On-the-Fly Multi-base Recoding for ECC Scalar Multiplication without Pre-computations

Abstract

Abstract-Scalar recoding is popular to speed up ECC scalar multiplication: non-adjacent form, double-base number system, multi-base number system. But fast recoding methods require pre-computations: multiples of base point or off-line conversion. In this paper, we present a multi-base recoding method for ECC scalar multiplication based on i) a greedy algorithm starting least significant terms first, ii) cheap divisibility tests by multi-base elements and iii) fast exact divisions by multibase elements. Multi-base terms are obtained on-the-fly using a special recoding unit which operates in parallel to curve-level operations and at very high speed. This ensures that all recoding steps are performed fast enough to schedule the next curve-level operations without interruptions. The proposed method can be fully implemented in hardware without pre-computations. We report FPGA implementation details and very good performances compared to state-of-art results.

Efficient and Secure ECDSA Algorithm and its Applications: A Survey

“…This method presents efficiency in scalar multiplication better than previous representation methods, where we note from the previous example that septupling is more redundant and has fewer terms than quintupling. Also, Chabrier and Tisserand [59] proposed MBNR (2,3,5,7) to represent scalar without precomputation. They investigated the costs in their method when a = -3, the cost is 18m + 11s (prime field).…”

FPGA Implementation and Comparison of Protections Against SCAs for RLWE

“…In RSA and ECC, some exponent or scalar randomization countermeasures have been proposed against SCAs (see for instance [7]). A secret exponent or scalar can be randomized without loss of information by adding a random multiple of the group order to it.…”

Randomized Mixed-Radix Scalar Multiplication

“…For example, by independently computing the remainders modulo the largest powers of 2 and 3 (possibly 5) in and by Chinese remaindering. We point the interested reader to the very fast mod3 implementation based on historic Pascal's tapes proposed in [34]. The exact division by m in line 9 can also be implemented very efficiently, for example using Jebelean's exact division [35].…”