Endomorphisms for Faster Elliptic Curve Cryptography on a Large Class of Curves

Abstract

Efficiently computable homomorphisms allow elliptic curve point multiplication to be accelerated using the Gallant-Lambert-Vanstone (GLV) method. We extend results of Iijima, Matsuo, Chao and Tsujii which give such homomorphisms for a large class of elliptic curves by working over F p 2 and demonstrate that these results can be applied to the GLV method. In general we expect our method to require about 0.75 the time of previous best methods (except for subfield curves, for which Frobenius expansions can be used). We give detailed implementation results which show that the method runs in between 0.70 and 0.84 the time of the previous best methods for elliptic curve point multiplication on general curves.

A Survey of Public-Key Cryptographic Primitives in Wireless Sensor Networks

“…Constructing efficiently computable endomorphisms is one of the key problems in the GLV method. In 2002, Iijima et al [85] constructed an efficient computable homomorphism on elliptic curves E(F p 2 ) with j(E) ∈ F p arising from the Frobenius map on a twist of E. Galbraith et al [86] generalized their construction for a large class of elliptic curves over F p 2 (referred to as GLS curves) and applied the GLV method. They gave detailed implementations on these curves, showing that their method ran in between 0.70 and 0.84 the time of the best methods for SMs on general curves at that time.…”

Faster Software for Fast Endomorphisms

“…More recently, Galbraith et al show how to apply it to larger classes of curves [8]. The key idea for these GLS curves is to work over small extension fieldsotherwise the scalar multiplication methods are analogous to those used in GLV.…”

Fast Cryptography in Genus 2

“…There are multiple ways to save computations in this latter approach. After computing the multiples in the first lookup table L 0 , the values for the d − 1 other tables can be computed by applying the map φ to the individual point in the lookup table [25]. Since the computation of the map φ only takes three or four multiplications (depending on the curve used), this is a significant saving compared to computing the group operation which is an order of magnitude slower.…”

“…Another advantage for genus 2 curves is that the endomorphism ring is larger than it is in the case of genus 1, so it is possible to achieve higher dimensional GLV scalar decompositions [26] (without passing to an extension field to make use of GLS [25]). For prime fields, we implement four-dimensional GLV decompositions on Buhler-Koblitz (BK) curves [16] and on Furukawa-Kawazoe-Takahashi (FKT) curves [24], both of which are faster than all prior eBACS-documented implementations.…”