33us, 94uJ Optimal Ate Pairing Engine on BN Curve over 254b Prime Field in 65nm CMOS FDSOI

A Low-Power Elliptic Curve Pairing Crypto-Processor for Secure Embedded Blockchain and Functional Encryption

“…We profiled various CIOS multipliers on our test chip and verified that energy consumption saturates at 64b word size, with 50% and 25% lower energy than conventional 16b and 32b architectures respectively. It is also more energy-efficient than previous work [2,3,4] when normalized with respect to prime size. A pair of cascaded 381b adder-subtractors is used for modular addition and subtraction, while modular inversion is implemented using exponentiation following Fermat's theorem.…”

“…3 shows our design of an energy-efficient modular arithmetic unit for the BLS12-381 curve. Modular arithmetic in Montgomery domain is standard for such large prime fields, and previous work on pairing accelerators use either high-performance parallel pipelined architectures with large area overhead [3,4] or compact serial multipliers with lower energy-efficiency [2]. To balance area and energy-efficiency, we implement Montgomery modular multiplication using the coarsely integrated operand scanning (CIOS) approach [5], which splits zero-padded inputs into six 64b words and operates on them iteratively using a 64b × 64b multiplier and a 128b + 64b + 64b adder, both utilizing carry-save structures for shorter critical path delay.…”

“…Verification of aggregate signatures involves the multiplication of several pairings, also known as a multi-pairing. While previous work [4] shares only the FE computation for multi-pairing, we share both ML and FE leading to 30% additional energy savings. Furthermore, to accelerate inner product encryption, we utilize special properties of the BLS12-381 elliptic curve such as Frobenius endomorphism and GLV scalar decomposition [6] to achieve 1.8× reduction in energy consumption compared to the baseline algorithm [10].…”

BN-254 Based Multi-Core, Multi-Pairing Crypto-Processor for Functional Encryption

“…2, contains arithmetic unit that realizes Montgomery multiplication, and the 2nd-layer sequencer that specifies the detailed arithmetic order. Three 1st-layer sequences are attached to three calculation cores, and units are fully pipelined F p 2 multiplier, constant multiplier, and ξ multiplier proposed by Ikeda et al [6].…”

“…Awano [5] optimized F p 12 calculation by global optimization of pipelined F p 2 multipliers, results in 9,270 cycles. Ikeda [6] optimized number of…”