Efficient and Secure Algorithms for GLV-Based Scalar Multiplication and Their Implementation on GLV-GLS Curves

Abstract

We propose efficient algorithms and formulas that improve the performance of side channel protected elliptic curve computations with special focus on scalar multiplication exploiting the Gallant-Lambert-Vanstone (CRYPTO 2001) and Galbraith-Lin-Scott (EUROCRYPT 2009) methods. Firstly, by adapting Feng et al.'s recoding to the GLV setting, we derive new regular algorithms for variable-base scalar multiplication that offer protection against simple side-channel and timing attacks. Secondly, we propose an efficient, sidechannel protected algorithm for fixed-base scalar multiplication which combines Feng et al.'s recoding with Lim-Lee's comb method. Thirdly, we propose an efficient technique that interleaves ARM and NEON-based multiprecision operations over an extension field to improve performance of GLS curves on modern ARM processors. Finally, we showcase the efficiency of the proposed techniques by implementing a state-of-the-art GLV-GLS curve in twisted Edwards form defined over F p 2 , which supports a four dimensional decomposition of the scalar and is fully protected against timing attacks. Analysis and performance results are reported for modern x64 and ARM processors. For instance, we compute a variable-base scalar multiplication in 89,000 and 244,000 cycles on an Intel Ivy Bridge and an ARM Cortex-A15 processor (respect.); using a precomputed table of 6KB, we compute a fixed-base scalar multiplication in 49,000 and 116,000 cycles (respect.); and using a precomputed table of 3KB, we compute a double scalar multiplication in 115,000 and 285,000 cycles (respect.). The proposed techniques represent an important improvement of the state-ofthe-art performance of elliptic curve computations, and allow us to set new speed records in several modern processors. The techniques also reduce the cost of adding protection against timing attacks in the computation of GLV-based variable-base scalar multiplication to below 10%. This work is the extended version of a publication that appeared at CT-RSA 2014 [12].

Kummer Strikes Back: New DH Speed Records

“…Our speeds also solidly beat all available ECC software, including [8], [11], and [17]; solidly beat the Sandy Bridge/Ivy Bridge ECC speeds claimed in [28], [32], and [35]; and are even faster than the previous Sandy Bridge/Ivy Bridge DH record claimed in [19], namely 96000/92000 cycles using unpublished software for GLV+GLS ECC. The only high-security DH speed faster than ours in the literature is the 60000 Haswell cycles claimed in [35] for a GLS curve over a binary field.…”

“…For comparison, the public has no easy way to check the "constant time" claims for the software in [19], so for users the only safe assumption is that the claims are not correct. If that software is deployed somewhere then an attacker can be expected to do the necessary reverse-engineering work to discover and exploit the timing variability.…”

Jacobian Coordinates on Genus 2 Curves

“…More specifically, there are scalar recoding algorithms (cf. [24,16]) that seemingly make it possible to implement the Jac1271 or GLV128c routines such that scalar multiplications on random inputs will run in constant time with probability exponentially close to 1. However, in order to guard against active adversaries and to be considered truly constant-time, the routines should be guaranteed to execute identically and run correctly for all combinations of integer scalars and input points; this means the explicit formulas must be able to handle input combinations in J C that are not "general" in the sense of Assumption 1.…”

Montgomery Multiplication Using Vector Instructions

“…The authors of [6,12,35] propose ways to speed up cryptography using the NEON vector instructions. Intel's SSE2 vector instruction set extension is used to compute pairings in [15] and multiply big numbers in [21].…”