Content uploaded by Diego F. Aranha
Author content
All content in this area was uploaded by Diego F. Aranha on Nov 16, 2014
Content may be subject to copyright.
Fast point multiplication algorithms for binary
elliptic curves with and without precomputation
Thomaz Oliveira1, Diego F. Aranha2, Julio L´opez2?, and Francisco
Rodr´ıguez-Henr´ıquez1
1Computer Science Department, CINVESTAV-IPN
2Institute of Computing, University of Campinas
Abstract. In this paper we introduce new methods for computing constant-
time variable-base point multiplications over the Galbraith-Lin-Scott
(GLS) and the Koblitz families of elliptic curves. Using a left-to-right
double-and-add and a right-to-left halve-and-add Montgomery ladder
over a GLS curve, we present some of the fastest timings yet reported
in the literature for point multiplication. In addition, we combine these
two procedures to compute a multi-core protected scalar multiplication.
Furthermore, we designed a novel regular τ-adic scalar expansion for
Koblitz curves. As a result, using the regular recoding approach, we set
the speed record for a single-core constant-time point multiplication on
standardized binary elliptic curves at the 128-bit security level.
Keywords: binary elliptic curves, scalar multiplication, software imple-
mentation
1 Introduction
From a cryptographic perspective, one of the most interesting consequences of
the Snowden revelations is the increased awareness about the importance of
implementing security protocols that offer the Perfect Forward Secrecy (PFS)
property. The PFS property guarantees that in a given protocol, none of its past
short term session keys can be derived from the long term server’s private key.
One tangible example of this situation is the recent announcement by the Inter-
net Engineering Task Force that the Transport Layer Security (TLS) protocol
version 1.3, will no longer include cipher suites based on RSA key transport
primitives [34]. Instead, the client-server secret key establishment will be per-
formed via either the Ephemeral Diffie-Hellman or the Elliptic Curve Ephemeral
Diffie-Hellman (ECDHE) methods. Because of the significant performance ad-
vantage of the latter over the former, it is anticipated that in the years to come,
ECDHE will be the favorite choice for establishing a TLS shared secret.
The specifications of all the TLS protocol versions [8–10] include support
for prime and binary field elliptic curve cryptographic primitives. In the case
of binary elliptic curves, the TLS protocol supports a selection of several stan-
dardized random curves as well as Koblitz curves [23] at the 80-, 128-, 192- and
?The author was supported in part by the Intel Labs University Research Office.
256-bit security levels. Koblitz curves allow performance improvements, due to
the availability of the Frobenius automorphism τ. Also, their generation is in-
herently rigid (in the SafeCurves sense [2]), where the only degree of freedom
in the curve generation process consists in choosing a suitable prime degree ex-
tension mthat produces a curve with almost-prime order. This severely limits
the possibility of “1-in-a-million attacks” [35] aiming to reach a weak curve after
testing many random seeds.
Point multiplication is the single most important operation of (hyper) elliptic
curve cryptography, for that reason, considerable effort has been directed towards
achieving fast and compact software/hardware implementations of it. A major
result that has influenced the latest implementations was found in 2009, when
Galbraith, Lin and Scott (GLS), building on a previous technique introduced by
Gallant, Lambert and Vanstone (GLV) [14], constructed efficient endomorphisms
for a class of elliptic curves defined over the quadratic field Fq2, where qis a prime
number [13]. Taking advantage of this result, the authors of [13] performed a
128-bit security level point multiplication that took 326,000 clock cycles on a
64-bit processor. Since then, a steady stream of algorithmic and technological
advances has translated into a significant reduction in the number of clock cycles
required to compute a (hyper) elliptic curve constant-time variable-base-point
multiplication at the 128-bit security level [1, 11, 24, 5, 4, 16, 38].
The authors of [24, 11] targeted a twisted Edwards GLV-GLS curve defined
over Fp2,with p= 2127 −5997.That curve is equipped with a degree-4 endo-
morphism allowing a fast point multiplication computation that required just
92,000 clock cycles on an Ivy Bridge processor [11]. Bos et al. [5] and Bernstein
et al. [1], presented an efficient point multiplication on the Kummer surface as-
sociated with the Jacobian of a genus 2 curve defined over a field generated by
the prime p= 2127 −1. Each iteration of the Montgomery ladder presented in [1]
costs roughly 25 field multiplications, which implemented on a Haswell processor
permits to compute a point multiplication in 72,000 clock cycles.
In 2014, Oliveira et al. introduced the λ-projective coordinate system that
leads to faster binary field elliptic curve arithmetic [31, 32]. The authors applied
that coordinate system into a binary GLS curve that admits a degree-2 endomor-
phism and a fast field arithmetic associated with the quadratic field extension of
the binary field F2127 .When implemented on a Haswell processor, this approach
permits to perform one constant-time point multiplication computation in just
60,000 clock cycles.
Contributions of this paper. This work presents new methods aimed to per-
form fast constant-time variable-base-point multiplication computation for both
random and Koblitz binary elliptic curves of the form y2+xy =x3+ax2+b.
In the case of random binary elliptic curves, we introduce a novel right-to-left
variant of the classical Montgomery-L´opez-Dahab ladder algorithm presented
in [25], which efficiently adapted the original ladder idea introduced by Peter
Montgomery in his 1987 landmark paper [26]. The new variant presented in this
work does not require point doublings, but instead, it uses the efficient point
halving operation available on binary elliptic curves. In contrast with the algo-
rithm presented in [25] that does not admit the benefit of precomputed tables,
our proposed variant can take advantage of this technique, a feature that could
be proved valuable for the fixed-base-point multiplication scenario. Moreover, we
show that our new right-to-left Montgomery ladder formulation can be nicely
combined with the classical ladder to attain a high parallel acceleration factor
for a constant-time multi-core implementation of the point multiplication oper-
ation. As a second contribution, we present a procedure that adapts the regular
scalar recoding of [21] to the task of producing a regular τ-NAF scalar recoding
for Koblitz curves. This approach has faster precomputation than related recod-
ings [30] and allows us to achieve a speed record for single-core constant-time
point multiplication on standardized binary elliptic curves at the 128-bit security
level.
The remainder of this paper is organized as follows. In Section 2 we give
a short description of the GLS and Koblitz curves, their arithmetic and their
security. In Section 3 we present new variants of the Montgomery ladder for
binary elliptic curves. Then, in Section 4, we introduce a regular τ-NAF recod-
ing amenable for producing protected point multiplication implementations on
Koblitz curves. In Section 5, we present our experimental implementation results
and finally, we draw our conclusions in Section 6.
2 Mathematical background
2.1 Quadratic field arithmetic
A binary extension field Fq, q = 2m,can be constructed by taking an degree-
mpolynomial f(x)∈F2[x] irreducible over F2,where the field elements in Fq
are the set of binary polynomials of degree less than m. Quadratic extensions
of a binary extension field can be built using a degree two monic polynomial
g(u)∈Fq[u] irreducible over Fq. In this case, the field Fq2is isomorphic to
Fq[u]/(g(u)) and its elements can be represented as a0+a1u, with a0, a1∈Fq.
Operations in the quadratic extension are performed coefficient-wise. For in-
stance, the multiplication of two elements a, b ∈Fq2is computed at the cost of
three multiplications in the base field using the customary Karatsuba formula-
tion,
a·b= (a0+a1u)·(b0+b1u) (1)
= (a0b0+a1b1)+(a0b0+ (a0+a1)·(b0+b1))u,
with a0, a1, b0, b1∈Fq.
In [31, 32], the authors developed an efficient software library for the field
F2mand its quadratic extension F22m,with m= 127,generated by means of the
irreducible trinomials f(x) = x127 +x63 + 1 and g(u) = u2+u+ 1, respectively.
The computational cost of the field arithmetic in the quadratic extension field
gets significantly reduced by using that towering approach. To be more concrete,
let Mand mdenote the cost of one field multiplication over Fq2and Fq,respec-
tively. The execution of the arithmetic library of [32] on the Sandy Bridge and
Haswell microprocessors yields a ratio M/m of just 2.23 and 1.51, respectively.
These experimental results are considerably better than the theoretical ratio
M/m = 3 that one could expect from the Karatsuba formulation of Eq (1). The
aforementioned performance speedup can be explained from the fact that the
towering field approach permits a much better usage of the processor’s pipelined
execution unit, which potentially can improve the speed of one 64-bit carry-less
multiplication3from 7 clock cycles to the maximum achievable throughput of
just 2 clock cycles [12].
2.2 GLS binary elliptic curves
Let Ea,b(Fq2) denote the additive abelian group formed by the point at infinity
Oand the set of affine points P= (x, y) with x, y ∈Fq2that satisfy the ordinary
binary elliptic curve equation given as,
E:y2+xy =x3+ax2+b, (2)
defined over Fq2=22m,with a∈Fq2and b∈F∗
q2.Let #Ea,b(Fq2) denote the size
of the group Ea,b(Fq2),and let us assume that Ea,b (Fq2) includes a subgroup
hPiof prime order r.
The point multiplication operation, denoted by Q=kP , corresponds to
adding Pto itself k−1 times, with k∈[0, r −1]. The average cost of computing
kP by a random n-bit scalar kusing the traditional double-and-add method is
about nD +n
2A, where Dand Aare the cost of doubling and adding a point,
respectively. If the elliptic curve Eof Eq. (2) is equipped with a non-trivial
efficiently computable endomorphism ψsuch that ψ(P) = δP ∈ hPi,for some
δ∈[2, r −2].Then the point multiplication can be computed `a la GLV as,
Q=kP =k1P+k2ψ(P) = k1P+k2·δP,
where the subscalars |k1|,|k2| ≈ n/2,can be found by solving a closest vector
problem in a lattice [13]. Having split the scalar kinto two parts, the computation
of kP =k1P+k2ψ(P) can be performed by applying simultaneous multiple
point multiplication techniques [18] that translates into a saving of half of the
doublings required by the execution of a single point multiplication kP .
Inspired by the GLS technique of [13], Hankerson, Karabina and Menezes
presented in [17] a family of binary GLS curves defined over the field Fq2,with
q= 2m,which admits a two-dimensional endomorphism. This endomorphism can
be computed at the inexpensive cost of just three additions in Fq. Furthermore,
by carefully choosing the elliptic curve parameters a, b of Eq. (2), the authors
of [17] showed that it is possible to find members of that family of GLS curves
with an almost-prime group order of the form #Ea,b(Fq2) = hr, with h= 2 and
where ris a (2m−1)-bit prime number.
3corresponding to the Intel’s PCLMULQDQ instruction.
Security of GLS curves Given a point Q∈ hPi, the Elliptic Curve Discrete
Logarithm Problem (ECDLP) consists of finding the unique integer k∈[0, r −1]
such that Q=kP. To the best of our knowledge, the most powerful attack
for solving the ECDLP on binary elliptic curves was presented in [33] (see
also [20, 36]), with an associated computational complexity of O(2c·m2/3log m),
where c < 2,and where mis a prime number. This is worse than generic algo-
rithms with time complexity O(2m/2) for all prime field extensions mless than
N= 2000,a bound that is well above the range used for performing elliptic
curve cryptography [33]. On the other hand, since the elliptic curve of Eq. (2) is
defined over a quadratic extension of the field Fq,the generalized Gaudry-Hess-
Smart (gGHS) attack [15, 19] to solve the ECDLP on the curve E, applies. To
prevent this attack, it suffices to verify that the constant bof Ea,b(Fq2) is not
weak. Nevertheless, the probability that a randomly selected b∈F∗
qis a weak
parameter, is negligibly small [17].
2.3 Koblitz curves
A Koblitz curve, also known as an anomalous binary curve or subfield curve, is
defined as the set of affine points P= (x, y)∈Fq×Fq, q = 2m, that satisfy
the Weierstraß equation Ea:y2+xy =x3+ax2+ 1, a ∈ {0,1},together with
a point at infinity denoted by O. In λ-affine coordinates, where the points are
represented as P= (x, λ =x+y
x), x 6= 0, the λ-affine form of the above equation
becomes [32], (λ2+λ+a)x2=x4+ 1.A Koblitz curve forms an abelian group
denoted as Ea(F2m) of order 2(2 −a)r, for an odd prime r, where its group law
is defined by the point addition operation.
Frobenius map. Since their introduction in [23], Koblitz curves were exten-
sively studied for their additional structure that allows, in principle, a perfor-
mance speedup in the point multiplication computation. The Frobenius map
τ:Ea(Fq)→Ea(Fq) defined by τ(O) = O, τ(x, y) = (x2, y2),is a curve auto-
morphism satisfying (τ2+ 2)P=µτ(P) for µ= (−1)1−aand all P∈Ea(Fq).
By solving the equation τ2+ 2 = µτ, the Frobenius map can be seen as the
complex number τ=µ+√−7
2. Notice that in λ-coordinates the Frobenius map
action remains the same, because, τ(x, λ)=(x2, λ2)=(x2, x2+y2
x2),which cor-
responds to the λ-representation of τ(x, y). Let Z[τ] be the ring of polynomials
in τwith coefficients in Z. Since the Frobenius map is highly efficient, as long as
it is possible to convert an integer scalar kto its τ-representation k=Pl−1
i=0 uiτi,
its action can be exploited in a point multiplication computation by adding mul-
tiples uiτi(P), with uiτi∈Z[τ]. Solinas [37] proposed exactly that, namely, a
τ-adic scalar recoding analogous to the signed digit scalar Non-Adjacent Form
representation.
Security of Koblitz curves From the security point of view, it has been ar-
gued that the availability of additional structure in the form of endomorphisms
can be a potential threat to the hardness of elliptic curve discrete logarithms [3],
but limitations observed in approaches based on isogeny walks is evidence con-
trariwise [22]. Furthermore, the generation of Koblitz curves satisfy by definition
the rigidity property. Constant-time compact implementations for Koblitz curves
are also easily obtained by specializing the Montgomery-L´opez-Dahab ladder al-
gorithm [25] for b= 1, although we show below that this is not the most efficient
constant-time implementation strategy possible. Another practical advantage is
the adoption of Koblitz curves by several standards bodies [27], which guaran-
tee interoperability and availability of implementations in many hardware and
software platforms.
3 New Montgomery ladder variants
This Section presents algorithms for computing the scalar multiplication through
the Montgomery ladder method. Here, we let Pbe a point in a binary elliptic
curve of prime order r > 2 and ka scalar of bit length n. Our objective is to
compute Q=kP .
Algorithm 1 Left-to-right Montgomery ladder [26]
Input: P= (x, y), k = (1, kn−2,...,k1, k0)
Output: Q=kP
1: R0←P;R1←2P;
2: for i=n−2downto 0do
3: if ki= 1 then
4: R0←R0+R1;R1←2R1
5: else
6: R1←R0+R1;R0←2R0
7: end if
8: end for
9: return Q=R0
Algorithm 1 describes the classical left-to-right Montgomery ladder approach
for point multiplication [26], whose key algorithmic idea is based on the following
observation. Given a base point Pand two input points R0and R1,such that
their difference, R0−R1=P, is known, the x-coordinates of the points, 2R0,
2R1and R0+R1,are fully determined by the x-coordinates of P, R0and R1.
More than one decade after its original proposal in [26], L´opez and Dahab
presented in [25] an optimized version of the Montgomery ladder, which was
specifically crafted for the efficient computation of point multiplication on or-
dinary binary elliptic curves. In this scenario, compact formulae for the point
addition and point doubling operations of Algorithm 1 can be derived from the
following result.
Lemma 1 ([25]). Let P= (x, y), R1= (x1, y1),and R0= (x0, y0)be elliptic
curve points, and assume that R1−R0=P, and x06= 0.Then, the x-coordinate
of the point (R0+R1),x3,can be computed in terms of x0, x1,and xas follows,
x3=(x+x0·x1
(x0+x1)2R06=±R1
x2
0+b
x2
0
R0=R1
(3)
Moreover, the y-coordinate of R0can be expressed in terms of P, and the x-
coordinates of R0, R1as,
y0=x−1(x0+x)(x0+x)(x1+x) + x2+y+y(4)
Let us denote the projective representation of the points R0, R1and R0+R1,
without considering their y-coordinates as, R0= (X0,−, Z0), R1= (X1,−, Z1)
and R0+R1= (X3,−, Z3).Then, for the case R0=R1,Lemma 1 implies,
(X3=X4
0+b·Z4
0
Z3=X2
0·Z2
0
(5)
Furthermore, for the case R06=±R1,one has that,
(Z3= (X0·Z1+X1·Z0)2
X3=x·Z3+ (X0·Z1)·(X1·Z0)(6)
From Equations (5) and (6) it follows that the computational cost of each
ladder step in Algorithm 1 is of 5 multiplications, 1 multiplication by the curve
b-constant, 4 or 5 squarings4and 3 additions over the binary extension field
where the elliptic curve has been defined.
In the rest of this Section, we will present a novel right-to-left formulation of
the classical Montgomery ladder.
3.1 Right-to-left double-and-add Montgomery-LD ladder
Algorithm 2 presents a right-to-left version of the classical Montgomery ladder
procedure. At the end of the i-th iteration, the points in the variables R0, R1
are, R0= 2i+1P, and R1=`P +P
2,where `is the integer represented by the
irightmost bits of the scalar k. The variable R2maintains the relationship,
R2=R0−R1from the initialization (step 1), until the execution of the last
iteration of the main loop (steps 2-9). This comes from the fact that at each
iteration, if ki= 1,then the difference R0−R1remains unchanged. If otherwise,
ki= 0,then both R2and R0are updated with their respective original values
plus R0,which ensures that R2=R0−R1,still holds. Notice however that,
although the difference R2=R0−R1,is known, it may vary throughout the
iterations.
As stated in Lemma 1, the point additions of steps 4 and 6 in Algorithm 2
can be computed using the x-coordinates of the points R0, R1and R2,according
4Either b= 1 or √bis precomputed. Formula (5) can also be computed as Z3=
(X0·Z0)2and X3= (X2
0+√b·Z2
0)2
Algorithm 2 Montgomery-LD double-and-add scalar multiplication (right-to-
left)
Input: P= (x, y), k = (kn−1, kn−2,...,k1, k0)
Output: Q=kP
1: R0←P;R1←P
2;R2←P
2= (R0−R1);
2: for i= 0 to n−1do
3: if ki= 1 then
4: R1←R1+R0;
5: else
6: R2←R2+R0;
7: end if
8: R0←2R0;
9: end for
10: return Q=R1−P
2
to the following analysis. If ki= 1, then the x-coordinate of R0+R1is a function
of the x-coordinates of R0,R1and R2, because R2=R0−R1. If ki= 0, the
x-coordinate of R2+R0is a function of the x-coordinates of the points R0,
R1and R2, because R0−R2=R0−(R0−R1) = R1. Hence, considering
the projective representation of the points R0= (X0,−, Z0), R1= (X1,−, Z1),
R2= (X2,−, Z2) and R0+R1= (X3,−, Z3),where all the y-coordinates are
ignored, and assuming R06=±R1,we have,
T= (X0·Z1+X1·Z0)2
Z3=Z2·T
X3=X2·T+Z2·(X0·Z1)·(X1·Z0)
(7)
From Equations (5) and (7), it follows that the computational cost of each ladder
step in Algorithm 2 is of 7 multiplications, 1 multiplication by the curve b-
constant, 4 or 5 squarings and 3 additions over the binary field where the elliptic
curve lies.
Although conceptually simple, the above method has several algorithmic and
practical shortcomings. The most important one is the difficulty to recover, at
the end of the algorithm, the y-coordinate of R1, as in none of the available points
(R0,R1and R2) the corresponding y-coordinate is known. This may force the
decision to use complete projective formulae for the point addition and doubling
operations of steps 4, 6 and 8, which would be costly. Finally, we stress that to
guarantee that the case R0=R2will never occur, it is sufficient to initialize R1
with P
2,and perform an affine subtraction at the end of the main loop (step 10).
In the following subsection we present a halve-and-add right-to-left Mont-
gomery ladder algorithm that alleviates the above shortcomings and still achieves
a competitive performance.
3.2 Right-To-Left halve-and-add Montgomery-LD ladder
Algorithm 3 Montgomery-L´opez-Dahab halve-and-add (right-to-left)
Input: P= (x, y), k0= (k0
n−1, k0
n−2,...,k0
1, k0
0)
Output: Q=kP
1: Precomputation: x(Pi),where Pi=P
2i,for i= 0,...,n
2: R1←Pn;R2←Pn;
3: for i= 0 to n−1do
4: R0←Pn−1−i;
5: if k0
i= 1 then
6: R1←R0+R1;
7: else
8: R2←R0+R2;
9: end if
10: end for
11: R1←R1−Pn
12: return R1
Algorithm 3 presents a right-to-left Montgomery ladder procedure similar to
Algorithm 2, but in this case, all the point doubling operations are substituted
with point halvings. A left-to-right approach using halve-and-add with Mont-
gomery ladder was published in [29], however, this method requires one inversion
per iteration, which degrades its efficiency due to the cost of this operation.
As in any halve-and-add procedure, an initial step before performing the
actual computation consists of processing the scalar ksuch that it can be equiv-
alently represented with negative powers of two. To this end, one first computes
k0≡2n−1kmod r, with n=|r|. This implies that, k≡Pn
i=1 k0
n−i/2i−1mod r
and therefore, kP =Pn
i=1 k0
n−i(1
2i−1P).Then, in the first step of Algorithm 3, n
halvings of the base point Pare computed. We stress that all the precomputed
points Pi=P
2i,for i= 0, . . . , n can be stored in affine coordinates. In fact, just
the x-coordinate of each one of the above npoints must be stored (with the sole
exception of the point Pn, whose y-coordinate is also computed and stored).
As in the preceding algorithm notice that at the end of the i-th iteration,
the points in the variables R0, R1are, R0=P
2n−i−1,and R1=`P +Pn,where
in this case `is the integer represented as, `=
i
P
j=0
k0
j
2n−jmod r. Notice also that
the variable R2maintains the relationship, R2=R0−R1, until the execution of
the last iteration of the main loop (steps 3-10). This comes from the fact that
at each iteration, if ki= 1,then the difference R0−R1remains unchanged.
If otherwise, ki= 0,then both R2and R0are updated with their respective
original values plus R0,which ensures that R2=R0−R1,still holds.
Since at every iteration, the values of the points R0, R1and R0−R1,are
all known, the compact point addition formula (7) can be used. In practice, this
is also possible because the y-coordinate of the output point kP can be readily
recovered using Equation 4, along with the point 2P. Moreover, since the points
in the precomputed table were generated using affine coordinates, it turns out
that the z-coordinate of the point R0is always 1 for all the iterations of the
main loop. This simplifies (7) as,
T= (X0·Z1+X1)2
Z3=Z2·T
X3=X2·T+Z2·(X0·Z1)·(X1)
(8)
Hence, the computational cost per iteration of Algorithm 3 is of 5 multiplications,
1 squaring, 2 additions and one point halving over the binary field where the
elliptic curve lies.
GLS Endomorphism The efficient computable endomorphism provided by the
GLS curves can be used to implement the 2-GLV method on the Algorithm 3. As
a result, only n/2 point halving operations must be computed. Besides the speed
improvement, the 2-GLV method reduces to a half the number of precomputed
points that must be stored.
3.3 Multi-core Montgomery ladder
As proposed in [38], by properly recoding the scalar, one can efficiently compute
the scalar multiplication in a multi-core environment. Specifically, given a scalar
kof size n, we fix a constant twhich establishes how many scalar bits will be
processed by the double-and-add, and by the halve-and-add procedures. This is
accomplished by computing, k0= 2tkmod r, which yields,
k=k0
0
2t+k0
1
2t−1+· ·· +k0
t−1
21
| {z }
halve−and−add
+k0
t
20+ 21k0
t+1 + 22k0
t+2 +· ·· + 2(n−1)−tk0
n−1
| {z }
double−and−add
In a two-core setting, it is straightforward to combine the left-to-right and
right-to-left Montgomery ladder procedures of Algorithms 1 and 3, and distribute
them to both cores. In this scenario, the number of necessary pre-computed
halved points reduces to ∼n
4. In a four-core platform, we can apply the GLS en-
domorphism to the left-to-right Montgomery ladder (Algorithm 1). Even though
the GLV technique is ineffective for the classical Montgomery algorithm (due to
the fact that we cannot share the point doublings between the base point and
its endomorphism), the method permits an efficient splitting of the algorithm
workload into two cores. In this way, one can use the first two cores for com-
puting t-digits of the GLV subscalars k1and k2by means of Algorithm 3, while
we allocate the other two cores to compute the rest of the scalar’s bits using
Algorithm 1, as shown in Algorithm 6 (see Appendix A).
Table 1. Montgomery-LD algorithms cost comparison. In this table, M, Ma, Mb, S, I
denote the following field operations: multiplication, multiplication by the curve a-
constant, multiplication by the curve b-constant, squaring and inversion. The point
halving operation is denoted by H.
Method Cost
1-core
Alg. 1: Montgomery-LD
(double-and-add, left-to-right)
pre/post 10M+ 1S+ 1I
sc. mult. n(5M+ 1Mb+ 4S)
Alg. 3: Montgomery-LD-2-GLV
(halve-and-add, right-to-left)
pre/post 48M+ 1Ma+ 13S+ 3I
sc. mult. ( n
2+ 1)H+n(5M+ 1S)
2-core
Montgomery-LD-2-GLV
(double-and-add, left-to-right) core I pre/post 25M+ 1Ma+ 5S+ 2I
sc. mult. (n−t2)(5M+ 1Mb+ 4S)
Montgomery-LD-2-GLV
(halve-and-add, right-to-left) core II pre/post 46M+ 2Ma+ 12S+ 2I
sc. mult. ( t2
2+ 1)H+t2(5M+ 1S)
Overhead 15M+ 5S+ 1I
4-core
Montgomery-LD-2-GLV
(double-and-add, left-to-right)
cores pre/post 10M+ 1S+ 1I
I & II sc. mult. ( n
2−t4)(5M+ 1Mb+ 4S)
Montgomery-LD-2-GLV
(halve-and-add, right-to-left)
cores pre/post 16M+ 1Ma+ 4S+ 1I
III & IV sc. mult. ( t4
2+ 1)H+t4(5M+ 1S)
Overhead 34M+ 1Ma+ 12S+ 1I
3.4 Cost comparison of Montgomery ladder variants
Table 1 shows the computational costs associated to the Montgomery ladder vari-
ants described in this Section. The constants t2and t4represent the values of
the parameter tchosen for the two- and four-core implementations, respectively.5
All Montgomery ladder algorithms require a basic post-computation cost to re-
trieve the y-coordinate, which demands ten multiplications, one squaring and
one inversion. Due to the application of the GLV technique, the Montgomery-
LD-2-GLV halve-and-add version (corresponding to Algorithm 3), requires some
few extra operations, namely, the subtraction of a point and the addition of two
accumulators, which is performed using the L´opez-Dahab (LD) projective coor-
dinate formulae. In the end, one extra inversion is needed to convert the point
representation from LD-projective coordinates to affine coordinates.
In the case of the parallel versions, the overhead is given by the post-computation
done in one single core. The exact costs are mainly determined by the accumu-
lator additions that are performed via full and mixed LD-projective formulae. In
all of the timings reported in Section 5, we consider the LD-projective to affine
coordinate transformation cost.
5In our implementations (see subsection 5.3 below), the values used for the parameters
t2and t4ranged from 53 to 55.
4 A novel regular τ-adic approach
4.1 Recoding in τ-adic form
The recoding approach proposed by Solinas finds an element ρ∈Z[τ],of as
small norm as possible, such that ρ≡k(mod τm−1
τ−1). A τ-adic expansion with
average non-zero density 1
3can be obtained by repeatedly dividing ρby τand
assigning the remainders to the digits uito obtain k=Pi=l−1
i=0 uiτi. An alter-
native approach that does not involve multi-precision divisions, is to compute
an element ρ0=kpartmodτm−1
τ−1by performing a partial reduction proce-
dure [37]. A width-w τ-NAF expansion with non-zero density 1
w+1 , where at
most one of any wconsecutive coefficients is non-zero, can also be obtained
by repeatedly dividing ρ0by τwand assigning the remainders to the digit set
{0,±α1,±α3,...,±α2w−1−1}, for αi=imod τw. Under reasonable assump-
tions, this window-based recoding has length l≤m+ 1 [37].
In this section, a regular recoding version of the (width-w)τ-NAF expan-
sion is derived. The security advantages of such recoding are the predictable
length and locations of non-zero digits in the expansion. This eliminates any
side-channel information that an attacker could possibly collect regarding the
operation executed at any iteration of the scalar multiplication algorithm (point
doubling/Frobenius map or point addition). As long as querying a precomputed
table of points to select the second operand of a point addition takes constant
time, the resulting algorithm should be resistant against any timing-based side-
channel attacks.
Let us first consider the integer recoding proposed by Joye and Tunstall [21].
They observed that any odd integer iin the interval [0,2w) can be written
as i= 2w−1+ (−(2w−1−i)). Repeatedly dividing an odd n-bit integer k−
((kmod 2w)−2w−1) by 2w−1maintains the parity and assigns the remainders to
the digit set {±1,...,±(2w−1−1)}, producing an expansion of length d1 + n
w−1]
with non-zero density 1
w−1. Our solution for the problem of finding a regular
τ-adic expansion employs the same intuition, as explained next.
Let φw:Z[τ]→Z2wbe a surjective ring homomorphism induced by τ7→
tw, for t2
w+ 2 ≡µtw(mod 2w), with kernel {α∈Z[τ] : τwdivides α}. An
element i=i0+i1τfrom Z[τ] with odd integers i0, i1∈[0,2w) satisfies the
analogous property φw(i)=2w−1+(−(2w−1−φw(i))). Repeated division of (r0+
r1τ)−(((r0+r1τ) mod τw)−τw−1) by τw−1, correspondingly of φw(ρ0)=(r0+
r1tw)−((r0+r1twmod 2w)−2w−1) by 2w−1, obtains remainders that belong to
the set {0,±α1,±α3,...,±α2w−1−1}. The resulting expansion always has length
d1 + m+2
w−1eand non-zero density 1
w−1. Algorithm 4 presents the recoding process
for any w≥2. The resulting recoding can also be seen as an adaption of the SPA-
resistant recoding of [30], mapping to the digit set {0,±α1,±α3,...,±α2w−1−1}
instead of integers. While the non-zero densities are very similar, our scheme
provides a performance benefit in the precomputation step, since the Frobenius
map is usually faster than point doubling and preserves affine coordinates and
consequently faster point additions.
Algorithm 4 Regular width-w τ -recoding for m-bit scalar
Input: w,tw,αu=βu+γuτfor u={±1,±3,±5,...,±2w−1−1}, ρ =r0+r1τ∈Z[τ]
with odd r0, r1
Output: ρ=
dm+2
w−1e
X
i=0
uiτi(w−1)
1: for i←0to dm+2
w−1e- 1 do
2: if w= 2 then
3: ui←((r0−2r1) mod 4) −2
4: r0←r0−ui
5: else
6: u←(r0+r1twmod 2w)−2w−1
7: if u > 0then s←1else s← −1
8: r0←r0−sβu, r1←r1−sγu, ui←sαu
9: end if
10: for j←0to (w−2) do
11: t←r0, r0←r1+µr0/2, r1← −t/2
12: end for
13: end for
14: if r06= 0 and r16= 1 then
15: ui←r0+r1τ
16: else
17: if r16= 0 then
18: ui←r1
19: else
20: ui←r0
21: end if
22: end if
4.2 Left-to-right regular approach
Algorithm 5 presents a complete description of a regular scalar multiplication
approach that uses as a building block the regular width-w τ-recoding procedure
just described.
Algorithm 5 Protected scalar multiplication
Input: P= (x, λ), k∈Z, width w
Output: Q=kP
1: Compute ρ0=r0+r1τ=kpartmodτm−1
τ−1
2: if 2|r0then r0
0=r0+ 1
3: if 2|r1then r0
1=r1+ 1
4: Compute width-wlength-lregular τ-adic of r0
0+r0
1τas Pd1+ m+2
w−1e
i=0 uiτi(w−1) (Alg. 4)
5: for i∈ {1,...,2w−1−1}do
6: Compute Pu=αuP
7:
8: Q← O
9: for i=l−1downto 0do
10: Q←τw−1(Q)
11: Perform a linear pass to recover Pui
12: Q←Q+Pui
13: end for
14: return Q=Q−(r0
0−r0)P−(r0
1−r1)τ(P).
For benchmarking purposes, we also included a baseline implementation of
the customary Montgomery L´opez-Dahab ladder. This allows easier comparisons
with related work and permits to evaluate the impact of incomplete reduction
in the field arithmetic performance (cf. subsection 5.2).
5 Implementation issues and results
In this Section, we discuss several implementation issues. We also present our
experimental results and we compare them against state-of-the-art protected
point multiplication implementations at the 128-bit security level.
5.1 Mechanisms to achieve a constant-time GLS-Montgomery
ladder implementation
To protect the previously described algorithms against timing attacks, we ob-
served the following precautions,
Branchless code The main loop, the pre- and post-computation phases are im-
plemented by a completely branch-free code.
Data veiling To guarantee a constant memory access pattern in the main loop
of the Montgomery ladder algorithms, we proposed an efficient data veiling
method, as described in Algorithm 7 of Appendix B. Algorithm 7 evaluates the
actual and the previous scalar bits to decide whether the variables containing
the Montgomery-LD accumulators values should or should not be masked. This
strategy saves a considerable portion of the computational effort associated to
Algorithm 1 of [4].
Field arithmetic Two of the base field arithmetic operations over Fqwere im-
plemented through look-up tables, namely, the half-trace and the multiplicative
inverse operations. The half-trace is used to perform the point halving prim-
itive, which is required in the pre-computation phase of the Montgomery-LD
halve-and-add algorithm. The multiplicative inverse is one of the operations in
the y-coordinate retrieval procedure, at the end of the Montgomery ladder al-
gorithms. Also, whenever post-computational additions are necessary, inverses
must be performed to convert a point from LD-projective to affine coordinates.
Although we are aware of the existence of protocols that consider the base
point as a secret information [6], in which case one could not consider that
our software provides protection against timing attacks, in the vast majority of
protocols, the base point is public. Consequently, any attacks aimed at the two
field operations mentioned above would be pointless.
5.2 Mechanisms to achieve a constant-time Koblitz implementation
Implementing Algorithm 5 in constant time needs some care, since all of its
building blocks must be implemented in constant time.
Finite field arithmetic. Modern implementations of finite field arithmetic can
make extensive use of vector registers, removing timing variances due to the cache
hierarchy. For our illustrative implementation of curve NIST-K283, we closely
follow the arithmetic described in Bluhm-Gueron [4], adopting the incomplete
reduction improvement proposed by Negre-Robert [28].
Integer recoding. All the branches in Algorithm 4 need to be eliminated by
conditional execution statements to protect leakage of the scalar k. Moreover, to
remove the remaining sign-related branches, multiple precision integer arithmetic
must be implemented in complement of two. If two constants, say βu, γu,are
stored in a precomputed table, then they need to be recovered by a linear pass
across the table in constant time. Finally, the partial reduction step producing ρ0
must also be implemented in constant time by removing all of its branches. Notice
that the requirement for r0, r1to be odd is not a problem, since partial reduction
can be modified to always result in odd integers, with a possible correction at
the end of the scalar multiplication by performing a (protected) conditional
subtraction of points (line 14 of Algorithm 5).
5.3 Results
Our implementation was mainly designed for the Intel Haswell processor family,
which supports vectorial sets such as SSE and AVX, a carry-less multiplication
and some bit manipulation instructions. The programming was done in C with
the support of assembly inline code. The compilation was performed via GCC
version 4.7.3 with the flags -m64 -march=core-avx2 -mtune=core-avx2 -O3
-fomit-frame-pointer -funroll-loops. Finally, the timings were collected
on an Intel Core i7-4700MQ, with the Turbo Boost and Hyperthreading features
disabled6.
Table 2 presents the experimental timings obtained for the most prominent
building blocks required for computing the point multiplication operation on the
GLS and Koblitz binary elliptic curves.
We present in Table 3 a comparison of our timings against a selection of
state-of-the-art implementations of the point multiplication operation on binary
and prime elliptic curves. Due to the Montgomery-LD point doubling efficiency,
which costs 49% less than a point halving, the GLS-Montgomery-LD-double-and-
add achieved the fastest timing in the one-core setting, with 70,800 clock cycles.
This is 13% faster than the performance obtained by the GLS-Montgomery-LD-
halve-and-add algorithm. In the known-base point setting, we can ignore the
GLS-Montgomery-LD-halve-and-add pre-computation expenses associated with
its table of halved points. In that case, we can compute the scalar multiplication
in an estimated time of 44,600 clock cycles using a table of just 4128 bytes.
6We intend to submit our software to the ECRYPT Benchmarking of Cryptographic
Systems (eBACS) SUPERCOP toolkit in the near future.
7The flexibility for finding a curve b-constant, provided by the GLS curves, allow
us to have a small √b(see Appendix C). As a consequence, we used the Eq. (5)
alternative formula.
Table 2. Timings (in clock cycles) for the elliptic curve operations in the Intel Haswell
platform.
Elliptic curve
operation
GLS E/F2254
cycles op/M1
Halving 184 4.181
Montgomery-LD D&A (left-to-right) Addition (Eq. (6)) 161 3.659
Montgomery-LD H&A (right-to-left) Addition (Eq. (8)) 199 4.522
Montgomery-LD Doubling7(Eq. (5)) 95 2.159
Elliptic curve
operation
Koblitz E/F2283
cycles op/M1
Frobenius 70 1.235
Integer τ-adic recoding (Alg. 4) (w= 5) 8,900 156.863
Point addition 602 10.588
1Ratio to multiplication.
Furthermore, the GLS-Montgomery-LD-halve-and-add is crucial for imple-
menting the multi-core versions of the Montgomery ladder. When compared
with our one-core double-and-add implementation, Table 3 reports a speedup
of 1.36 and 2.03 in our two- and four-core Montgomery ladder versions, re-
spectively. Here, besides the overhead costs commented in Section 3, we can
clearly perceive the usual multicore management penalty. Finally, we observe
that our GLS-Montgomery-LD-double-and-add surpasses by 48%, 40% and 2%
the Montgomery ladder implementations of [4] (Random), [4] (Koblitz) and [1],
respectively.
As for our Koblitz implementations, the fast τendomorphism allows us
to have a regular-recoding implementation that outperforms a standard Mont-
gomery ladder for Koblitz curves by 18%. In addition, our fastest Koblitz code
surpasses by 16% the recent implementation reported in [4] 8. Finally, note that,
in spite of the fact that the τendomorphism is 26% faster than the Montgomery-
LD point doubling, the superior efficiency of the GLS quadratic field arithmetic
produces faster results for the GLS Montgomery ladder algorithms.
6 Conclusion
We presented several algorithms that permit to compute a constant-time high-
security point multiplication operation over two families of binary elliptic curves,
namely, the GLS and the Koblitz curves. Although this work was completely fo-
cused on a high-end desk computation of the variable-base point multiplication,
8We could not reproduce the timing of 118,000 cycles with the code available from [4],
which indicates that TurboBoost could be possibly turned on on their benchmarks.
Considering this, our implementation of Koblitz-Montgomery-LD becomes 9% faster
than [4], reflecting the savings from partial reduction, and the speedup achieved by
the Koblitz-regular implementation increases to 26%.
Table 3. Timings (in clock cycles) for 128-bit level scalar multiplication with timing-
attack resistance in the Intel Ivy Bridge (I) and Haswell (H) architectures.
Method Cycles Arch
State-of-the-art
implementations
Montgomery-DJB-chain (prime) [7] 148,000 I
Random-Montgomery-LD ladder (binary) [4] 135,000 H
Genus-2-Kummer (prime) [5] 122,000 I
Koblitz-Montgomery-LD ladder (binary) [4] 118,000 H
Twisted-Edwards-4-GLV (prime) [11] 92,000 I
Genus-2-Kummer Montgomery ladder (prime) [1] 72,200 H
GLS-2-GLV double-and-add (binary, λ) [32] 60,000 H
Our Work
Koblitz-Montgomery-LD double-and-add (left-to-right) 122,000 H
Koblitz-regular τ-and-add (left-to-right, w= 5) 99,000 H
GLS-Montgomery-LD-2-GLV halve-and-add (Algorithm 3) 80,800 H
GLS-Montgomery-LD double-and-add (Algorithm 1) 70,800 H
2-core GLS-Montgomery-LD-2-GLV halve-and-add/double-and-add 52,000 H
4-core GLS-Montgomery-LD-2-GLV halve-and-add/double-and-add
(Algorithm 6)
34,800 H
the possibility of applying Algorithm 3 to the fixed-base point multiplication
setting is highly appealing since that procedure requires a comparatively small
pre-computed table of roughly 2n·(n+ 1) bits for computing a point multipli-
cation at the n-bit security level. The above combined with the Montgomery
ladder unique feature of performing all the computations using only two point
coordinates, should be attractive for deployments of public key cryptography on
constrained computing environments.
References
1. D. J. Bernstein, C. Chuengsatiansup, T. Lange, and P. Schwabe. Kummer strikes
back: new DH speed records. Cryptology ePrint Archive, Report 2014/134, 2014.
http://eprint.iacr.org/.
2. D. J. Bernstein and T. Lange. SafeCurves: choosing safe curves for elliptic-curve
cryptography. http://safecurves.cr.yp.to.
3. D. J. Bernstein and T. Lange. Security dangers of the NIST curves. Invited talk,
International State of the Art Cryptography Workshop, Athens, Greece, 2013.
4. M. Bluhm and S. Gueron. Fast Software Implementation of Binary Elliptic
Curve Cryptography. Cryptology ePrint Archive, Report 2013/741, 2013. http:
//eprint.iacr.org/.
5. J. W. Bos, C. Costello, H. Hisil, and K. Lauter. Fast Cryptography in Genus 2. In
T. Johansson and P. Q. Nguyen, editors, Advances in Cryptology - EUROCRYPT
2013, volume 7881 of LNCS, pages 194–210. Springer, 2013.
6. S. Chatterjee, K. Karabina, and A. Menezes. A New Protocol for the Nearby
Friend Problem. In M. G. Parker, editor, Cryptography and Coding, 12th IMA
International Conference, Cryptography and Coding 2009, volume 5921 of LNCS,
pages 236–251. Springer, 2009.
7. C. Costello, H. Hisil, and B. Smith. Faster Compact Diffie-Hellman: Endomor-
phisms on the x-line. In P. Nguyen and E. Oswald, editors, Advances in Cryptol-
ogy EUROCRYPT 2014, volume 8441 of LNCS, pages 183–200. Springer Berlin
Heidelberg, 2014.
8. T. Dierks and C. Allen. The TLS Protocol Version 1.0. RFC 2246 (Proposed
Standard), Jan. 1999. Obsoleted by RFC 4346, updated by RFCs 3546, 5746,
6176.
9. T. Dierks and E. Rescorla. The Transport Layer Security (TLS) Protocol Version
1.1. RFC 4346 (Proposed Standard), Apr. 2006. Obsoleted by RFC 5246, updated
by RFCs 4366, 4680, 4681, 5746, 6176.
10. T. Dierks and E. Rescorla. The Transport Layer Security (TLS) Protocol Version
1.2. RFC 5246 (Proposed Standard), August 2008.
11. A. Faz-Hern´andez, P. Longa, and A. H. Sanchez. Efficient and Secure Algo-
rithms for GLV-Based Scalar Multiplication and Their Implementation on GLV-
GLS Curves. In J. Benaloh, editor, Topics in Cryptology - CT-RSA 2014, volume
8366 of LNCS, pages 1–27. Springer, 2014.
12. A. Fog. Instruction Tables: List of Instruction Latencies, Throughputs and Micro-
operation Breakdowns for Intel, AMD and VIA CPUs., Accessed: May 14 2014.
Available at: http://www.agner.org/optimize/instruction_tables.pdf.
13. S. D. Galbraith, X. Lin, and M. Scott. Endomorphisms for Faster Elliptic Curve
Cryptography on a Large Class of Curves. In A. Joux, editor, Advances in Cryptol-
ogy - EUROCRYPT 2009, volume 5479 of LNCS, pages 518–535. Springer, 2009.
14. R. P. Gallant, R. J. Lambert, and S. A. Vanstone. Faster Point Multiplication on
Elliptic Curves with Efficient Endomorphisms. In J. Kilian, editor, Advances in
Cryptology CRYPTO 2001, volume 2139 of LNCS, pages 190–200. Springer Berlin
Heidelberg, August 2001.
15. P. Gaudry, F. Hess, and N. P. Smart. Constructive and destructive facets of Weil
descent on elliptic curves. Journal of Cryptology, 15:19–46, March 2002.
16. S. Gueron and V. Krasnov. Fast Prime Field Elliptic Curve Cryptography with 256
Bit Primes. Cryptology ePrint Archive, Report 2013/816, 2013. http://eprint.
iacr.org/.
17. D. Hankerson, K. Karabina, and A. Menezes. Analyzing the Galbraith-Lin-Scott
Point Multiplication Method for Elliptic Curves over Binary Fields. Computers,
IEEE Transactions on, 58(10):1411 – 1420, October 2009.
18. D. Hankerson, A. Menezes, and S. Vanstone. Guide to Elliptic Curve Cryptography.
Springer-Verlag New York, Inc., Secaucus, NJ, USA, 2003.
19. F. Hess. Generalising the GHS Attack on the Elliptic Curve Discrete Logarithm
Problem. LMS Journal of Computation and Mathematics, 7:167–192, June 2004.
20. Y.-J. Huang, C. Petit, N. Shinohara, and T. Takagi. Improvement of Faug`ere et
al.’s Method to Solve ECDLP. In K. Sakiyama and M. Terada, editors, Advances in
Information and Computer Security - IWSEC 2013, volume 8231 of LNCS, pages
115–132. Springer, 2013.
21. M. Joye and M. Tunstall. Exponent Recoding and Regular Exponentiation Al-
gorithms. In B. Preneel, editor, Progress in Cryptology – AFRICACRYPT 2009,
volume 5580 of LNCS, pages 334–349. Springer Berlin Heidelberg, 2009.
22. A. H. Koblitz, N. Koblitz, and A. Menezes. Elliptic curve cryptography: The
serpentine course of a paradigm shift. Journal of Number Theory, 131(5):781 –
814, 2011. Elliptic Curve Cryptography.
23. N. Koblitz. CM-curves with good cryptographic properties. In J. Feigenbaum,
editor, Advances in Cryptology - CRYPTO ’91, volume 576 of LNCS, pages 279–
287. Springer, 1991.
24. P. Longa and F. Sica. Four-Dimensional Gallant-Lambert-Vanstone Scalar Multi-
plication. Journal of Cryptology, 27(2):248–283, 2014.
25. J. L´opez and R. Dahab. Fast Multiplication on Elliptic Curves over GF(2m)
without Precomputation. In C¸ etin Kaya Ko¸c and C. Paar, editors, Cryptographic
Hardware and Embedded Systems, First International Workshop, CHES’99, volume
1717 of LNCS, pages 316–327. Springer, 1999.
26. P. L. Montgomery. Speeding the Pollard and elliptic curve methods of factorization.
Mathematics of Computation, 48:243–264, 1987.
27. National Institute of Standards and Technology. Recommended Elliptic Curves
for Federal Government Use. NIST Special Publication, 1999. http://csrc.nist.
gov/csrc/fedstandards.html.
28. C. N`egre and J.-M. Robert. Impact of Optimized Field Operations AB,AC and
AB+CD in Scalar Multiplication over Binary Elliptic Curve. In Progress in Cryp-
tology AFRICACRYPT 2013, volume 7918 of LNCS, pages 279–296. Springer
Berlin Heidelberg, 2013.
29. C. N`egre and J.-M. Robert. New Parallel Approaches for Scalar Multiplica-
tion in Elliptic Curve over Fields of Small Characteristic. 2013. http://hal.
archives-ouvertes.fr/docs/00/90/84/63/PDF/parallelization-ecsm8.pdf.
30. K. Okeya, T. Takagi, and C. Vuillaume. Efficient representations on koblitz curves
with resistance to side channel attacks. In ACISP, volume 3574 of LNCS, pages
218–229. Springer, 2005.
31. T. Oliveira, J. L´opez, D. F. Aranha, and F. Rodr´ıguez-Henr´ıquez. Lambda Coor-
dinates for Binary Elliptic Curves. In G. Bertoni and J.-S. Coron, editors, Cryp-
tographic Hardware and Embedded Systems - CHES 2013, volume 8086 of LNCS,
pages 311–330. Springer, 2013.
32. T. Oliveira, J. L´opez, D. F. Aranha, and F. Rodr´ıguez-Henr´ıquez. Two is the fastest
prime: lambda coordinates for binary elliptic curves. J. Cryptographic Engineering,
4(1):3–17, 2014.
33. C. Petit and J.-J. Quisquater. On Polynomial Systems Arising from a Weil Descent.
In X. Wang and K. Sako, editors, Advances in Cryptology - ASIACRYPT 2012,
volume 7658 of LNCS, pages 451–466. Springer, 2012.
34. J. Salowey. Confirming Consensus on removing RSA key Transport from TLS 1.3.
Transport Layer Security working group of the IETF Mailing List, May 3 2014.
35. M. Scott. Re: NIST announces set of Elliptic Curves. https://groups.google.
com/forum/message/raw?msg=sci.crypt/mFMukSsORmI/FpbHDQ6hM_MJ, 1999.
36. M. Shantz and E. Teske. Solving the Elliptic Curve Discrete Logarithm Prob-
lem Using Semaev Polynomials, Weil Descent and Gr¨obner Basis Methods –
an Experimental Study. Cryptology ePrint Archive, Report 2013/596, 2013.
http://eprint.iacr.org/.
37. J. A. Solinas. Efficient Arithmetic on Koblitz Curves. Designs, Codes and Cryp-
tography, 19(2-3):195–249, 2000.
38. J. Taverne, A. Faz-Hern´andez, D. F. Aranha, F. Rodr´ıguez-Henr´ıquez, D. Hanker-
son, and J. L´opez. Speeding scalar multiplication over binary elliptic curves using
the new carry-less multiplication instruction. Journal of Cryptographic Engineer-
ing, 1:187–199, November 2011.
A Multi-core Montgomery ladder
Here we present the four-core GLS-Montgomery-LD ladder algorithm. Given t4
the integer constant that establishes the workload of each algorithm, P∈E(Fq2),
and the scalar krepresented as k1+k2·δusing the GLS-GLV method, cores
Iand II are both responsible for computing bn
2c − t4bits of the subscalars k1
and k2using the Montgomery-LD double-and-add method. In turn, the cores
III and IV , both compute t4bits of k1and k2with the Montgomery-LD halve-
and-add algorithm. In the end, on a single core, it is necessary to add all the
accumulators Qi, for i= 0 . . . 3.
Algorithm 6 Parallel Montgomery ladder scalar multiplication (four-core)
Input: P∈E(Fq2) of order r, scalar kof bit length n, integer constant t4
Output: Q=kP
k0←2t4kmod r
Represent k0=k0
1+k0
2λ, where ψ(P) = λP
{Initialization}
R0← O, R1←P
for i=dn
2edownto t4do
b←k0
1,i ∈ {0,1}
R1−b←R1−b+Rb
Rb←2Rb
end for
Q0←R0
{Barrier}Core I
{Initialization}
R0← O, R1←P
for i=dn
2edownto t4do
b←k0
2,i ∈ {0,1}
R1−b←R1−b+Rb
Rb←2Rb
end for
Q1←R0
{Barrier}Core II
{Precomputation}
for i= 1 to t4+ 1 do
Pi←P
2i
end for
{Initialization}
R1←Pt4+1,R2←Pt4+1
for i= 0 to t4−1do
R0←Pt4−i
b←k0
1,i ∈ {0,1}
R2−b←R2−b+R0
end for
Q2←R1−Pt4+1
{Barrier}Core III
{Precomputation}
for i= 1 to t4+ 1 do
Pi←P
2i
end for
{Initialization}
R1←Pt4+1,R2←Pt4+1
for i= 0 to t4−1do
R0←Pt4−i
b←k0
2,i ∈ {0,1}
R2−b←R2−b+R0
end for
Q3←R1−Pt4+1
{Barrier}Core IV
return Q=Q0+Q2+ψ(Q1+Q3)
B Memory access pattern
The following data veiling algorithm ensures a fixed memory access pattern for
all Montgomery-LD ladder algorithms. Given the two Montgomery-LD ladder
accumulators Aand B, and the scalar k= (kn−1, kn−2,...k0), this method
allows us, in the beginning of the i-th main loop iteration, to use the bits ki−1
and kito decide if Aand Bwill or will not be swapped. As a result, it is not
necessary to reapply the procedure at the end of the i-th iteration.
Algorithm 7 Data veiling algorithm
Input: Scalar digits kiand ki−1, Montgomery-LD ladder accumulators Aand B
Output: Montgomery-LD ladder accumulators Aand B
mask ←0−(ki−1⊕ki)
tmp ←A⊕B
tmp ←tmp ∧mask
A←A⊕tmp
B←B⊕tmp
return A, B
C GLS elliptic curve parameters
For achieving a greater benefit from the multiplication by the b-constant in
the Montgomery-LD doubling formula X3=X04+bZ04= (X02+√bZ02)2we
carefully selected a GLS curve with a 64-bit b-parameter square-root. As a result,
we saved two carry-less multiplication and a dozen of SSE instructions per field
multiplication. Next, we describe the parameters, as polynomials represented in
hexadecimal, for our GLS curve Ea,b/Fq2:y2+xy =x3+ax2+b.
–a=u
–b=0x54045144410401544101540540515101
–√b=0xE2DA921E91E38DD1
The 253-bit prime order rof the main subgroup of Ea,b/Fq2is,
r=0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA6B89E49D3FECD828CA8D66BF4B88ED5.
Also, the integer δsuch that ψ(P) = δP for all P∈Ea,b is,
δ=0x74AEFB81EE8A42E9E9D0085E156A8EFBA3D302F9C74D737FA00360F9395C788.
The base point P= (x, y) of order rused in this work is,
x=0x4A21A3666CF9CAEBD812FA19DF9A3380 +0x358D7917D6E9B5A7550B1B083BC299F3 ·u
y=0x6690CB7B914B7C4018E7475D9C2B1C13 +0x2AD4E15A695FD54011BA179D5F4B44FC ·u.
Finally, the towering of our field Fq∼
=F2[x]/(f(x)) and its quadratic exten-
sion Fq2∼
=Fq[u]/(g(x)) is constructed by means of the irreducible trinomials
f(x) = x127 +x63 + 1 and g(u) = u2+u+ 1.
