Lambda Coordinates for Binary Elliptic Curves

Efficient and Secure Algorithms for GLV-Based Scalar Multiplication and Their Implementation on GLV-GLS Curves

“…Our results are more than 2 times faster than Bernstein et al's implementation using a Montgomery curve over F p [5] on the targeted x64 processors. In comparison with curvebased implementations on genus 2 curves or binary curves, we observe that our results are between 24%-26% faster than the genus 2 implementation by Bos et al [8], and between 19%-24% faster than the implementation by Oliveira et al [35] based on a binary GLS curve using the 2-GLV method 1 . Only the recent implementation by Bernstein et al [4], which uses the same genus 2 Kummer surface employed by Bos et al [8], is able to achieve a performance that is comparable to this work, with a result that is slightly slower on the Intel Ivy Bridge processor.…”

“…Bos et al [9] explore the combined GLV-GLS approach over genus 2 curves defined over F p 2 , which supports an 8-GLV decomposition. In the case of binary GLS elliptic curves, Oliveira et al [35] report the implementation of a curve exploiting the 2-GLV method. More recently, Guillevic and Ionica [18] show how to exploit the 4-GLV method on certain genus one curves defined over F p 2 and genus two curves defined over F p ; and Smith [39] proposes a new family of elliptic curves that support 2-GLV decompositions.…”

“…From all the works above, only [31] and [35] include side-channel protection in their GLV-based implementations.…”

“…Later, in [16] Galbraith et al showed how to exploit the Frobenius endomorphism to enable the use of the GLV approach on a wider set of curves defined over the quadratic extension field F p 2 . Since then, significant research has been performed to improve the performance [30,24] and to explore the applicability to other settings [20,35] or to higher dimensions on genus one curves [24,31,18] and genus two curves [8,9,18]. Unfortunately, most of the work and comparisons with other approaches have been carried out with unprotected algorithms and implementations.…”

“…Moreover, it does not require dummy operations, making it resilient to safe-error attacks [42,43], and can be used as basis for realizing constanttime implementations that guard against timing attacks [26,11,2,36]. In addition, we present different variants of the technique that are intended for different scenarios exploiting simple or complex GLV decompositions, and thus provide algorithms that have broad applicability to many settings using GLV, GLS, or a combination of both [16,20,30,24,31,35,8,9,18,39]. In comparison with the best previous approaches, the method improves the computing performance especially during the potentially expensive precomputation stage, and allows us to save at least half of the storage requirement for precomputed values without impacting performance.…”