Software Implementation of Elliptic Curve Cryptography over Binary Fields

Hankerson, Darrel; Hernandez, Julio López; Menezes, Alfred

doi:10.1007/3-540-44499-8_1

Cited by 270 publications

(197 citation statements)

References 29 publications

Supporting

Mentioning

197

Contrasting

Order By: Relevance

“…With a polynomial basis, according to [4], S ≈ 1 7.5 M for n = 163 and 1 9 M for n = 233. Following [3] we assume that, on average, I ≈ 8 M when n = 163 and I ≈ 10 M when n = 233.…”

Section: Point Halvingmentioning

confidence: 99%

Minimality of the Hamming Weight of the τ-NAF for Koblitz Curves and Improved Combination with Point Halving

Avanzi

Heuberger

Prodinger

2006

Selected Areas in Cryptography

View full text Add to dashboard Cite

Abstract. In order to efficiently perform scalar multiplications on elliptic Koblitz curves, expansions of the scalar to a complex base associated with the Frobenius endomorphism are commonly used. One such expansion is the τ -adic NAF, introduced by Solinas. Some properties of this expansion, such as the average weight, are well known, but in the literature there is no proof of its optimality, i.e. that it always has minimal weight. In this paper we provide the first proof of this fact. Point halving, being faster than doubling, is also used to perform fast scalar multiplications on generic elliptic curves over binary fields. Since its computation is more expensive than that of the Frobenius, halving was thought to be uninteresting for Koblitz curves. At PKC 2004, Avanzi, Ciet, and Sica combined Frobenius operations with one point halving to compute scalar multiplications on Koblitz curves using on average 14% less group additions than with the usual τ -and-add method without increasing memory usage. The second result of this paper is an improvement over their expansion. The new representation, called the widedouble-NAF, is not only simpler to compute, but it is also optimal in a suitable sense. In fact, it has minimal Hamming weight among all τ -adic expansions with digits {0, ±1} that allow one halving to be inserted in the corresponding scalar multiplication algorithm. The resulting scalar multiplication requires on average 25% less group operations than the This paper was in part written while this author was visiting the

show abstract

“…With a polynomial basis, according to [4], S ≈ 1 7.5 M for n = 163 and 1 9 M for n = 233. Following [3] we assume that, on average, I ≈ 8 M when n = 163 and I ≈ 10 M when n = 233.…”

Section: Point Halvingmentioning

confidence: 99%

Minimality of the Hamming Weight of the τ-NAF for Koblitz Curves and Improved Combination with Point Halving

Avanzi

Heuberger

Prodinger

2006

Selected Areas in Cryptography

View full text Add to dashboard Cite

show abstract

“…The inverse can be efficiently calculated by the extended Euclidean algorithm for polynomials. In our solution, we use the "modified almost inverse algorithm for inversion in F 2 m " algorithm [6] to calculate the inversion of a polynomial in F 2 163 . An inversion operation takes much longer time than other basic field operations, therefore the group operation algorithm must be carefully selected to reduce the number of inversion operations.…”

Section: Implementation Of Secure Scalar Multiplication In Eccmentioning

confidence: 99%

Protecting Elliptic Curve Cryptography Against Memory Disclosure Attacks

Yang

Guan

Liu

et al. 2015

Information and Communications Security

View full text Add to dashboard Cite

Abstract. In recent years, memory disclosure attacks, such as cold boot attack and DMA attack, have posed huge threats to cryptographic applications in real world. In this paper, we present a CPU-bounded memory disclosure attacks resistant yet efficient software implementation of elliptic curves cryptography on general purpose processors. Our implementation performs scalar multiplication using CPU registers only in kernel level atomatically to prevent the secret key and intermediate data from leaking into memory. Debug registers are used to hold the private key, and kernel is patched to restrict access to debug registers. We take full advantage of the AVX and CLMUL instruction sets to speed up the implementation. When evaluating the proposed implementation on an Intel i7-2600 processor (at a frequency of 3.4GHz), a full scalar multiplication over binary fields for key length of 163 bits only requires 129 µs, which outperforms the unprotected implementation in the well known OpenSSL library by a factor of 78.0%. Furthermore, our work is also flexible for typical Linux applications. To the best of our knowledge, this is the first practical ECC implementation which is resistant against memory disclosure attacks so far.

show abstract

“…If the sensor nodes are required to verify the signature quickly, the term vP + uQ should be computed efficiently. Inspired by shamir's trick [13], we perform simultaneous elliptic scalar multiplication using wMOF. The details of our algorithm can be found in the Appendix.…”

Section: Implementation Detailsmentioning

confidence: 99%

“…The experimental results testify to the viability of our protocol for WSNs. Furthermore, the proposed protocol outperforms existing ECC-based protocols over GF (2 p ) for WSNs with the aid of efficient algorithms such as width-w Mutual-Opposite-Form (wMOF) [14] and shamir's trick [13].…”

Section: Introductionmentioning

confidence: 99%

A New Security Protocol Based on Elliptic Curve Cryptosystems for Securing Wireless Sensor Networks

Seo

Kim

Ramakrishna

2006

Emerging Directions in Embedded and Ubiquitous Computing

View full text Add to dashboard Cite

Abstract. In this paper, we describe the design and implementation of a new security protocol based on Elliptic Curve Cryptosystems (ECC) for securing Wireless Sensor Networks (WSNs). Some public-key-based protocols such as TinyPK and EccM 2.0 have already been proposed in response. However, they exhibit poor performance. Moreover, they are vulnerable to man-in-the-middle attacks. We propose a cluster-based Elliptic Curve Diffie-Hellman (ECDH) and Elliptic Curve Digital Signature Algorithm (ECDSA) for efficiency and security during the pairwise key setup and broadcast authentication phases, respectively. We have implemented our protocol on 8-bit, 7.3828-MHz MICAz mote. The experimental results indicate the feasibility of our protocol for WSNs.

show abstract

Software Implementation of Elliptic Curve Cryptography over Binary Fields

Abstract: This paper presents an extensive and careful study of the software implementation on workstations of the NIST-recommended elliptic curves over binary fields. We also present the results of our implementation in C on a Pentium II 400 MHz workstation.

Cited by 270 publications

References 29 publications

Minimality of the Hamming Weight of the τ-NAF for Koblitz Curves and Improved Combination with Point Halving

Minimality of the Hamming Weight of the τ-NAF for Koblitz Curves and Improved Combination with Point Halving

Protecting Elliptic Curve Cryptography Against Memory Disclosure Attacks

A New Security Protocol Based on Elliptic Curve Cryptosystems for Securing Wireless Sensor Networks

Contact Info

Product

Resources

About