Four $$\mathbb {Q}$$ : Four-Dimensional Decompositions on a $$\mathbb {Q}$$ -curve over the Mersenne Prime

FourQ on embedded devices with strong countermeasures against side-channel attacks

“…FourQ, introduced by Costello and Longa in 2015 [16], is defined by the complete twisted Edwards [4] equation E/F p 2 : −x 2 + y 2 = 1 + dx 2 y 2 , where the quadratic extension field F p 2 = F p (i) for i 2 = −1 and p = 2 127 − 1, and d = 125317048443780598345676279555970305165 · i + 4205857648805777768770. The prime order subgroup E(F p 2 ) [N ], where N is the 246-bit prime corresponding to #E(F p 2 ) = 392 · N , is used to carry out cryptographic computations.…”

“…FourQ [16] is a high-performance elliptic curve that provides about 128 bits of security and enables efficient and secure scalar multiplications. Implementations based on this curve have been shown to achieve the fastest computations of variable-base, fixed-base and double scalar multiplications to date on a large variety of x64 and ARMv7-A processors [16,36].…”

“…Implementations based on this curve have been shown to achieve the fastest computations of variable-base, fixed-base and double scalar multiplications to date on a large variety of x64 and ARMv7-A processors [16,36]. This performance trait is especially attractive for IoT, when devices need to keep clock frequencies to a minimum (in order to fulfill limited power budgets) and yet need to minimize the impact on the device's response time.…”

Single-Trace Side-Channel Attacks on Scalar Multiplications with Precomputations

“…These include, e.g., regular w-NAF and m-ary methods [20,34,40,45,51], regular width-w τ -adic NAF method for Koblitz curves [46], the regular signed-digit comb methods [21,30], and scalar multiplications on curves with fast endomorphisms that use multiscalar multiplications with precomputations (e.g., GLV [24] and GLS [23] methods and, in particular, the recent regular algorithm [19]). Some of these methods have been recently utilized in lightweight ECC implementations to achieve protection against single-trace attacks: e.g., [30] was used in [47], [46] in [48], and [19] in [14]. All deterministic countermeasures inside Ψ such as atomicity of point addition and point doubling, unified addition formulae, etc., do not work against the attack and are, thus, also in the list of vulnerable methods when used in a scalar multiplication algorithm that utilizes precomputations in the above sense.…”

“…Fully regular patterns of operations can be achieved with atomic scalar multiplication algorithms with precomputations which typically combine side-channel security with efficiency (see, e.g., [19,30,45,46]). Such algorithms have been recently used for side-channel protected lightweight hardware implementations, e.g., in [47,48] as well as fast software, e.g., in [14]. In the light of new advanced single-trace attacks, there have been doubts about the security offered by these algorithms (see, e.g., [3,31,47]).…”