A Coprocessor for the Final Exponentiation of the η T Pairing in Characteristic Three

Beuchat, Jean-Luc; Brisebarre, Nicolas; Shirase, Masaaki; Takagi, Tsuyoshi; Okamoto, Eiji

doi:10.1007/978-3-540-73074-3_4

Cited by 11 publications

(23 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…This choice of parameters allows us to easily compare our work against the many pairing accelerators for m = 97 described in the open literature. Instead of embedding dedicated hardware to perform the inversion over F 3 97 according to the Extended Euclidean Algorithm (EEA), Beuchat et al [6] proposed an algorithm based on Fermat's little theorem and on Itoh and Tsujii's work [15] for F 3 97 . It involves 96 cubings and 9 multiplications.…”

Section: Calculation Of the η T Pairing In Characteristic Threementioning

confidence: 99%

“…Beuchat et al [6] designed a unified arithmetic operator able to perform addition, multiplication, and cubing over operator is based on the array multiplier architecture proposed by Shu, Kwon, and Gaj in [27] (see [29,5] for an introduction to array multipliers). Since such multipliers process D coefficients of an operand at each clock cycle, they mainly consist of D Partial Product Generators (PPGs), a D-operand adder, and an accumulator.…”

Section: An Accelerator For the η T Pairing Calculationmentioning

confidence: 99%

“…Addition is somewhat more complex and we will use the toy example proposed in [6] to illustrate how the operator works. Let us assume we have to compute −a(x) + b(x).…”

Section: An Accelerator For the η T Pairing Calculationmentioning

confidence: 99%

“…In order to efficiently implement successive cubings, a feedback mechanism allows one to load R1 and R2 with the result of a cubing (multiplexers controlled by c 0 and c 2 on Figure 1). Figure 2 describes the architecture of our η T pairing coprocessor, which is mainly based on the hardware accelerator for the final exponentiation introduced in [6]. It consists of a single processing element (unified operator for addition, multiplication, and cubing), registers implemented by means of a dual-port RAM (six Virtex-II Pro SelectRAM+ blocks), and a control unit which consists of a Finite State Machine (FSM) and an instruction memory (ROM).…”

Section: An Accelerator For the η T Pairing Calculationmentioning

confidence: 99%

“…In [7] Beuchat et al proposed a modified η T pairing algorithm in characteristic three that does not require any inverse Frobenius map. Moreover, they designed a novel arithmetic operator implementing addition, cubing, and multiplication over F 3 97 which performs in a fast and cheap way the final exponentiation η T (P, Q) W [6]. In this paper, we extend this approach to the computation of the full η T pairing (i.e.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Arithmetic Operators for Pairing-Based Cryptography

Beuchat

Brisebarre

Detrey

et al. 2007

Cryptographic Hardware and Embedded Systems - CHES 2007

Self Cite

View full text Add to dashboard Cite

Abstract. Since their introduction in constructive cryptographic applications, pairings over (hyper)elliptic curves are at the heart of an ever increasing number of protocols. Software implementations being rather slow, the study of hardware architectures became an active research area. In this paper, we first study an accelerator for the ηT pairing over F3 [x]/(x 97 + x 12 + 2). Our architecture is based on a unified arithmetic operator which performs addition, multiplication, and cubing over F 3 97 . This design methodology allows us to design a compact coprocessor (1888 slices on a Virtex-II Pro 4 FPGA) which compares favorably with other solutions described in the open literature. We then describe ways to extend our approach to any characteristic and any extension field.

show abstract

Section: Calculation Of the η T Pairing In Characteristic Threementioning

confidence: 99%

Section: An Accelerator For the η T Pairing Calculationmentioning

confidence: 99%

“…Addition is somewhat more complex and we will use the toy example proposed in [6] to illustrate how the operator works. Let us assume we have to compute −a(x) + b(x).…”

Section: An Accelerator For the η T Pairing Calculationmentioning

confidence: 99%

Section: An Accelerator For the η T Pairing Calculationmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Arithmetic Operators for Pairing-Based Cryptography

Beuchat

Brisebarre

Detrey

et al. 2007

Cryptographic Hardware and Embedded Systems - CHES 2007

Self Cite

View full text Add to dashboard Cite

show abstract

Hardware Accelerator for the Tate Pairing in Characteristic Three Based on Karatsuba-Ofman Multipliers

Beuchat

Detrey

Estibals

et al. 2009

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Abstract. This paper is devoted to the design of fast parallel accelerators for the cryptographic Tate pairing in characteristic three over supersingular elliptic curves. We propose here a novel hardware implementation of Miller's loop based on a pipelined Karatsuba-Ofman multiplier. Thanks to a careful selection of algorithms for computing the tower field arithmetic associated to the Tate pairing, we manage to keep the pipeline busy. We also describe the strategies we considered to design our parallel multiplier. They are included in a VHDL code generator allowing for the exploration of a wide range of operators. Then, we outline the architecture of a coprocessor for the Tate pairing over F3m . However, a final exponentiation is still needed to obtain a unique value, which is desirable in most of the cryptographic protocols. We supplement our pairing accelerator with a coprocessor responsible for this task. An improved exponentiation algorithm allows us to save hardware resources.According to our place-and-route results on Xilinx FPGAs, our design improves both the computation time and the area-time trade-off compared to previoulsy published coprocessors.

show abstract

Breaking Pairing-Based Cryptosystems Using η T Pairing over GF(397)

Hayashi

Shimoyama

Shinohara

et al. 2012

Advances in Cryptology – ASIACRYPT 2012

Self Cite

View full text Add to dashboard Cite

Abstract. There are many useful cryptographic schemes, such as ID-based encryption, short signature, keyword searchable encryption, attribute-based encryption, functional encryption, that use a bilinear pairing. It is important to estimate the security of such pairing-based cryptosystems in cryptography. The most essential number-theoretic problem in pairing-based cryptosystems is the discrete logarithm problem (DLP) because pairing-based cryptosystems are no longer secure once the underlining DLP is broken. One efficient bilinear pairing is the ηT pairing defined over a supersingular elliptic curve E on the finite field GF (3 n ) for a positive integer n. The embedding degree of the ηT pairing is 6; thus, we can reduce the DLP over E on GF (3 n ) to that over the finite field GF (3 6n ). In this paper, for breaking the ηT pairing over GF (3 n ), we discuss solving the DLP over GF (3 6n ) by using the function field sieve (FFS), which is the asymptotically fastest algorithm for solving a DLP over finite fields of small characteristics. We chose the extension degree n = 97 because it has been intensively used in benchmarking tests for the implementation of the ηT pairing, and the order (923-bit) of GF (3 6·97 ) is substantially larger than the previous world record (676-bit) of solving the DLP by using the FFS. We implemented the FFS for the medium prime case (JL06-FFS), and propose several improvements of the FFS, for example, the lattice sieve for JL06-FFS and the filtering adjusted to the Galois action. Finally, we succeeded in solving the DLP over GF (3 6·97 ). The entire computational time of our improved FFS requires about 148.2 days using 252 CPU cores. Our computational results contribute to the secure use of pairing-based cryptosystems with the ηT pairing.

show abstract

A Coprocessor for the Final Exponentiation of the η T Pairing in Characteristic Three

Cited by 11 publications

References 22 publications

Arithmetic Operators for Pairing-Based Cryptography

Arithmetic Operators for Pairing-Based Cryptography

Hardware Accelerator for the Tate Pairing in Characteristic Three Based on Karatsuba-Ofman Multipliers

Breaking Pairing-Based Cryptosystems Using η T Pairing over GF(397)

Contact Info

Product

Resources

About