Fast FPGA Implementations of Diffie-Hellman on the Kummer Surface of a Genus-2 Curve

Abstract

We present the first hardware implementations of Diffie-Hellman key exchange based on the Kummer surface of Gaudry and Schost’s genus-2 curve targeting a 128-bit security level. We describe a single-core architecture for lowlatency applications and a multi-core architecture for high-throughput applications. Synthesized on a Xilinx Zynq-7020 FPGA, our architectures perform a key exchange with lower latency and higher throughput than any other reported implementation using prime-field elliptic curves at the same security level. Our single-core architecture performs a scalar multiplication with a latency of 82 microseconds while our multicore architecture achieves a throughput of 91,226 scalar multiplications per second. When compared to similar implementations of Microsoft’s Fourℚ on the same FPGA, this translates to an improvement of 48% in latency and 40% in throughput for the single-core and multi-core architecture, respectively. Both our designs exhibit constant-time execution to thwart timing attacks, use the Montgomery ladder for improved resistance against SPA, and support a countermeasure against fault attacks.

A High-Performance ECC Processor Over Curve448 Based on a Novel Variant of the Karatsuba Formula for Asymmetric Digit Multiplier

“…Their implementations require a fewer number of DSP blocks compared to standard titling generated from the schoolbook multiplication algorithm. Accordingly, [20] and [32] use this technique for their multiplier construction of the SIKE accelerator and Diffie-Hellman key exchange based on the Kummer surface, respectively. Compared to the non-standard tiling technique, our work requires less DSP utilization (e.g., for 256-bit multiplier, we achieve 31% more efficient than their work).…”

“…Compared to the non-standard tiling technique, our work requires less DSP utilization (e.g., for 256-bit multiplier, we achieve 31% more efficient than their work). In another word, we may increase the performance of [20] and [32] by only changing their multiplier circuit with ours. Furthermore, the proposed multiplier construction can be generalized for broader use in a cryptographic algorithm that employs multiplication.…”