biary represeaio wih bis ad he mos sigifica bi (MSB) k -1 = 1 Firs iiialize Q wih P (Q = P) The perform a loop i which he bis from posiio - o 0 are esed I each loop ru a poi doublig (Q = Q) is performed If he curre bi k i is a 1 he also a poi addiio (Q = Q + P) is o calculae So we ca easily compue Q = k P Algorihm 1: Double ad Add 1 k := (k -1 k 1 k 0 ) Q := P 3 for i from - dowo 0 do 4 Q := Q 5 if k i 6 Q := Q + P 7 reur Q Wih his algorihm we eed -1 poi doubligs ad Hw(k)-1 poi addiios ad Hw(k) is he Hammig weigh of k The Hammig weigh represes he umber of o-zeros i k which is i he average / for a biary represeaio To reduce he Hammig weigh of k we ca recode k i a siged digi (SD) represeaio k i {-1 0 1} Wih a suiable recodig algorihm we ca reduce he Hammig weigh i he average o /3 So we ca elimiae /6 poi addiios bu we eed addiioally he poi subracio For a poi P = (x 1 y 1 ) i affie coordiaes o a ellipic curve E is P = (x 1 y 1 + x 1 ) herefore he poi subracio ca be compued wih a poi addiio ad a addiioal fiie field addiio Wih his approach we ca build he Doublead-Add/Subrac (DaAS) algorihm

3 Algorihm : Double ad Add/Subrac 1 k := (k -1 k 1 k 0 ) SD Q := P 3 for i from - dowo 0 do 4 Q := Q 5 if k i 6 Q := Q + P 7 elseif k i = -1 he 8 Q := Q P 9 reur Q To recode k i a siged digi represeaio here exis several algorihms To ge a miimal Hammig weigh we ca use he caoical recodig algorihm described i [7] This is a serial algorihm which works from righ-o-lef Aoher algorihm is he modified Booh algorihm [8] This algorihm ca compue he siged digi represeaio parallel ad also from lef-o-righ So for a hardware soluio his algorihm is very suiable So he ime o compue a scalar muliplicaio k*p wih Algorihm 1 or Algorihm is k* P= PA* Hw( k) + PD*( 1) where PA is he ime for a poi addiio ad PD is he ime for a poi doublig If we wa o kow he average ime for he scalar muliplicaio we have o add he average umber of o zeros for he Hammig weigh ad ge he equaios for he DaA ad DaAS algorihm k* P DaA= PA + PD( 1 ) k* P DaAS = PA + PD ( 1 ) + A 3 6 Because we eed he poi subracio for he DaAS algorihm we have o add he ime for a field addiio A muliplied wih he average umber of egaive oes i k The ime for a poi addiio ad a poi doublig depeds o he coordiae sysem o which he pois are compued For he affie coordiaes he ime is = PA A M S I = PD A M S I For projecive coordiaes you fid he umber of field operaios i Table Bu addiioal he ime for he back coversio from projecive o affie coordiaes is o add o he ime for a scalar muliplicaio k* P projecive = k* P + back coversio (7) (8) (9) (10) 3 Improveme If a poi addiio is faser o calculae ha a poi doublig he i is possible o speed up he DaA ad DaAS algorihm because Q+ P = ( Q+ P) + Q (11) I his case we have o compue wo successive poi addiios where he secod poi addiios icludes a added from he firs The publicaio [9] shows a mehod o save he compuaio of he y-coordiae for he iermediae resul i affie coordiaes for his case So i is possible o save a field addiio muliplicaio ad squarig 33 Mogomery Algorihm A differe approach for compuig k P was iroduced by Mogomery [10] This approach is based o he DaA algorihm ad he observaio ha he y-coordiaes of he sum of wo pois whose differece is kow ca be compued i erms of he x-coordiaes of he ivolved pois Algorihm 3: Mogomery 1 k := (k -1 k 1 k 0 ) P 1 := P P := P 3 for i from - dowo 0 do 4 if k i 5 P 1 := P 1 + P P := P 6 else 7 P 1 := P 1 P := P 1 + P 8 reur (Q = P 1 ) The ime o compue he scalar muliplicaio wih his algorihm is ( )( ) = + + (1) k* P Mo PA PD 1 y Bu we oly eed o compue he x-coordiaes I he publicaio [11] we ca fid he umber o field operaios for affie ad projecive coordiaes for he Algorihm 3 These are summarized i he followig able Table 3 Number of Operaios for he Mogomery Algorihm Operaio Coordiaes Add Mul Sqr Iv Poi Addiio Affie 4 ad Doublig Compue y Affie Coordiae

4 4 41 Comparig he Algorihms Sofware Table 7 Time for a Scalar Muliplicaio usig LiDIA Time i ms for m = Coordiaes Algorihm DaAS Affie DaAS [9] Mogomery DaAS [4] DaAS [5] DaAS [6] To fid ou which algorihm is he bes we eed o kow he ime for he field operaio For a sofware soluio here exis several implemeaios Here we compare he algorihms wih he Java implemeaio Crypix Ellipix [1] ad he C++ implemeaio LiDIA [13] The ime for he compuaio of he field operaios was measured o a AMD Ahlo 1400 MHz PC wih 51 MB Ram o Widows 000 To ge a useful resul we ru every operaio wih rus I Table 4 ad Table 5 we ca see he ruig ime of he field operaios i millisecods Table 4 Ruig Time i ms usig Crypix Ellipix [1] Field Widh m Add Mul Sqr Iv Table 5 Ruig Time i ms usig LiDIA [13] Field Widh m Add Mul Sqr Iv If we use he measured ime o compue he ime for a scalar muliplicaio wih he differe algorihms from secio 3 he i is possible o compare he algorihms ad use he bes for he implemeaio of he scalar muliplicaio I Table 6 ad Table 7 are he ime for he scalar muliplicaio wih he wo sofware implemeaios summarized Wih hese resuls i is possible o choose he bes algorihm for he sofware compuaio The ables shows ha he bes compuaio ime has he Mogomery Algorihm wih projecive coordiaes for boh sofware implemeaios Table 6 Time for a Scalar Muliplicaio usig Crypix Ellipix Coordiaes Algorihm Time i ms for m = DaAS Affie DaAS [9] Mogomery DaAS [4] DaAS [5] DaAS [6] Mogomery Hardware Mogomery For sofware is he Mogomery Algorihm wih projecive coordiaes he bes algorihm Bu is his algorihm also he bes for a hardware soluio? This quesio will be aswered i his secio Firs we have o kow he compuaio ime for he four field operaios The ime depeds of he clock frequecy ad he umber of clock cycles for every operaio The addiio ca be compued i oe clock cycle because i is oly a XOR combiaio of every bi The squarig ca be also compued i o clock cycle a soluio for his ca be foud i [14] If we compue he muliplicaio serial we eed m clock cycles The speed for his operaio ca be icreased bu hese resuls i a grea area The las ad also he operaio which is he hardes o compue is he iversio For he iversio here exis wo algorihms oe is he Exeded Euclidia Algorihm ad he oher uses Ferma s Theorem For he Exeded Euclidia Algorihm exis a hardware soluio which ca be foud i [15] This soluio compues he iversio i m clock cycles bu eed a grea amou of area So his soluio oly should be used wih algorihms which eed may iversios Aoher soluio ha compues he iversio wih Ferma s Theorem is o fid i [16] This is a soluio which compues he iversio wih muliplicaios ad squarigs Wih his we ca summarize he umber of clock cycles for every field operaio: A M S I [15] = 1 = m = 1 = m ( ( ) ) ( ) = log m 1 + Hw( m 1) + m 1 I [16] M S (13) Because of he grea amou of area for he iversio wih [15] oly algorihms wih affie coordiaes should use his hardware soluio For algorihms wih projecive coordiaes which oly eed o iversio is he soluio from [16] a beer choice So we ca compue he umber of clock cycles for he differe algorihms from secios 3 which are summarized i Table 8

5 Table 8 Algorihms for Hardware Compuaio Coordiaes Algorihm Clock cycles for m = DaAS Affie DaAS [9] Mogomery DaAS [4] DaAS [5] DaAS [6] Mogomery The fases hardware soluio for a scalar muliplicaio is o fid i [17] This hardware uses he Mogomery Algorihm wih projecive coordiaes Bu if we compare he algorihms i Table 8 we see ha he DaAS Algorihm wih he improveme from [9] is he fases algorihm Therefore a hardware soluio ha uses his algorihm ad he iversio wih [15] ca be speed up o he compuaio ime up o 40% 5 Coclusios This paper compares he differe algorihms ha compue he scalar muliplicaio for he ellipic curve crypography Especially i secio 4 we ca show ha oher algorihms ha he geeral used are faser o compue he scalar muliplicaio i hardware Therefore his paper should be kow o everyoe who was o build a hardware or sofware soluio which compues he scalar muliplicaio for he ellipic curve crypography Refereces [1] N Kobliz Ellipic Curve Cryposysems Mahemaics of Compuaio Vol 48 No 177 pp [] V Miller Use of Ellipic Curves i Crypography Advaces i Crypology - CRYPTO '85 Spriger-Verlag LNCS 18 pp [3] ANSI X96 Public Key Crypography for he Fiacial Services Idusry: The Ellipic Curve Digial Sigaure Algorihm (ECDSA) 1999 [4] IEEE Sd IEEE Sadard Specificaios for Public-Key Crypography IEEE Compuer Sociey 000 [5] J Lopez ad R Dahab Improved Algorihms for Ellipic Curve Arihmeic i GF( ) Seleced Areas i Crypography - SAC '98 Spriger Verlag LNCS 1556 pp [6] A J Meezes Ellipic Curve Public Key Cryposysems Kluwer Academic Publishers 1993 [7] G W Reiwieser Biary Arihmeic Advaces i Compuers Vol 1 pp [8] O L MacSorley High-Speed Arihmeic i Biary Compuers Proceedigs of he IRE pp [9] K Eiseräger K Lauer ad P L Mogomery Fas Ellipic Curve Arihmeic ad Improved Weil Pairig Evaluaio The Crypographers' Track a he RSA Coferece CT-RSA 003 Spriger-Verlag LNCS 61 pp [10] P L Mogomery Speedig he Pollard ad Ellipic Curve Mehods of Facorizaio Mahemaics of Compuaio Vol 48 No 177 pp [11] J Lopez ad R Dahab Fas Muliplicaio o Ellipic Curves over GF( m ) wihou Precompuaio Workshop o Crypographic Hardware ad Embedded Sysems - CHES '99 Spriger Verlag LNCS 1717 pp [1] Crypix Ellipix Ellipix is ieded o be a complee 100% pure Java implemeaio of he IEEE P1363 ANSI X96 ad ANSI X963 sadards Crypix hp://wwwcrypixorg/ 1999 [13] LiDIA Group LiDIA 1pre7 A Library for Compuaioal Number Theory TU-Darmsad hp://wwwiformaiku-darmsadde/ti/lidia/ 003 [14] H Wu Low Complexiy Bi-Parallel Fiie Field Arihmeic Usig Polyomial Basis Workshop o Crypographic Hardware ad Embedded Sysems - CHES '99 Spriger Verlag LNCS 1717 pp [15] H Bruer A Curiger ad M Hofseer O Compuig Muliplicaive Iverses i GF( m ) IEEE Trasacios o Compuaio Vol 4 pp Augus 1993 [16] T Ioh ad S Tsujii A Fas Algorihm for Compuig Muliplicaive Iverses i GF( m ) Usig Normal Bases Iformaio o Compuaio Vol 78 pp [17] G Orlado C Paar A High-Performace Recofigurable Ellipic Curve Processor for GF( m ) Workshop o Crypographic Hardware ad Embedded Sysems - CHES 000 Spriger-Verlag LNCS 1965 pp