Random Euclidean Addition Chain Generation and Its Application to Point Multiplication

Abstract

International audienceEfficiency and security are the two main objectives of every elliptic curve scalar multiplication implementations. Many schemes have been proposed in order to speed up or secure its computation, usually thanks to efficient scalar representation [30,10,24], faster point operation formulae [8,25,13] or new curve shapes [2]. As an alternative to those general methods, authors have suggested to use scalar belonging to some subset with good computational properties [15,14,36,41,42], leading to faster but usually cryptographically weaker systems. In this paper, we use a similar approach. We propose to modify the key generation pro- cess using a small Euclidean addition chain c instead of a scalar k. This allows us to use a previous scheme, secure against side channel attacks, but whose efficiency relies on the computation of small chains computing the scalar. We propose two different ways to generate short Euclidean addition chains and give a first theoretical analysis of the size and dis- tribution of the obtained keys. We also propose a new scheme in the context of fixed base point scalar multiplication

Euclidean addition chains scalar multiplication on curves with efficient endomorphism

“…Then we generalize the results from [21] on the distribution of integers computed by an EAC starting from any pair of points (aP, bP ) when P is fixed (Corollary 1). Finally we consider the case of scalar multiplication with a random base point on curves with a fast endomorphism φ (Proposition 4).…”

“…the date of receipt and acceptance should be inserted later Abstract Random Euclidean addition chain generation has proven to be an efficient low memory and SPA secure alternative to standard ECC scalar multiplication methods in the context of fixed base point [21]. In this work, we show how to generalize this method to random point scalar multiplication on elliptic curves with an efficiently computable endomorphism.…”

“…Several works have used those formulae to propose efficient and secure scalar multiplication schemes: one can see [23,2,21] for right-to-left algorithms and [26] for left-to-right applications.…”

“…Following notations from [21], the first computation will be called a big step (denoted by 0) and the second one will be called a small step (denoted by 1). For instance, starting from P and 2P (sharing the same Z-coordinate), one can compute (P, 3P ) or (2P, 3P ).…”

“…To obtain a proven security of n bits, that is to say to be able to guarantee that one can generate 2 n different chains computing 2 n different points, one can work with chains of length n but has to pre-compute the pair (F n+2 P, F n+3 P ), where {F n } is the Fibonacci sequence, and work on larger fields than standard methods. Those constraints limit the use of this approach to the case of fixed base point scalar multiplication [21].…”