Trading Inversions for Multiplications in Elliptic Curve Cryptography

Abstract

Recently, Eisenträger et al. proposed a very elegant method for speeding up scalar multiplication on elliptic curves. Their method relies on improved formulas for evaluating S = (2P + Q) from given points P and Q on an elliptic curve. Compared to the naive approach, the improved formulas save a field multiplication each time the operation is performed. This paper proposes a variant which is faster whenever a field inversion is more expensive than six field multiplications. We also give an improvement when tripling a point, and present a ternary/binary method to perform efficient scalar multiplication.

The double-base number system and its application to elliptic curve cryptography

“…In this section, we illustrate the efficiency of the proposed variants of the generic algorithm by providing experimental results and comparisons with classical methods (double-and-add, NAF, w-NAF) and some recently proposed algorithms: a ternary/binary approach from [12] for curves defined over binary fields using affine coordinates; and two algorithms from Izu et al published in [29] and [31] for curves defined over prime fields. In the latter, we consider the protected version of our algorithm, combined with Joye and Tymen's randomization technique to counteract differential attacks [32].…”

“…For the quadrupling operations, the trick used in [21] Table 6 below, we summarize the costs and break-even points between our new formulae and the algorithms proposed in [12]. With such small break-even points, however, it remains unclear which formulae will give the best overall performance in practical situations.…”

The Tate Pairing Via Elliptic Nets

“…Miller's algorithm in affine coordinates requires one or two F q inversion per step. In situations where inversions are costly (depending on implementation, they may cost anywhere from approximately 4 to 80 multiplications [28]), one may implement Miller's algorithm in homogeneous coordinates.…”

Efficient Explicit Formulae for Genus 2 Hyperelliptic Curves over Prime Fields and Their Implementations

“…The above trick of efficiently computing 2D 1 + D 2 has found important applications in some scalar multiplication algorithms such as NAF, JSF and so on [7]. In this subsection, we only compare the average cost per bit scalar when implementing NAF scalar multiplication algorithm with the naive method and our newly derived formulae, respectively, because the NAF scalar multiplication algorithm will be used in our implementation in the next section.…”

“…In this subsection, we only compare the average cost per bit scalar when implementing NAF scalar multiplication algorithm with the naive method and our newly derived formulae, respectively, because the NAF scalar multiplication algorithm will be used in our implementation in the next section. The results of comparisons are listed in the following Table 3 (The pre-and post-computations are neglected as in [7]). (Table 2) 1I + 56M + 7S 1I + 100 3 M + 17 3 S 1I + 37.87M…”