Low-Weight Primes for Lightweight Elliptic Curve Cryptography on 8-bit AVR Processors

Abstract

Abstract. Small 8-bit RISC processors and micro-controllers based on the AVR instruction set architecture are widely used in the embedded domain with applications ranging from smartcards over control systems to wireless sensor nodes. Many of these applications require asymmetric encryption or authentication, which has spurred a body of research into implementation aspects of Elliptic Curve Cryptography (ECC) on the AVR platform. In this paper, we study the suitability of a special class of finite fields, the so-called Optimal Prime Fields (OPFs), for a "lightweight" implementation of ECC with a view towards high performance and security. An OPF is a finite field Fp defined by a prime of the form p = u · 2 k + v, whereby both u and v are "small" (in relation to 2 k ) so that they fit into one or two registers of an AVR processor. OPFs have a low Hamming weight, which allows for a very efficient implementation of the modular reduction since only the non-zero words of p need to be processed. We describe a special variant of Montgomery multiplication for OPFs that does not execute any input-dependent conditional statements (e.g. branch instructions) and is, hence, resistant against certain side-channel attacks. When executed on an Atmel ATmega processor, a multiplication in a 160-bit OPF takes just 3237 cycles, which compares favorably with other implementations of 160-bit modular multiplication on an 8-bit processor. We also describe a performance-optimized and a security-optimized implementation of elliptic curve scalar multiplication over OPFs. The former uses a GLV curve and executes in 4.19 M cycles (over a 160-bit OPF), while the latter is based on a Montgomery curve and has an execution time of approximately 5.93 M cycles. Both results improve the state-of-the-art in lightweight ECC on 8-bit processors.

Efficient Implementation of ECDH Key Exchange for MSP430-Based Wireless Sensor Networks

“…In other words, a MoTE curve can only be generated over a prime field Fp whose order is congruent to 1 modulo 4 [6,16]. The authors of the original MoTE-ECC paper [16] used so-called Optimal Prime Fields (OPFs) as underlying algebraic structure, which are defined by primes of the form p = u · 2 k + 1 where u has a length of up to 16 bits [15]. While such primes are always congruent to 1 mod 4, they have the disadvantage that the computation of square roots mod p is costly, which poses a problem for application scenarios where point compression is desirable 1 .…”

“…A further drawback of OPFs is that, despite their excellent arithmetic properties (see e.g. [15]), they are not (yet) widely supported by other ECC implementations for WSNs. Therefore, and since we want our software to be suitable for applications that require point compression, we eventually decided to not use OPFs.…”

“…Similar to numerous other ECC software implementations, e.g. [15], we adopt the idea of incomplete modular reduction, which means all arithmetic operations modulo p accept operands that are not fully reduced (and hence not less than p), as long as they fit into m words. In our case, the operands can be up to n = mw = k + 1 bits long because the exponent k of the primes we use is not a multiple of w but one bit shorter.…”

“…When using a pseudoMersenne prime, it is common practice to do the reduction mod p after the multiplication instead of executing them in an interleaved fashion as in [15]. Also our implementation for the MSP430 follows this basic approach.…”

“…In contrast, our software supports Montgomery and Edwards curves over a 159 and a 191-bit prime field, which represents a good compromise between performance and security. Our implementation is inspired by MoTE-ECC [16], but we use pseudo-Mersenne prime fields instead of the so-called Optimal Prime Fields (OPFs) [15] to facilitate inter-operability with other ECC implementations. We implemented and optimized all field operations from scratch in Assembly language, whereby we paid particular attention to the squaring since it was often ignored in related work.…”