Arithmetic Operators for Pairing-Based Cryptography Jean-Luc Beuchat - - PowerPoint PPT Presentation

▶

arithmetic operators for pairing based cryptography

Arithmetic Operators for Pairing-Based Cryptography Jean-Luc Beuchat - - PowerPoint PPT Presentation

Mar 17, 2024 307 likes •914 views

Arithmetic Operators for Pairing-Based Cryptography Jean-Luc Beuchat Laboratory of Cryptography and Information Security Graduate School of Systems and Information Engineering University of Tsukuba 1-1-1 Tennodai, Tsukuba Ibaraki, 305-8573,

slide-1

SLIDE 1

Arithmetic Operators for Pairing-Based Cryptography

Jean-Luc Beuchat

Laboratory of Cryptography and Information Security Graduate School of Systems and Information Engineering University of Tsukuba 1-1-1 Tennodai, Tsukuba Ibaraki, 305-8573, Japan mailto:beuchat@risk.tsukuba.ac.jp Joint work with Nicolas Brisebarre (Universit´ e J. Monnet, Saint-´ Etienne, France), J´ er´ emie Detrey (ENS Lyon, France), Eiji Okamoto (University of Tsukuba, Japan), Masaaki Shirase (Future University, Hakodate, Japan), and Tsuyoshi Takagi (Future University, Hakodate, Japan)

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 1 / 38

slide-2

SLIDE 2

Outline of the Talk

1

Example: Three-Party Key Agreement

2

Computation of the ηT Pairing

3

A Coprocessor for the ηT Pairing Computation

4

A Coprocessor for the Final Exponentiation

5

A Coprocessor for the Full Pairing Computation

6

Conclusion

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 2 / 38

slide-3

SLIDE 3

Example: Three-Party Key Agreement

Key agreement

How can Alice, Bob, and Chris agree upon a shared secret key?

Bob Chris Alice

?

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 3 / 38

slide-4

SLIDE 4

Example: Three-Party Key Agreement

Discrete logarithm problem (DLP)

G = P: additively-written group of order n DLP: given P, Q, find the integer x ∈ {0, . . . , n − 1} such that Q = xP

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 4 / 38

slide-5

SLIDE 5

Example: Three-Party Key Agreement

Discrete logarithm problem (DLP)

G = P: additively-written group of order n DLP: given P, Q, find the integer x ∈ {0, . . . , n − 1} such that Q = xP

Diffie-Hellman problem (DHP)

Given P, aP, and bP, find abP.

Alice Bob

a b aP bP

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 4 / 38

slide-6

SLIDE 6

Example: Three-Party Key Agreement

Discrete logarithm problem (DLP)

G = P: additively-written group of order n DLP: given P, Q, find the integer x ∈ {0, . . . , n − 1} such that Q = xP

Diffie-Hellman problem (DHP)

Given P, aP, and bP, find abP.

Alice Bob

a b aP bP bP aP

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 4 / 38

slide-7

SLIDE 7

Example: Three-Party Key Agreement

Discrete logarithm problem (DLP)

G = P: additively-written group of order n DLP: given P, Q, find the integer x ∈ {0, . . . , n − 1} such that Q = xP

Diffie-Hellman problem (DHP)

Given P, aP, and bP, find abP.

Alice Bob

a b abP abP

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 4 / 38

slide-8

SLIDE 8

Example: Three-Party Key Agreement

Alice Chris Bob

aP bP cP a b c

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 5 / 38

slide-9

SLIDE 9

Example: Three-Party Key Agreement

First round

Alice Chris Bob

aP aP bP bP cP cP a b c

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 5 / 38

slide-10

SLIDE 10

Example: Three-Party Key Agreement

a

Alice Chris Bob

abP acP bcP b c

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 5 / 38

slide-11

SLIDE 11

Example: Three-Party Key Agreement

Second round

Alice Chris Bob

abP acP bcP acP abP bcP b c a

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 5 / 38

slide-12

SLIDE 12

Example: Three-Party Key Agreement

c abcP

Alice Bob Chris

abcP abcP a b

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 5 / 38

slide-13

SLIDE 13

Example: Three-Party Key Agreement

Three-party two-round key agreement protocol

Does a three-party one-round key agreement protocol exist?

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 6 / 38

slide-14

SLIDE 14

Example: Three-Party Key Agreement

Bilinear pairing

G1 = P: additively-written group G2: multiplicatively-written group with identity 1 A bilinear pairing on (G1, G2) is a map ˆ e : G1 × G1 → G2 that satisfies the following conditions:

1

Bilinearity. For all Q, R, S ∈ G1,

ˆ e(Q + R, S) = ˆ e(Q, S)ˆ e(R, S) and ˆ e(Q, R + S) = ˆ e(Q, R)ˆ e(Q, S).

2

Non-degeneracy. ˆ e(P, P) = 1.

3

Computability. ˆ

e can be efficiently computed.

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 7 / 38

slide-15

SLIDE 15

Example: Three-Party Key Agreement

Bilinear Diffie-Hellman problem (BDHP)

Given P, aP, bP, and cP, compute ˆ e(P, P)abc Assumption: the BDHP is difficult

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 8 / 38

slide-16

SLIDE 16

Example: Three-Party Key Agreement

Alice Chris Bob

aP bP cP a b c

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 9 / 38

slide-17

SLIDE 17

Example: Three-Party Key Agreement

Bob

aP bP cP bP aP cP aP cP bP a b c

Alice Chris

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 9 / 38

slide-18

SLIDE 18

Example: Three-Party Key Agreement

ˆ e(aP, bP)c a c b ˆ e(bP, cP)a ˆ e(aP, cP)b ˆ e(bP, cP)a = ˆ e(aP, cP)b = ˆ e(aP, bP)c = ˆ e(P, P)abc

Alice Chris Bob

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 9 / 38

slide-19

SLIDE 19

Example: Three-Party Key Agreement

Examples of cryptographic bilinear maps

Weil pairing Tate pairing ηT pairing (Barreto et al.) Ate pairing (Hess et al.)

Applications

Identity based encryption Short signature

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 10 / 38

slide-20

SLIDE 20

Computation of the ηT Pairing

Q Elliptic curve over F3m P = (xp, yp) Q = (xq, yq) (F36m) P Exponentiation ηT pairing calculation ηT(P, Q) ηT(P, Q)W ∈ F36m

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 11 / 38

slide-21

SLIDE 21

Computation of the ηT Pairing – Tower Field

F32m = F3m[σ]/(σ2 + 1)

1 x x2 xm−1 xm−2 xm−3

F36m = F32m[ρ]/(ρ3 − ρ − 1)

1 σ ρ2 1

F3 = Z/3Z = {0, 1, 2} F3m = F3[x]/(f (x))

ρ

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 12 / 38

slide-22

SLIDE 22

Computation of the ηT Pairing – Tower Field

xm−3 xm−2 xm−1 x2 x 1

F3m

ρ σρ 1 σ σρ2 ρ2

F32m F32m F32m 2 bits 2m bits 12m bits F3 F36m

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 13 / 38

slide-23

SLIDE 23

Computation of the ηT Pairing

ηT(P, Q)

Addition Multiplication Cubing Cube root

ηT(P, Q)3

m+1 2

(Arith 18)

Addition Multiplication Cubing

Bilinearity of ηT(P, Q)W

ηT (P, Q)W =

3m

ηT
3

m−1 2

P, Q

3

m+1 2 W Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 14 / 38

slide-24

SLIDE 24

Computation of the ηT Pairing

Multiplication over F36m – ηT(P, Q)

m+1 2

multiplications Operands: A and B ∈ F36m with

σ ρ σρ ρ2 σρ2 B = r0, yp, and yq ∈ F3m 1 −r 2 ypyq −r0 −1

Cost: 13 multiplications and 46 additions over F3m

Multiplication over F36m – Exponentiation

Only one multiplication Operands: A and B ∈ F36m Cost: 18 multiplications and 58 additions over F3m

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 15 / 38

slide-25

SLIDE 25

A Coprocessor for the ηT Pairing Computation

Exponentiation (Waifi 2007) ηT(P, Q) ηT(P, Q)W P = (xp, yp) Q = (xq, yq) ηT pairing calculation (Arith 18)

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 16 / 38

slide-26

SLIDE 26

A Coprocessor for the ηT Pairing Computation

Exponentiation (Waifi 2007) ηT(P, Q) ηT(P, Q)W P = (xp, yp) Q = (xq, yq) ηT pairing calculation (Arith 18)

Computation of ηT(P, Q): multiplication over F36m

New algorithm

◮ 15 multiplications and 29 additions over F3m ◮ Allows one to share operands between multipliers (less registers)

Architecture

◮ 9 multipliers ◮ Most significant coefficient first (Horner’s rule) Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 16 / 38

slide-27

SLIDE 27

A Coprocessor for the ηT Pairing Computation

Prototype

Field: F397 = F3[x]/(x97 + x12 + 2) FPGA: Cyclone II EP2C35 (Altera)

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 17 / 38

slide-28

SLIDE 28

A Coprocessor for the ηT Pairing Computation

Prototype

Field: F397 = F3[x]/(x97 + x12 + 2) FPGA: Cyclone II EP2C35 (Altera)

ηT(P, Q) (Arith 18)

Arithmetic over F397

◮ 9 multipliers ◮ 2 adders ◮ 1 cubing unit

Area: 14895 LEs Frequency: 149 MHz Computation time: 33 µs

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 17 / 38

slide-29

SLIDE 29

A Coprocessor for the ηT Pairing Computation

Prototype

Field: F397 = F3[x]/(x97 + x12 + 2) FPGA: Cyclone II EP2C35 (Altera)

ηT(P, Q) (Arith 18)

Arithmetic over F397

◮ 9 multipliers ◮ 2 adders ◮ 1 cubing unit

Area: 14895 LEs Frequency: 149 MHz Computation time: 33 µs

Exponentiation (Waifi 2007)

Challenge Raise ηT(P, Q) to the W power in 33 µs (or less) with the smallest amount of hardware

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 17 / 38

slide-30

SLIDE 30

A Coprocessor for the ηT Pairing Computation

Why FPGAs?

Prototyping

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 18 / 38

slide-31

SLIDE 31

A Coprocessor for the ηT Pairing Computation

Why FPGAs?

Prototyping Short time to market

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 18 / 38

slide-32

SLIDE 32

A Coprocessor for the ηT Pairing Computation

Why FPGAs?

Prototyping Short time to market Small series

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 18 / 38

slide-33

SLIDE 33

A Coprocessor for the ηT Pairing Computation

Why FPGAs?

Prototyping Short time to market Small series Hardware accelerators for some applications (e.g. cryptography)

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 18 / 38

slide-34

SLIDE 34

A Coprocessor for the Final Exponentiation

Final exponentiation: operations over F3m

Additions 477 Multiplications 78 Cubings 3m + 3 Inversion 1

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 19 / 38

slide-35

SLIDE 35

A Coprocessor for the Final Exponentiation

Addition over F3m

. . .

a0 a1 b1 s1 = (a1 + b1) mod 3 addition Modulo 3 Modulo 3 addition b0 s0 = (a0 + b0) mod 3 sm−1 = (am−1 + bm−1) mod 3 bm−1 Modulo 3 addition am−1

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 20 / 38

slide-36

SLIDE 36

A Coprocessor for the Final Exponentiation

Addition, subtraction, and accumulation over F3m

+/− +/− a(x) b(x) c2 c3 c0 c1 Enable Enable c4 1 Add/Accumulate s(x) Addition of 3 operands Multiplication by 1 or 2 2b(x) ≡ −b(x) (mod 3) c5 Enable

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 21 / 38

slide-37

SLIDE 37

A Coprocessor for the Final Exponentiation

Multiplication over F3m

Array multiplier (⌈m/3⌉ clock cycles) Most significant coefficient first (Horner’s rule)

Multiplication by 0, 1, or 2 a3i ×x2 a3i+2 Shift register c0 c4 c3 a(x) Enable and reset Enable c2 c1 a3i+1 mod f mod f Load and mod f PPG ×x3 shift ×x PPG PPG p(x) Addition of 4 operands b(x)

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 22 / 38

slide-38

SLIDE 38

A Coprocessor for the Final Exponentiation

Cubing over F3[x]/(x97 + x12 + 2)

a60 a0 a61 a96 a95 a94 a2 a1 a0 a60 ν2(x) ν0(x) a(x)3 Addition of 3 operands ν1(x) a89 a64 a61 a32 a65 a93

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 23 / 38

slide-39

SLIDE 39

A Coprocessor for the Final Exponentiation

Arithmetic operators over F397 on a Cyclone II FPGA

Operation Area Control [LEs] [bits] Add./sub. 970 6 Mult. 1375 5 Cubing 668 4 ALU 3308 17

Addition Multiplication Cubing 5 2 a(x) b(x) Ctrl p(x) 6 4

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 24 / 38

slide-40

SLIDE 40

A Coprocessor for the Final Exponentiation

Unified arithmetic operator

Operations

◮ Addition ◮ Subtraction ◮ Accumulation ◮ Multiplication ◮ Cubing

Area (Cyclone II): 2676 LEs (instead of 3308) Control bits: 11 (instead of 17) Inversion: Fermat’s little theorem (96 cubings and 9 multiplications) a3m−2 = a−1, where a ∈ F3m

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 25 / 38

slide-41

SLIDE 41

A Coprocessor for the Final Exponentiation

Unified arithmetic operator

mod f(x) mod f(x)

p(x) ×x3 ×x2 ν2(x) ν1(x) ν0(x) ×x PPG PPG PPG d03i d03i+1 d03i+2 d2(x) d1(x) d0(x) Shift Load Enable Load

register Shift

R2 R1 R0 1 1 1 c0 c1 c7 c8 c4 c5 c9 c10 c6 c2 c3 1 1 1 1

mod f(x)

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 26 / 38

slide-42

SLIDE 42

A Coprocessor for the Final Exponentiation

Prototype

Field: F397 = F3[x]/(x97 + x12 + 2) FPGA: Cyclone II EP2C35 (Altera)

ηT(P, Q) (Arith 18)

Arithmetic over F397

◮ 9 multipliers ◮ 2 adders ◮ 1 cubing unit

Area: 14895 LEs Frequency: 149 MHz Computation time: 33 µs

Exponentiation (Waifi 2007)

Unified operator Area: 2787 LEs Frequency: 159 MHz Computation time: 26 µs

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 27 / 38

slide-43

SLIDE 43

A Coprocessor for the Full Pairing Computation

Operations over F3m

Single unified operator for computing ηT(P, Q)W Additions 51 · m − 1 2 + 503 Multiplications 15 · m − 1 2 + 86 Cubings 10m + 2 Inversion 1

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 28 / 38

slide-44

SLIDE 44

A Coprocessor for the Full Pairing Computation

Results (CHES 2007)

FPGA: Xilinx Virtex-II Pro 4 F3[x]/(x97 + x12 + 2) Area: 1888 slices + 6 memory blocks Clock frequency: 147 MHz Clock cycles for a full pairing: 32618 Calculation time: 222µs

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 29 / 38

slide-45

SLIDE 45

A Coprocessor for the Full Pairing Computation

Results (CHES 2007)

FPGA: Xilinx Virtex-II Pro 4 F3[x]/(x97 + x12 + 2) Area: 1888 slices + 6 memory blocks Clock frequency: 147 MHz Clock cycles for a full pairing: 32618 Calculation time: 222µs

Extended Euclidean algorithm (EEA)

Area: 2210 additional slices Clock cycles for a full pairing: 32419 instead of 32618

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 29 / 38

slide-46

SLIDE 46

Conclusion

Comparisons

Architecture Area Calculation FPGA time Arith 18 & Waifi 2007 18000 LEs 33 µs Cyclone II CHES 2007 1888 slices 222 µs Virtex-II Pro Grabher and Page (CHES 2005) 4481 slices 432 µs Virtex-II Pro Kerins et al. (CHES 2005) 55616 slices 850 µs Virtex-II Pro Ronan et al. (ITNG 2007) 10000 slices 178 µs Virtex-II Pro

(1 slice ≈ 2 LEs)

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 30 / 38

slide-47

SLIDE 47

Conclusion

VHDL code generator

Generation of an unified operator according to Fpm and f (x) Support for the following operations:

◮ Addition ◮ Multiplication ◮ Frobenius (a(x)p mod f (x)) ◮ Inverse Frobenius ( p

a(x) mod f (x))

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 31 / 38

slide-48

SLIDE 48

Conclusion

VHDL code generator

Generation of an unified operator according to Fpm and f (x) Support for the following operations:

◮ Addition ◮ Multiplication ◮ Frobenius (a(x)p mod f (x)) ◮ Inverse Frobenius ( p

a(x) mod f (x))

Future work

Automatic generation of the control unit Application (e.g. short signature) Genus 2 Side-channel

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 31 / 38

slide-49

SLIDE 49

Appendix

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 32 / 38

slide-50

SLIDE 50

Multiplication over F36m – ηT(P, Q)

A · (−r2

0 + ypyqσ − r0ρ − ρ2) = c0 + c1σ + c2ρ + c3σρ + c4ρ2 + c5σρ2

c0 c1σ c2ρ c3σρ c4ρ2 c5σρ2 −a4r0 −a5r0 −a0r0 −a1r0 −a2r0 −a3r0 −a2 −a3 −a4 −a5 −a0 −a1 −a2 −a3 −a4 −a5 −a4r0 −a5r0 −a0r 2 a0ypyq −a2r 2 a2ypyq −a4r 2 a4ypyq −a1ypyq −a1r 2 −a3ypyq −a3r 2 −a5ypyq −a5r 2

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 33 / 38

slide-51

SLIDE 51

Multiplication over F36m – ηT(P, Q)

A · (−r2

0 + ypyqσ − r0ρ − ρ2) = c0 + c1σ + c2ρ + c3σρ + c4ρ2 + c5σρ2

c0 c1σ c2ρ c3σρ c4ρ2 c5σρ2 −a4r0 −a5r0 −a0r0 −a1r0 −a2r0 −a3r0 −a2 −a3 −a4 −a5 −a0 −a1 −a2 −a3 −a4 −a5 −a4r0 −a5r0 −a0r 2 a0ypyq −a2r 2 a2ypyq −a4r 2 a4ypyq −a1ypyq −a1r 2 −a3ypyq −a3r 2 −a5ypyq −a5r 2

1 Compute in parallel r2

0 , ypyq, a0r0, a1r0, a2r0, a3r0, a4r0, and a5r0 (8

multiplications)

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 33 / 38

slide-52

SLIDE 52

Multiplication over F36m – ηT(P, Q)

A · (−r2

0 + ypyqσ − r0ρ − ρ2) = c0 + c1σ + c2ρ + c3σρ + c4ρ2 + c5σρ2

c0 c1σ c2ρ c3σρ c4ρ2 c5σρ2 −a4r0 −a5r0 −a0r0 −a1r0 −a2r0 −a3r0 −a2 −a3 −a4 −a5 −a0 −a1 −a2 −a3 −a4 −a5 −a4r0 −a5r0 −a0r 2 a0ypyq −a2r 2 a2ypyq −a4r 2 a4ypyq −a1ypyq −a1r 2 −a3ypyq −a3r 2 −a5ypyq −a5r 2

1 Compute in parallel r2

0 , ypyq, a0r0, a1r0, a2r0, a3r0, a4r0, and a5r0 (8

multiplications)

2 Apply Karatsuba’s algorithm to compute the remaining products by

means of 9 multipliers

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 33 / 38

slide-53

SLIDE 53

Multiplication over F36m – ηT(P, Q)

A · (−r2

0 + ypyqσ − r0ρ − ρ2) = c0 + c1σ + c2ρ + c3σρ + c4ρ2 + c5σρ2

−a0r2 a0ypyq −a2r2 a2ypyq −a4r2 a4ypyq −a1ypyq −a1r2 −a3ypyq −a3r2 −a5ypyq −a5r2 Karatsuba’s algorithm (9 multiplications performed in parallel): a0ypyq − a1r2

0 = (a0 + a1)×(ypyq − r2 0 ) + a0×r2 0 − a1×ypyq

a2ypyq − a3r2

0 = (a2 + a3)×(ypyq − r2 0 ) + a2×r2 0 − a3×ypyq

a4ypyq − a5r2

0 = (a4 + a5)×(ypyq − r2 0 ) + a4×r2 0 − a5×ypyq

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 34 / 38

slide-54

SLIDE 54

Multiplication over F36m – ηT(P, Q)

M0 M1 M2 a0r0 a2r0 a4r0 a0r2 a2r2 a4r2 Three multipliers Common operand: r0 or r2

Synchronous reset D0 c2 c10 c1 00 c0 01 c4 10 c3 11 D1 Load Load Load Load c8 Shift c6 c7 c5 Clear Load Load Clear Select P c9

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 35 / 38

slide-55

SLIDE 55

Multiplication over F36m – ηT(P, Q)

M3 M4 M5 a1r0 a3r0 a5r0 a1ypyq a3ypyq a5ypyq Three multipliers Common operand: r0 or ypyq

Synchronous reset D0 c2 c10 c1 00 c0 01 c4 10 c3 11 D1 Load Load Load Load c8 Shift c6 c7 c5 Clear Load Load Clear Select P c9

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 35 / 38

slide-56

SLIDE 56

Multiplication over F36m – ηT(P, Q)

M6 M7 M8 r 2 ypyq – (a0 + a1)× (a2 + a3)× (a4 + a5)× (ypyq − r 2

0 )

(ypyq − r 2

0 )

(ypyq − r 2

0 )

1 1 c5 Load c7 Load c6 01 c9 Shift c12 c11 Select c10 Load Load Clear c3 c4 c2 c1 00 Select c0 11 Load Clear 10 Synchronous reset P D0 D1 Load Load c8

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 36 / 38

slide-57

SLIDE 57

A Coprocessor for the ηT Pairing Computation

1 Mux0 d1 Ctrl Ctrl 1 D0 Ctrl D1

pe_mult_block_t1_generic

Ctrl D1 Q D0 Q

pe_mult_block_t1_generic pe_mult_block_t2_generic

D0 Ctrl D1 Q D0 D2 D1

pe_add

S Mux1 1 D C

pe_cubing

Mux2 Ctrl RAM Qa Qb d0 Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 37 / 38

slide-58

SLIDE 58

A Coprocessor for the Full Pairing Computation

Finite State d0(x) Start Control d2(x) Counter Address Address Port A Port B Processing element Done ROM Machine RAM Port B Port A 1 1 Data Addr Wen Wen Addr Data Unified

perator

c31 c30 c29 c28 c27 c26 c25 c24 c23 c22 c21 c20 c19 c18 c17 c15 c14 c16 c13 c12 c11 c10 c9 c8 c6 c7 c3 c4 c5 c2 c0 c1

Wen 10 bits 32 bits 7 bits 198 bits 7 bits 194 bits 194 bits 11 bits 194 bits 198 bits P, Q Select Addr Wen ηT(P, Q)W Addr Q QA QB p(x) d1(x)

Jean-Luc Beuchat (LCIS) ηT Pairing in Characteristic Three 38 / 38