[PPT] - ECC optimization on Sandy Bridge The cost of cofactor h = 1 Daan PowerPoint Presentation

SLIDE 1

ECC optimization on Sandy Bridge

The cost of cofactor h = 1 Daan Sprenkels hello@dsprenkels.com

Radboud University Nijmegen

1 April 2019

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 1 / 30

SLIDE 2

Outline

Introduction Preliminaries Cofactor security ECC implementation Results

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 2 / 30

SLIDE 3

Outline

Introduction Preliminaries Cofactor security ECC implementation Results

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 2 / 30

SLIDE 4

Elliptic curves

E : y2 = x3 + ax + b

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 3 / 30

SLIDE 5

Elliptic curves

E : y2 = x3 + ax + b

−4 −2 2 4 x −4 −2 2 4 y

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 3 / 30

SLIDE 6

Elliptic curves: addition

E : y2 = x3 + ax + b

−4 −2 2 4 x −4 −2 2 4 y P Q −R R

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 3 / 30

SLIDE 7

Elliptic curves: doubling

E : y2 = x3 + ax + b

−4 −2 2 4 x −4 −2 2 4 y P −R R

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 3 / 30

SLIDE 8

Elliptic curves

◮ Coordinates include the point at infinity O

◮ Define P + O = P

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 4 / 30

SLIDE 9

Elliptic curves

◮ Coordinates include the point at infinity O

◮ Define P + O = P

◮ Curve equation: E : y2 = x3 + ax + b

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 4 / 30

SLIDE 10

Elliptic curves

◮ Coordinates include the point at infinity O

◮ Define P + O = P

◮ Curve equation: E : y2 = x3 + ax + b ◮ Coordinates are defined over a field Fq

◮ I.e. integers modulo q

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 4 / 30

SLIDE 11

Elliptic curves: actually

E : y2 = x3 − 3x + 1 defined over F11

1 2 3 4 5 6 7 8 9 10 11 x −5 −4 −3 −2 −1 1 2 3 4 5 y

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 5 / 30

SLIDE 12

Elliptic curves: actual addition

E : y2 = x3 − 3x + 1 defined over F11

1 2 3 4 5 6 7 8 9 10 11 x −5 −4 −3 −2 −1 1 2 3 4 5 y P Q −R R

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 5 / 30

SLIDE 13

Group arithmetic

◮ We can do arithmetic with these rules! :) ◮ Addition: P + Q ◮ Subtraction: P − Q ◮ Neutral element: O, i.e. “zero”

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 6 / 30

SLIDE 14

Group arithmetic

◮ We can do arithmetic with these rules! :) ◮ Addition: P + Q ◮ Subtraction: P − Q ◮ Neutral element: O, i.e. “zero” ◮ Scalar multiplication: [k]P = P + P + ... + P

k times

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 6 / 30

SLIDE 15

Group arithmetic

◮ We can do arithmetic with these rules! :) ◮ Addition: P + Q ◮ Subtraction: P − Q ◮ Neutral element: O, i.e. “zero” ◮ Scalar multiplication: [k]P = P + P + ... + P

k times

◮ Discrete log problem: given P, Q where [k]P = Q, hard to find k

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 6 / 30

SLIDE 16

Elliptic curves are cyclic

◮ Points form a cycle: O +P − − → P

+P

− − → [2]P

+P

− − → [3]P

+P

− − → ... +P − − → [n − 1]P

+P

− − → O

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 7 / 30

SLIDE 17

Elliptic curves are cyclic

◮ Points form a cycle: O +P − − → P

+P

− − → [2]P

+P

− − → [3]P

+P

− − → ... +P − − → [n − 1]P

+P

− − → O

n steps

◮ The order n should contain a large prime factor ◮ Only one cycle if n is prime

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 7 / 30

SLIDE 18

Cofactors

◮ If n is not a prime Then n = h · ℓ ◮ I.e. small loops are possible: E.g. if 4|n, then there is a point T4: O

+T4

− − → T4

+T4

− − → [2]T4

+T4

− − → [3]T4

+T4

− − → O

nly 4 steps!

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 8 / 30

SLIDE 19

Cofactors

◮ If n is not a prime Then n = h · ℓ ◮ I.e. small loops are possible: E.g. if 4|n, then there is a point T4: O

+T4

− − → T4

+T4

− − → [2]T4

+T4

− − → [3]T4

+T4

− − → O

nly 4 steps!

◮ h is called the cofactor

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 8 / 30

SLIDE 20

Cofactors

◮ If n is not a prime Then n = h · ℓ ◮ I.e. small loops are possible: E.g. if 4|n, then there is a point T4: O

+T4

− − → T4

+T4

− − → [2]T4

+T4

− − → [3]T4

+T4

− − → O

nly 4 steps!

◮ h is called the cofactor ◮ This property is often harmless

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 8 / 30

SLIDE 21

Cofactors

◮ If n is not a prime Then n = h · ℓ ◮ I.e. small loops are possible: E.g. if 4|n, then there is a point T4: O

+T4

− − → T4

+T4

− − → [2]T4

+T4

− − → [3]T4

+T4

− − → O

nly 4 steps!

◮ h is called the cofactor ◮ This property is often harmless

◮ I.e. sometimes it’s the opposite of harmless

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 8 / 30

SLIDE 22

A brief history...

◮ 1999: elliptic curves popularized

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 9 / 30

SLIDE 23

A brief history...

◮ 1999: elliptic curves popularized ◮ 2006: Curve25519 published by Bernstein

◮ “Safe” for implementors

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 9 / 30

SLIDE 24

A brief history...

◮ 1999: elliptic curves popularized ◮ 2006: Curve25519 published by Bernstein

◮ “Safe” for implementors ◮ Super fast

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 9 / 30

SLIDE 25

A brief history...

◮ 1999: elliptic curves popularized ◮ 2006: Curve25519 published by Bernstein

◮ “Safe” for implementors ◮ Super fast ◮ Has cofactor h = 8

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 9 / 30

SLIDE 26

A brief history...

◮ 1999: elliptic curves popularized ◮ 2006: Curve25519 published by Bernstein

◮ “Safe” for implementors ◮ Super fast ◮ Has cofactor h = 8

◮ 2014: Monero cryptocurrency

◮ Uses Curve25519

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 9 / 30

SLIDE 27

A brief history...

◮ 1999: elliptic curves popularized ◮ 2006: Curve25519 published by Bernstein

◮ “Safe” for implementors ◮ Super fast ◮ Has cofactor h = 8

◮ 2014: Monero cryptocurrency

◮ Uses Curve25519

◮ 2017: vulnerability in Monero found

◮ Allowed anyone to create coins out of thin air

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 9 / 30

SLIDE 28

The Monero vulnerability

◮ Transaction involves a ring signature

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 10 / 30

SLIDE 29

The Monero vulnerability

◮ Transaction involves a ring signature ◮ Double-spending is prevented by a key image I

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 10 / 30

SLIDE 30

The Monero vulnerability

◮ Transaction involves a ring signature ◮ Double-spending is prevented by a key image I

◮ I binds the transaction to signer’s public key P

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 10 / 30

SLIDE 31

The Monero vulnerability

◮ Transaction involves a ring signature ◮ Double-spending is prevented by a key image I

◮ I binds the transaction to signer’s public key P ◮ Binding is in zero-knowledge

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 10 / 30

SLIDE 32

The Monero vulnerability

◮ Transaction involves a ring signature ◮ Double-spending is prevented by a key image I

◮ I binds the transaction to signer’s public key P ◮ Binding is in zero-knowledge ◮ Key image I should be unique

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 10 / 30

SLIDE 33

Monero transactions

◮ Have generators G1, G2; private key x; public key P; key image I.

◮ signx(m) ◮ Sign m with private key x ◮ Choose commitment u ∈R hZℓ ◮ Compute a2 = [u]G2; c = H(m, a1, a2); r = u + cx ◮ Output signature s = (a1, a2, r)

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 11 / 30

SLIDE 34

Monero transactions

◮ Have generators G1, G2; private key x; public key P; key image I.

◮ signx(m) ◮ Sign m with private key x ◮ Choose commitment u ∈R hZℓ ◮ Compute a2 = [u]G2; c = H(m, a1, a2); r = u + cx ◮ Output signature s = (a1, a2, r) ◮ verifyP,I(m, s) ◮ [r]G1

?

= a1 + [c]P ◮ [r]G2

?

= a2 + [c]I ◮ I unique?

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 11 / 30

SLIDE 35

Attacking Monero signatures

◮ Challenge. Find some signature+keypair a2, c, r, and I, s.t. [r]G2 = a2 + [c]I = a2 + [c]I ′, where I = I ′.

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 12 / 30

SLIDE 36

Attacking Monero signatures

◮ Challenge. Find some signature+keypair a2, c, r, and I, s.t. [r]G2 = a2 + [c]I = a2 + [c]I ′, where I = I ′. ◮ Solution. Choose I ′ = I + Tα, where α|c and [α]Tα = O.

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 12 / 30

SLIDE 37

Attacking Monero signatures

◮ Challenge. Find some signature+keypair a2, c, r, and I, s.t. [r]G2 = a2 + [c]I = a2 + [c]I ′, where I = I ′. ◮ Solution. Choose I ′ = I + Tα, where α|c and [α]Tα = O. ◮ Correctness. a2 + [c]I ′ = a2 + [c](I + Tα)

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 12 / 30

SLIDE 38

Attacking Monero signatures

◮ Challenge. Find some signature+keypair a2, c, r, and I, s.t. [r]G2 = a2 + [c]I = a2 + [c]I ′, where I = I ′. ◮ Solution. Choose I ′ = I + Tα, where α|c and [α]Tα = O. ◮ Correctness. a2 + [c]I ′ = a2 + [c](I + Tα) = a2 + [c]I + c α

[α]Tα

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 12 / 30

SLIDE 39

Attacking Monero signatures

◮ Challenge. Find some signature+keypair a2, c, r, and I, s.t. [r]G2 = a2 + [c]I = a2 + [c]I ′, where I = I ′. ◮ Solution. Choose I ′ = I + Tα, where α|c and [α]Tα = O. ◮ Correctness. a2 + [c]I ′ = a2 + [c](I + Tα) = a2 + [c]I + c α

[α]Tα

= a2 + [c]I + c α

O

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 12 / 30

SLIDE 40

Attacking Monero signatures

◮ Challenge. Find some signature+keypair a2, c, r, and I, s.t. [r]G2 = a2 + [c]I = a2 + [c]I ′, where I = I ′. ◮ Solution. Choose I ′ = I + Tα, where α|c and [α]Tα = O. ◮ Correctness. a2 + [c]I ′ = a2 + [c](I + Tα) = a2 + [c]I + c α

[α]Tα

= a2 + [c]I +

✚✚✚ ✚

c α

O

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 12 / 30

SLIDE 41

Attacking Monero signatures

◮ Challenge. Find some signature+keypair a2, c, r, and I, s.t. [r]G2 = a2 + [c]I = a2 + [c]I ′, where I = I ′. ◮ Solution. Choose I ′ = I + Tα, where α|c and [α]Tα = O. ◮ Correctness. a2 + [c]I ′ = a2 + [c](I + Tα) = a2 + [c]I + c α

[α]Tα

= a2 + [c]I +

✚✚✚ ✚

c α

O

= a2 + [c]I

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 12 / 30

SLIDE 42

Surely this could have been prevented?

Easy fix: ◮ Protocol assumed [r]G2 = a2 + [c]I, only for a single I

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 13 / 30

SLIDE 43

Surely this could have been prevented?

Easy fix: ◮ Protocol assumed [r]G2 = a2 + [c]I, only for a single I ◮ Fix: check if the order of I is ℓ

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 13 / 30

SLIDE 44

Surely this could have been prevented?

Easy fix: ◮ Protocol assumed [r]G2 = a2 + [c]I, only for a single I ◮ Fix: check if the order of I is ℓ

◮ i.e. check [ℓ]I

?

= O

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 13 / 30

SLIDE 45

Surely this could have been prevented?

Easy fix: ◮ Protocol assumed [r]G2 = a2 + [c]I, only for a single I ◮ Fix: check if the order of I is ℓ

◮ i.e. check [ℓ]I

?

= O ◮ Fun fact: this check makes the verification 2× slower

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 13 / 30

SLIDE 46

Why didn’t they validate points?

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 14 / 30

SLIDE 47

Why didn’t they validate points?

Look at the docs:

(highlight added by me) Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 14 / 30

SLIDE 48

Surely this could have been prevented?

Easy fix: ◮ Protocol assumed [r]G2 = a2 + [c]I, only for a single I ◮ Fix: check if the order of I is ℓ

◮ i.e. check [ℓ]I

?

= O

◮ Better fix: use a prime order curve

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 15 / 30

SLIDE 49

Outline

Introduction Preliminaries Cofactor security ECC implementation Results

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 16 / 30

SLIDE 50

Goal of this thesis

What is the actual performance benefit of Curve25519

ver traditional (Weierstrass) curves?

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 17 / 30

SLIDE 51

Our contribution

Our research: ◮ Implement variable base-point scalar multiplication

◮ That is the algorithm for computing [k]P, ◮ for a prime-order curve, ◮ that looks similar to Curve25519, ◮ on Sandy Bridge microarchitecture

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 18 / 30

SLIDE 52

Our contribution

Our research: ◮ Implement variable base-point scalar multiplication

◮ That is the algorithm for computing [k]P, ◮ for a prime-order curve, ◮ that looks similar to Curve25519, ◮ on Sandy Bridge microarchitecture

◮ Compare performance with Curve25519 (Sandy2x)

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 18 / 30

SLIDE 53

Selecting a curve

◮ I.e. E : y2 = x3 − 3x + 13318, defined over F2255−19.

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 19 / 30

SLIDE 54

Selecting a curve

◮ I.e. E : y2 = x3 − 3x + 13318, defined over F2255−19. ◮ Prime order curve; same field as Curve25519

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 19 / 30

SLIDE 55

Scalar multiplication overview

field arithmetic

fe add fe sub fe mul fe carry

addition formulas

ge double ge add

scalar multiplication

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 20 / 30

SLIDE 56

Field element representation

◮ Use double-precision floating points

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 21 / 30

SLIDE 57

Field element representation

◮ Use double-precision floating points ◮ Allows 4× vectorized operations using SIMD instructions

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 21 / 30

SLIDE 58

Field element representation

◮ Use double-precision floating points ◮ Allows 4× vectorized operations using SIMD instructions ◮ Radix-221.25 redundant representation

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 21 / 30

SLIDE 59

Field element representation

◮ Use double-precision floating points ◮ Allows 4× vectorized operations using SIMD instructions ◮ Radix-221.25 redundant representation ◮ Use 12 limbs to represent 255-bit numbers

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 21 / 30

SLIDE 60

Field element representation

◮ Use double-precision floating points ◮ Allows 4× vectorized operations using SIMD instructions ◮ Radix-221.25 redundant representation ◮ Use 12 limbs to represent 255-bit numbers

◮ I.e. f = f0 + f1 + ... + f11

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 21 / 30

SLIDE 61

Field arithmetic

◮ Carry

◮ top(fi): force loss of precision ◮ Then, move “high” bits to next limb

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 22 / 30

SLIDE 62

Field arithmetic

◮ Carry

◮ top(fi): force loss of precision ◮ Then, move “high” bits to next limb

◮ Addition

◮ (f + g)i = fi + gi ◮ (f − g)i = fi − gi

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 22 / 30

SLIDE 63

Field arithmetic

◮ Carry

◮ top(fi): force loss of precision ◮ Then, move “high” bits to next limb

◮ Addition

◮ (f + g)i = fi + gi ◮ (f − g)i = fi − gi

◮ Multiplication

◮ (f · g)k =

i+j=k figi + i+j=k+12

2−255 · 19
figi

◮ Optimized using Karatsuba’s multiplication

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 22 / 30

SLIDE 64

Addition formulas

◮ Use Renes-Costello-Batina formulas ◮ Rewrite using graphs into vectorized operations ◮ Implement using field arithmetic functions

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 23 / 30

SLIDE 65

Point doubling

dbl_generic x y z x3 31 y3 27 z3 34 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 28 29 30 32 33

⟦ ⟧ ⟦ ⟧ ⟦ ⟧ ⟦ ⟧ ₉ ⟦ ⟧ ⟦ ⟧ ⟦ ⟧ ₂₀

Legend add subtract triple multiply by small constant multiply square

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 24 / 30

SLIDE 66

Point doubling

dbl_4x (3M + 4c) extra carry operation x y z x3 31 y3 27 z3 32 14 13 12 15 5 2 34 8 ⟦-b/2⟧ 3 17 16 ⟦-3⟧ 18 ⟦2b⟧ 6 24 23 ⟦3⟧ 1 28 26 30 9 = -a₉/2 19 25 22 25 29a 4 11 10 7 ⟦-6⟧ 34 33 29b ⟦8⟧ 11 22 21 ⟦-3⟧ 20 = -a₂₀

Legend add subtract triple multiply by small constant multiply square

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 24 / 30

SLIDE 67

Point addition

add_generic x1 y1 z1 x2 y2 z2 x3 40 y3 38 z3 43 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 39 41 42

⟦ ⟧ ⟦ ⟧ ⟦ ⟧ ⟦ ⟧

Legend add subtract triple multiply by small constant multiply

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 25 / 30

SLIDE 68

Point addition

add_4x (3M and 4c) extra carry after operation x1 y1 z1 x2 y2 z2 x3 40 y3 38 z3 43 1 2 3 16 14 15 19 25 18 6 4 5 11 9 10 36 33 32 27b 26b ⟦3⟧ 31 30 ⟦3⟧ 37 23 24 35 13 39 8 41 42 34 29 22 21 ⟦3⟧ 20 28 27a 26a ⟦3⟧ 7 12 17

Legend add subtract triple multiply by small constant multiply

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 25 / 30

SLIDE 69

Scalar multiplication

◮ Use left-to-right double-and-add

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 26 / 30

SLIDE 70

Scalar multiplication

◮ Use left-to-right double-and-add ◮ Optimization: use signed window method (w = 5)

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 26 / 30

SLIDE 71

Scalar multiplication

◮ Use left-to-right double-and-add ◮ Optimization: use signed window method (w = 5) ◮ Uses 263 · double + 59 · add operations

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 26 / 30

SLIDE 72

Outline

Introduction Preliminaries Cofactor security ECC implementation Results

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 27 / 30

SLIDE 73

Compared to Curve25519

Table: Cycle counts for Sandy2x and this work. Implementation Sandy Bridge Ivy Bridge Haswell Curve25519 (Sandy2x) 159kcc 157kcc – this work 390kcc 383kcc 340kcc

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 28 / 30

SLIDE 74

Compared to Curve25519

Table: Cycle counts for Sandy2x and this work. Implementation Sandy Bridge Ivy Bridge Haswell Curve25519 (Sandy2x) 159kcc 157kcc – this work 390kcc 383kcc 340kcc Conclusion: about 2.5× slower

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 28 / 30

SLIDE 75

Thank you! I

Acknowledgements <3:

◮ Peter, (+the department, Marrit, Judith, Gerdriaan) ◮ The LLVM project (especially for llvm-mca) ◮ Olivier (from SNT; for lending their Sandy Bridge machine)

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 29 / 30

SLIDE 76

Thank you! I

Acknowledgements <3:

◮ Peter, (+the department, Marrit, Judith, Gerdriaan) ◮ The LLVM project (especially for llvm-mca) ◮ Olivier (from SNT; for lending their Sandy Bridge machine)

Stuff I left out:

◮ Ristretto ◮ Politics ◮ Many implementation details

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 29 / 30

SLIDE 77

Thank you! II

The code is at https://github.com/dsprenkels/curve13318 Extra reading: ◮ My thesis: https://dsprenkels.com/files/thesis-20190311.pdf ◮ Monero vulnerability (1): https://nickler.ninja/blog/2017/05/23/exploiting-low-order-

generators-in-one-time-ring-signatures/

◮ Monero vulnerability (2): https://moderncrypto.org/mail-archive/curves/2017/000898.html Find me through: ◮ Email: hello@dsprenkels.com ◮ PGP key: 951D 6F6E C19E 5D87 1A61 A7F4 1445 C075 FFD5 68CD

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 30 / 30

SLIDE 78

References I

Barreto, P.S.L.M.: on Twitter (May 2017), https://twitter.com/pbarreto/status/869103226276134912 Bernstein, D.J.: Curve25519: New Diffie-Hellman speed records. pp. 207–228 (2006), https://cr.yp.to/ecdh/curve25519-20060209.pdf Bernstein, D.J., Duif, N., Lange, T., Schwabe, P., Yang, B.Y.: High-speed high-security signatures. pp. 124–142 (2011), https://ed25519.cr.yp.to/ed25519-20110926.pdf Chou, T.: Sandy2x: New Curve25519 speed records. pp. 145–160 (2016), https://www.win.tue.nl/~tchou/papers/sandy2x.pdf Genkin, D., Valenta, L., Yarom, Y.: May the Fourth Be With You: A microarchitectural side channel attack on several real-world applications of Curve25519. pp. 845–858 (2017), https://eprint.iacr.org/2017/806.pdf Karatsuba, A., Ofman, Y.: Multiplication of many-digital numbers by automatic computers. Dokl. Akad. Nauk SSSR 145(2), 293–294 (1962), http://www.mathnet.ru/php/getFT.phtml?jrnid=dan&paperid=26729&what=fullt&option_lang=eng

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 31 / 30

SLIDE 79

References II

Kaufmann, T., Pelletier, H., Vaudenay, S., Villegas, K.: When constant-time source yields variable-time binary: Exploiting Curve25519-donna built with MSVC 2015. pp. 573–582 (2016), https://infoscience.epfl.ch/record/223794/files/32_1.pdf Koblitz, N.: Elliptic curve cryptosystems. Math. Comp. 48, 209–209 (1987), https: //www.ams.org/journals/mcom/1987-48-177/S0025-5718-1987-0866109-5/S0025-5718-1987-0866109-5.pdf luigi1111, ”fluffypony” Spagni, R.: Disclosure of a major bug in cryptonote based currencies (May 2017), https: //src.getmonero.org/2017/05/17/disclosure-of-a-major-bug-in-cryptonote-based-currencies.html Miller, V.S.: Use of elliptic curves in cryptography. pp. 417–426 (1986), https://www.researchgate.net/profile/Victor_Miller/publication/227128293_Use_of_Elliptic_Curves_ in_Cryptography/links/0c96052e065c94b47c000000/Use-of-Elliptic-Curves-in-Cryptography.pdf Perrin, T.: Subject: [curves] CryptoNote and equivalent points (May 2017), https://moderncrypto.org/mail-archive/curves/2017/000898.html Renes, J., Costello, C., Batina, L.: Complete addition formulas for prime order elliptic curves. pp. 403–428 (2016), http://eprint.iacr.org/2015/1060

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 32 / 30

SLIDE 80

References III

Schnorr, C.P.: Efficient signature generation by smart cards 4(3), 161–174 (Jan 1991), https: //www.researchgate.net/profile/Claus_Schnorr/publication/227088517_Efficient_signature_generation_ by_smart_cards/links/0046353849579ce09c000000/Efficient-signature-generation-by-smart-cards.pdf

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 33 / 30

SLIDE 81

Double-and-add algorithm

function DoubleAndAdd(k, P) ⊲ Compute [k]P R ← O for i from n − 1 down to 0 do R ← [2]R ⊲ Doubling if ki = 1 then R ← R + P ⊲ Addition else R ← R + O ⊲ Addition end if end for return R end function

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 34 / 30

SLIDE 82

Fixed-window double-and-add

function FixedWindow(k, P) ⊲ Compute [k]P k′ ← Windowsw(k) Precompute ([2]P, ... , [2w − 1]P) R ← O for i from n

w − 1 down to 0 do

for j from 0 to w − 1 do R ← [2]R ⊲ w doublings end for if k′

i = 0 then

R ← R + [k′

i ]P

⊲ Addition else R ← R + O ⊲ Addition end if end for return R end function

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 35 / 30

SLIDE 83

Signed double-and-add

function SignedFixedWindow(k, P) ⊲ Compute [k]P k′ ← RecodeSigned(Windowsw(k)) Precompute ([2]P, ... , [2w−1]P) R ← O for i from n

w − 1 down to 0 do

for j from 0 to w − 1 do R ← [2]R ⊲ w doublings end for if k′

i > 0 then

R ← R + [k′

i ]P

⊲ Addition else if k′

i < 0 then

R ← R − [−k′

i ]P

⊲ Addition else R ← R + O ⊲ Addition end if end for return R end function

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 36 / 30

SLIDE 84

Implemented signed double-and-add

function ScalarMultiplication(k, P) ⊲ Compute [k]P T ← (O, P, ... , [16]P) ⊲ Precompute ([2]P, ... , [16]P) k′ ← RecodeSigned(Windows5(k)) R ← O for i from 50 down to 0 do for j from 0 to 4 do R ← [2]R ⊲ 5 doublings end for if k′

i < 0 then

R ← R − T−k′

i

⊲ Addition else R ← R + Tk′

i

⊲ Addition end if end for return R ⊲ R = (XR : YR : ZR) end function

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 37 / 30

SLIDE 85

sign exponent mantissa 63 52

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 38 / 30

SLIDE 86

Depiction of top(f )

253bi+1 253bi bi+1 bi

? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?

fi:

+ 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

+ ci:

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 + 1 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?

z′:

+ 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

− ci:

? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

result:

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 39 / 30

SLIDE 87

Signed windows

k′

3

k′

2

k′

1

k′ 1011 0010 0110 1110 k =

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 40 / 30

SLIDE 88

Signed window recoding

k′′

4

k′′

3

k′′

2

k′′

1

k′′ 1011 0010 0110 1110 1 −101 010 111 −010 k =

Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 41 / 30