Faster Software for Fast Endomorphisms

Abstract

Abstract. GLV curves (Gallant et al.) have performance advantages over standard elliptic curves, using half the number of point doublings for scalar multiplication. Despite their introduction in 2001, implementations of the GLV method have yet to permeate widespread software libraries. Furthermore, side-channel vulnerabilities, specifically cachetiming attacks, remain unpatched in the OpenSSL code base since the first attack in 2009 (Brumley and Hakala) even still after the most recent attack in 2014 (Benger et al.). This work reports on the integration of the GLV method in OpenSSL for curves from 160 to 256 bits, as well as deploying and evaluating two side-channel defenses. Performance gains are up to 51%, and with these improvements GLV curves are now the fastest elliptic curves in OpenSSL for these bit sizes.

Euclidean addition chains scalar multiplication on curves with efficient endomorphism

“…An implementation of GLV (standard and secure version) for OpenSSL is discussed in [6]. For a 128-bit security level, the proposed secure version is about 10% slower than the standard GLV version.…”

Side-Channel Analysis of SM2

“…Ladder. While it is indeed feasible to reduce leakage in OpenSSL's wNAF scalar multiplication code path [18], tediously straightlining conditions and making table lookups regular adds significant code complexity, increases the probability of defects, and generally results in low maintainability code. Even then, there is no guarantee that all leakage issues are addressed: the code path was not initially intended to resist SCA, and retrofitting mitigations becomes awkward.…”