Hardware-Software Co-Design for Security: ECC Processor Example - - PowerPoint PPT Presentation

▶
hardware software co design for security ecc processor
SMART_READER_LITE
LIVE PREVIEW

Hardware-Software Co-Design for Security: ECC Processor Example - - PowerPoint PPT Presentation

Oct 16, 2023 24 likes •574 views

Hardware-Software Co-Design for Security: ECC Processor Example Arnaud Tisserand CNRS, Lab-STICC SILM Workshop, Nov. 2019 -- Introduction Public-key (or asymmetric) cryptography (PKC): RSA (hyper-)elliptic curve cryptography ((H)ECC)

slide-1
SLIDE 1

Hardware-Software Co-Design for Security: ECC Processor Example

Arnaud Tisserand

CNRS, Lab-STICC

SILM Workshop, Nov. 2019

slide-2
SLIDE 2

Introduction

Public-key (or asymmetric) cryptography (PKC):

  • RSA
  • (hyper-)elliptic curve cryptography ((H)ECC)
  • post-quantum crypto (PQC)

Design, prototype and evaluate hardware/software (HW/SW) for PKC:

  • HW: computation units, accelerators, crypto-processors
  • SW: libraries, generators for HW, dedicated compiler for our processors

Objectives:

  • high speed, reduced silicon area and energy consumption
  • protections against side-channel and fault-injection attacks (SCA/FIA)
  • HW: FPGA and ASIC implementations
  • SW: embedded processors implementations

Arnaud Tisserand. CNRS – Lab-STICC 2/20

slide-3
SLIDE 3

Elliptic Curve Cryptography (ECC)

Elliptic curve over GF(p): E : y2 = x3 + ax + b Curve points representation:

  • P = (x, y) affine coordinates

many field inversions

  • P = (x, y, z, . . .) redundant coordinates

significantly faster (e.g., Jacobian) Scalar multiplication: Q = [k]P = P + P + · · · + P

  • k times

where P ∈ E and k = (kn−1kn−2 . . . k1k0)2

y 2 = x3 + 4x + 20 over GF(1009) The most time consuming

  • peration in protocols

k has 200–600 bits Good and complete presentation in [14] and [10]

Arnaud Tisserand. CNRS – Lab-STICC 3/20

slide-4
SLIDE 4

Scalar Multiplication

Q = [k]P = P + P + · · · + P

  • k times
  • P ∈ E
  • k = (kn−1kn−2 . . . k1k0)2

Double-and-add scalar multiplication algorithm: 1: Q ← O 2: for i from n − 1 to 0 do 3: Q ← [2]Q (DBL) 4: if ki = 1 then Q ← Q + P (ADD) 5: return Q

  • scans each bit of k and performs corresponding curve-level operation
  • average cost: 0.5n ADD + n DBL (security

≈ 0.5n ones in k)

mul OUT RX sub OUT RY mul OUT RZ PZ mul PZ mul PZ mul PZ PX mul PX PY mul PY QY QY QX QX QZ QZ QZ QZ mul v18 add add v12 sub v13 mul v10 v10 v10 mul v11 v11 sub v11 mul v16 v17 v14 v14 sub v0 v1 v1 v2 v2 sqr v2 sub v3 v4 v4 v5 sqr v5 mul v6 v7 v7 v8 v9 v9 mul OUT RX sub OUT RY add OUT RZ PZ mul PZ mul PZ PX sqr PX mul PX PY PY mul PY a a add add v18 v18 add v19 v19 sub add v12 v12 sub v12 v13 add add v10 v10 v10 v11 mul v16 sqr v17 v17 v15 mul add v23 v23 sqr v22 v20 add v25 v25 v24 v24 add v0 add v1 v1 add v1 v2 v3 v4 sqr v4 v5 v6 v6 v6 v6 v7 v7 add v8 v8 v9 v9

Arnaud Tisserand. CNRS – Lab-STICC 4/20

slide-5
SLIDE 5

Side Channel Attacks

key exchange signature etc

protocol level

[k]P ADD(P, Q) DBL(P)

curve level

x±y x×y . . .

field level

Scalar multiplication operation for i from 0 to t − 1 do if ki = 1 then Q = ADD(P, Q) P = DBL(P)

Arnaud Tisserand. CNRS – Lab-STICC 5/20

slide-6
SLIDE 6

Side Channel Attacks

key exchange signature etc

protocol level

[k]P ADD(P, Q) DBL(P)

curve level

x±y x×y . . .

field level

Scalar multiplication operation for i from 0 to t − 1 do if ki = 1 then Q = ADD(P, Q) P = DBL(P)

Arnaud Tisserand. CNRS – Lab-STICC 5/20

slide-7
SLIDE 7

Side Channel Attacks

key exchange signature etc

protocol level

[k]P ADD(P, Q) DBL(P)

curve level

x±y x×y . . .

field level

DBL DBL DBL DBL DBL DBL

Scalar multiplication operation for i from 0 to t − 1 do if ki = 1 then Q = ADD(P, Q) P = DBL(P)

Arnaud Tisserand. CNRS – Lab-STICC 5/20

slide-8
SLIDE 8

Side Channel Attacks

key exchange signature etc

protocol level

[k]P ADD(P, Q) DBL(P)

curve level

x±y x×y . . .

field level

DBL DBL DBL DBL DBL DBL ADD ADD

Scalar multiplication operation for i from 0 to t − 1 do if ki = 1 then Q = ADD(P, Q) P = DBL(P)

Arnaud Tisserand. CNRS – Lab-STICC 5/20

slide-9
SLIDE 9

Side Channel Attacks

key exchange signature etc

protocol level

[k]P ADD(P, Q) DBL(P)

curve level

x±y x×y . . .

field level

DBL DBL DBL DBL DBL DBL ADD ADD

0 0 0 1 1

Scalar multiplication operation for i from 0 to t − 1 do if ki = 1 then Q = ADD(P, Q) P = DBL(P)

  • simple power analysis (& variants)

Arnaud Tisserand. CNRS – Lab-STICC 5/20

slide-10
SLIDE 10

Side Channel Attacks

key exchange signature etc

protocol level

[k]P ADD(P, Q) DBL(P)

curve level

x±y x×y . . .

field level

DBL DBL DBL DBL DBL DBL ADD ADD

0 0 0 1 1

Scalar multiplication operation for i from 0 to t − 1 do if ki = 1 then Q = ADD(P, Q) P = DBL(P)

  • simple power analysis (& variants)
  • differential power analysis (& variants)
  • horizontal/vertical/templates/. . . attacks

Arnaud Tisserand. CNRS – Lab-STICC 5/20

slide-11
SLIDE 11

Software vs Hardware Support

reg. file FU1 FU2 FU3 LSU memory hierarchy D instructions management + control I @ @

SW HW

CTRL

  • p.

reg.

  • p.

reg.

  • p.

reg.

  • p.

reg.

memory

FLEXIBILITY EXCELLENT limited SPEED slow fast AREA large small ENERGY large small

  • DEVEL. COST

moderate HUGE

slide-12
SLIDE 12

Software vs Hardware Support

reg. file FU1 FU2 FU3 LSU memory hierarchy D instructions management + control I @ @

SW HW

CTRL

  • p.

reg.

  • p.

reg.

  • p.

reg.

  • p.

reg.

memory

FLEXIBILITY EXCELLENT limited SPEED slow fast AREA large small ENERGY large small

  • DEVEL. COST

moderate HUGE

SECURITY?

Arnaud Tisserand. CNRS – Lab-STICC 6/20

slide-13
SLIDE 13

Activity in a Processor

Operation to be executed: r ← x + a[i] time x a[i] r + data/op.

  • AS: ALU status
  • PIS: fetch, decode, pipeline management, bypasses, memory hierarchy, branch

predictor, monitoring, etc.

Arnaud Tisserand. CNRS – Lab-STICC 7/20

slide-14
SLIDE 14

Activity in a Processor

Operation to be executed: r ← x + a[i] time signals x a[i] r + data/op.

  • AS: ALU status
  • PIS: fetch, decode, pipeline management, bypasses, memory hierarchy, branch

predictor, monitoring, etc.

Arnaud Tisserand. CNRS – Lab-STICC 7/20

slide-15
SLIDE 15

Activity in a Processor

Operation to be executed: r ← x + a[i] time signals x a[i] r + data/op. LD R1,R2 ADD R3,R1,R4 instructions

  • AS: ALU status
  • PIS: fetch, decode, pipeline management, bypasses, memory hierarchy, branch

predictor, monitoring, etc.

Arnaud Tisserand. CNRS – Lab-STICC 7/20

slide-16
SLIDE 16

Activity in a Processor

Operation to be executed: r ← x + a[i] time signals x a[i] r + data/op. LD R1,R2 ADD R3,R1,R4 instructions AS

  • AS: ALU status
  • PIS: fetch, decode, pipeline management, bypasses, memory hierarchy, branch

predictor, monitoring, etc.

Arnaud Tisserand. CNRS – Lab-STICC 7/20

slide-17
SLIDE 17

Activity in a Processor

Operation to be executed: r ← x + a[i] time signals x a[i] r + data/op. LD R1,R2 ADD R3,R1,R4 instructions AS processor internal state (PIS) processor internal state (PIS) processor internal state (PIS) state

  • AS: ALU status
  • PIS: fetch, decode, pipeline management, bypasses, memory hierarchy, branch

predictor, monitoring, etc.

Arnaud Tisserand. CNRS – Lab-STICC 7/20

slide-18
SLIDE 18

Our Processor Specifications

key exchange signature etc

protocol level

[k]P ADD(P, Q) DBL(P)

P + P curve level

x±y x×y . . .

field level

Arnaud Tisserand. CNRS – Lab-STICC 8/20

slide-19
SLIDE 19

Our Processor Specifications

key exchange signature etc

protocol level

HW

[k]P ADD(P, Q) DBL(P)

P + P curve level

x±y x×y . . .

field level

  • Performances =

⇒ hardware (HW)

◮ dedicated functional units ◮ internal parallelism

  • Limited cost (embedded systems)

◮ reduced silicon area ◮ low energy (& power consumption) ◮ large area used at each clock cycle

Arnaud Tisserand. CNRS – Lab-STICC 8/20

slide-20
SLIDE 20

Our Processor Specifications

key exchange signature etc

protocol level

HW SW

[k]P ADD(P, Q) DBL(P)

P + P curve level

x±y x×y . . .

field level

  • Performances =

⇒ hardware (HW)

◮ dedicated functional units ◮ internal parallelism

  • Limited cost (embedded systems)

◮ reduced silicon area ◮ low energy (& power consumption) ◮ large area used at each clock cycle

  • Flexibility =

⇒ software (SW)

◮ curves, algorithms, representations (points/elements), k recoding, . . . ◮ at design time / at run time

Arnaud Tisserand. CNRS – Lab-STICC 8/20

slide-21
SLIDE 21

Our Processor Specifications

key exchange signature etc

protocol level

HW SW HW

[k]P ADD(P, Q) DBL(P)

P + P curve level

x±y x×y . . .

field level

  • Performances =

⇒ hardware (HW)

◮ dedicated functional units ◮ internal parallelism

  • Limited cost (embedded systems)

◮ reduced silicon area ◮ low energy (& power consumption) ◮ large area used at each clock cycle

  • Flexibility =

⇒ software (SW)

◮ curves, algorithms, representations (points/elements), k recoding, . . . ◮ at design time / at run time

  • Security against SCAs =

⇒ HW

◮ secure units (F2m, Fp) ◮ secure key storage/management ◮ secure control

Arnaud Tisserand. CNRS – Lab-STICC 8/20

slide-22
SLIDE 22

Processor Architecture

processor

Arnaud Tisserand. CNRS – Lab-STICC 9/20

slide-23
SLIDE 23

Processor Architecture

processor FU1 FU2 FU3

Arnaud Tisserand. CNRS – Lab-STICC 9/20

slide-24
SLIDE 24

Processor Architecture

processor register file FU1 FU2 FU3

Arnaud Tisserand. CNRS – Lab-STICC 9/20

slide-25
SLIDE 25

Processor Architecture

processor key mng. register file FU1 FU2 FU3

Arnaud Tisserand. CNRS – Lab-STICC 9/20

slide-26
SLIDE 26

Processor Architecture

processor CTRL key mng. register file FU1 FU2 FU3

Arnaud Tisserand. CNRS – Lab-STICC 9/20

slide-27
SLIDE 27

Processor Architecture

processor CTRL code mem. key mng. register file FU1 FU2 FU3

Arnaud Tisserand. CNRS – Lab-STICC 9/20

slide-28
SLIDE 28

Processor Architecture

processor interconnect CTRL code mem. key mng. register file FU1 FU2 FU3

Arnaud Tisserand. CNRS – Lab-STICC 9/20

slide-29
SLIDE 29

Processor Architecture

processor interconnect CTRL code mem. key mng. register file FU1 FU2 FU3

Data: w-bit (32, . . . , 128) except for k digits, control: a few bits per unit

Arnaud Tisserand. CNRS – Lab-STICC 9/20

slide-30
SLIDE 30

Processor Architecture

external interface processor interconnect CTRL code mem. key mng. register file FU1 FU2 FU3

Data: w-bit (32, . . . , 128) except for k digits, control: a few bits per unit

Arnaud Tisserand. CNRS – Lab-STICC 9/20

slide-31
SLIDE 31

Protected F2m Multipliers

Unprotected

50 100 150 200 250 100 200 300 400 500 #transitions cycles Mastrovito 233 200 225 250 cycles Arnaud Tisserand. CNRS – Lab-STICC 10/20

slide-32
SLIDE 32

Protected F2m Multipliers

Unprotected

50 100 150 200 250 100 200 300 400 500 #transitions cycles Mastrovito 233 200 225 250 cycles

Protected Overhead: Area/time < 10 %

Arnaud Tisserand. CNRS – Lab-STICC 10/20

slide-33
SLIDE 33

Protected Processor for F2m

100 200 300 50 100 150 200 250 300 350 #transit. cycles DBL operation Mastrovito Unprotected Activity trace 0.00 0.02 0.04 0.06 0.08 current [mA] DBL operation Mastrovito Unprotected Current measures 100 200 300 #transit. DBL operation Mastrovito Protected Activity trace 0.00 0.04 0.08 0.12 0.16 current [mA] DBL operation Mastrovito Protected Current measures 100 200 300 #transit. ADD operation Mastrovito Protected Activity trace

Arnaud Tisserand. CNRS – Lab-STICC 11/20

slide-34
SLIDE 34

Key Management Unit

key mng. k key recoding ki CTRL

  • On-the-fly recoding of k: binary, λ-NAF (λ ∈ {2, 3, 4, 5}), variants

(fixed/sliding), double-base [6] and multiple-base [7] number systems (w/wo randomization), addition chains [20], other ?

  • Specific private path in the interconnect (no key leaks in RF or FUs)

Arnaud Tisserand. CNRS – Lab-STICC 12/20

slide-35
SLIDE 35

Double-Base Number System

Standard radix-2 representation: k =

t−1

  • i=0

ki2i = kt−1 kt−2 . . . k2 k1 k0

t explicit digits

Arnaud Tisserand. CNRS – Lab-STICC 13/20

slide-36
SLIDE 36

Double-Base Number System

Standard radix-2 representation: k =

t−1

  • i=0

ki2i = kt−1

2t−1

kt−2

2t−2

. . .

. . .

k2

22

k1

21

k0

20 t explicit digits implicit weights

Digits: ki ∈ {0, 1}, typical size: t ∈ {160, . . . , 600}

Arnaud Tisserand. CNRS – Lab-STICC 13/20

slide-37
SLIDE 37

Double-Base Number System

Standard radix-2 representation: k =

t−1

  • i=0

ki2i = kt−1

2t−1

kt−2

2t−2

. . .

. . .

k2

22

k1

21

k0

20 t explicit digits implicit weights

Digits: ki ∈ {0, 1}, typical size: t ∈ {160, . . . , 600} Double-Base Number System (DBNS): k =

n−1

  • j=0

kj2aj3bj =

Arnaud Tisserand. CNRS – Lab-STICC 13/20

slide-38
SLIDE 38

Double-Base Number System

Standard radix-2 representation: k =

t−1

  • i=0

ki2i = kt−1

2t−1

kt−2

2t−2

. . .

. . .

k2

22

k1

21

k0

20 t explicit digits implicit weights

Digits: ki ∈ {0, 1}, typical size: t ∈ {160, . . . , 600} Double-Base Number System (DBNS): k =

n−1

  • j=0

kj2aj3bj = kn−1 an−1 bn−1 . . . . . . . . . k1 a1 b1 k0 a0 b0 n (2, 3)−terms explicit “digits” explicit ranks aj, bj ∈ N, kj ∈ {1} or kj ∈ {−1, 1}, size n ≈ log t

Arnaud Tisserand. CNRS – Lab-STICC 13/20

slide-39
SLIDE 39

Double-Base Number System

Standard radix-2 representation: k =

t−1

  • i=0

ki2i = kt−1

2t−1

kt−2

2t−2

. . .

. . .

k2

22

k1

21

k0

20 t explicit digits implicit weights

Digits: ki ∈ {0, 1}, typical size: t ∈ {160, . . . , 600} Double-Base Number System (DBNS): k =

n−1

  • j=0

kj2aj3bj = kn−1 an−1 bn−1 . . . . . . . . . k1 a1 b1 k0 a0 b0 n (2, 3)−terms explicit “digits” explicit ranks aj, bj ∈ N, kj ∈ {1} or kj ∈ {−1, 1}, size n ≈ log t DBNS is a very redundant and sparse representation:

1701 = (11010100101)2

1701 = 243 + 1458 = 2035 + 2136 = (1, 0, 5), (1, 1, 6) = 1728 − 27 = 2633 − 2033 = (1, 6, 3), (−1, 0, 3) = 729 + 972 = 2036 + 2235 = (1, 0, 6), (1, 2, 5) . . .

Arnaud Tisserand. CNRS – Lab-STICC 13/20

slide-40
SLIDE 40

Randomized DBNS Recoding of the Scalar k

encryption signature etc

protocol level

[k]P ADD(P, Q) DBL(P) TPL(P)

curve level

x±y x×y . . .

field level

On-the-fly DBNS random recoding for the scalar k randomly recode windows of the scalar k on-the-fly: 1 + 2 ⇆ 3 1 + 3 ⇆ 22 1 + 23 ⇆ 32 . . . control number of reductions (←) and expansions (→) Point tripling operation Q = TPL(P) = P + P + P k

ki block time

recoding rules possible rules

Arnaud Tisserand. CNRS – Lab-STICC 14/20

slide-41
SLIDE 41

Randomized DBNS Recoding of the Scalar k

encryption signature etc

protocol level

[k]P ADD(P, Q) DBL(P) TPL(P)

curve level

x±y x×y . . .

field level

On-the-fly DBNS random recoding for the scalar k randomly recode windows of the scalar k on-the-fly: 1 + 2 ⇆ 3 1 + 3 ⇆ 22 1 + 23 ⇆ 32 . . . control number of reductions (←) and expansions (→) Point tripling operation Q = TPL(P) = P + P + P k

ki block time

recoding rules possible rules

recoded ki (,ki+1)

random choice

Arnaud Tisserand. CNRS – Lab-STICC 14/20

slide-42
SLIDE 42

Randomized DBNS Recoding of the Scalar k

encryption signature etc

protocol level

[k]P ADD(P, Q) DBL(P) TPL(P)

curve level

x±y x×y . . .

field level

On-the-fly DBNS random recoding for the scalar k randomly recode windows of the scalar k on-the-fly: 1 + 2 ⇆ 3 1 + 3 ⇆ 22 1 + 23 ⇆ 32 . . . control number of reductions (←) and expansions (→) Point tripling operation Q = TPL(P) = P + P + P k

ki block time

recoding rules possible rules

recoded ki (,ki+1)

random choice

DBNS is redundant ⇒ security ր DBNS is sparse ⇒ 20–30 % speed ր Ref: [6]

Arnaud Tisserand. CNRS – Lab-STICC 14/20

slide-43
SLIDE 43

Register File (≈ Dual Port Memory)

x[i] y[i] r[i] field elements (size ≥ m bits) word size (w bits) Control signals: addresses (port A, port B), read/write, write enable Specific addressing model for Fq elements through an intermediate address table with hardware loop

  • linear addresses, SW: LOAD @x =

⇒ HW: loop x[0], x[1], . . . x[ℓ − 1]

  • randomized addresses (specific PRNG)

Arnaud Tisserand. CNRS – Lab-STICC 15/20

slide-44
SLIDE 44

Developed Programming Tools

time now

V0 hardware modules . . . configurations CAD tools selection user crypto. lib. assembler binary implementation

Arnaud Tisserand. CNRS – Lab-STICC 16/20

slide-45
SLIDE 45

Developed Programming Tools

time now

V0 V1 hardware modules . . . configurations CAD tools selection user crypto. lib. assembler binary implementation small compiler python API

Arnaud Tisserand. CNRS – Lab-STICC 16/20

slide-46
SLIDE 46

Developed Programming Tools

time now

V0 V1 V2 hardware modules hardware modules . . . configurations CAD tools selection user crypto. lib. crypto. lib. assembler binary implementation small compiler Sage API

Arnaud Tisserand. CNRS – Lab-STICC 16/20

slide-47
SLIDE 47

PAVOIS Integrated Circuit

ECC 256 bits GF(p) with p configurable 65 nm CMOS 1.5 mm2

  • algo. & arith. protections

basic layout obfuscation

Arnaud Tisserand. CNRS – Lab-STICC 17/20

slide-48
SLIDE 48

Cryptoprocessors for HECC

Data Memory Control Program Memory Data MUX Ctrl DMUX AddSub Mult CSWAP Data Memory Global Control Program Memory Data MUX Ctrl DMUX AddSub Mult OReg CSWAP CSWAP AddSub Data Memory Mult AddSub Control Program Memory Data MUX Ctrl DMUX Mult Control Program Memory Data MUX ADD/SUB AddSub Data Memory Data MUX Data Memory ADD/SUB AddSub Mult Mult C S W A P

Arnaud Tisserand. CNRS – Lab-STICC 18/20

slide-49
SLIDE 49

Our Long Term Objectives

Study the links between:

  • cryptosystems
  • arithmetic algorithms
  • Fq, pts representations
  • architectures & units
  • circuit optimisations

to ensure

  • high security against

◮ theoretical attacks ◮ physical attacks

  • low design cost
  • low silicon cost
  • low energy(/power)
  • high performances
  • high flexibility

area 1 delay 1 energy 1 security 1

Arnaud Tisserand. CNRS – Lab-STICC 19/20

slide-50
SLIDE 50

Our Long Term Objectives

Study the links between:

  • cryptosystems
  • arithmetic algorithms
  • Fq, pts representations
  • architectures & units
  • circuit optimisations

to ensure

  • high security against

◮ theoretical attacks ◮ physical attacks

  • low design cost
  • low silicon cost
  • low energy(/power)
  • high performances
  • high flexibility

area 1 1 + a delay 1 1 + t energy 1 1 + e a, t, e ∈ 0%, 5%, 10%, . . . , 100% security 1

Arnaud Tisserand. CNRS – Lab-STICC 19/20

slide-51
SLIDE 51

Our Long Term Objectives

Study the links between:

  • cryptosystems
  • arithmetic algorithms
  • Fq, pts representations
  • architectures & units
  • circuit optimisations

to ensure

  • high security against

◮ theoretical attacks ◮ physical attacks

  • low design cost
  • low silicon cost
  • low energy(/power)
  • high performances
  • high flexibility

area 1 1 + a delay 1 1 + t energy 1 1 + e a, t, e ∈ 0%, 5%, 10%, . . . , 100% security 1 ×10 ×100

Arnaud Tisserand. CNRS – Lab-STICC 19/20

slide-52
SLIDE 52

The end, questions ?

Contact:

  • mailto:arnaud.tisserand@univ-ubs.fr
  • http://www-labsticc.univ-ubs.fr/~tisseran
  • CNRS

Lab-STICC, Centre Recherche UBS Rue St Maud´

  • e. BP 92116. 56321 Lorient cedex, France

Thank you

Arnaud Tisserand. CNRS – Lab-STICC 20/20

slide-53
SLIDE 53

References I

[1]

  • K. Bigou and A. Tisserand.

Improving modular inversion in RNS using the plus-minus method. In G. Bertoni and J.-S. Coron, editors, Proc. 15th International Workshop on Cryptographic Hardware and Embedded Systems (CHES), volume 8086 of LNCS, pages 233–249, Santa Barbara, CA, USA, August 2013. Springer. [2]

  • K. Bigou and A. Tisserand.

Single base modular multiplication for efficient hardware RNS implementations of ECC. In T. Guneysu and H. Handschuh, editors, Proc. 17th International Workshop on Cryptographic Hardware and Embedded Systems (CHES), volume 9293 of LNCS, pages 123–140, Saint-Malo, France, September 2015. Springer. [3]

  • K. Bigou and A. Tisserand.

Hybrid position-residues number system. In J. Hormigo, S. Oberman, and N. Revol, editors, Proc. 23rd Symposium on Computer Arithmetic (ARITH), pages 126–133, Santa Clara, CA, U.S.A, July 2016. IEEE Computer Society. [4]

  • A. Byrne, F. Crowe, W. P. Marnane, N. Meloni, A. Tisserand, and E. M. Popovici.

SPA resistant elliptic curve cryptosystem using addition chains.

  • Int. J. High Performance Systems Architecture, 1(2):133–142, October 2007.

[5]

  • A. Byrne, N. Meloni, A. Tisserand, E. M. Popovici, and W. P. Marnane.

Comparison of simple power analysis attack resistant algorithms for an elliptic curve cryptosystem. Journal of Computers, 2(10):52–62, 2007. [6]

  • T. Chabrier, D. Pamula, and A. Tisserand.

Hardware implementation of DBNS recoding for ECC processor. In Proc. 44rd Asilomar Conference on Signals, Systems and Computers, pages 1129–1133, Pacific Grove, California, U.S.A., November 2010. IEEE. [7]

  • T. Chabrier and A. Tisserand.

On-the-fly multi-base recoding for ECC scalar multiplication without pre-computations. In A. Nannarelli, P.-M. Seidel, and P. T. P. Tang, editors, Proc. 21st Symposium on Computer Arithmetic (ARITH), pages 219–228, Austin, TX, U.S.A, April 2013. IEEE Computer Society. Arnaud Tisserand. CNRS – Lab-STICC 20/20

slide-54
SLIDE 54

References II

[8]

  • J. Chen, A. Tisserand, E. M. Popovici, and S. Cotofana.

Robust sub-powered asynchronous logic. In J. Becker and M. R. Adrover, editors, Proc. 24th International Workshop on Power and Timing Modeling, Optimization and Simulation (PATMOS), pages 1–7, Palma de Mallorca, Spain, September 2014. IEEE. [9]

  • J. Chen, A. Tisserand, E. M. Popovici, and S. Cotofana.

Asynchronous charge sharing power consistent Montgomery multiplier. In J. Sparso and E Yahya, editors, Proc. 21st IEEE International Symposium on Asynchronous Circuits and Systems (ASYNC), pages 132–138, Mountain View, California, USA, May 2015. [10]

  • H. Cohen and G. Frey, editors.

Handbook of Elliptic and Hyperelliptic Curve Cryptography. Discrete Mathematics and Its Applications. Chapman & Hall/CRC, July 2005. [11]

  • G. Gallin, T. U. Celik, and A. Tisserand.

Architecture level optimizations for kummer based HECC on FPGAs. In Arpita Patra and Nigel P. Smart, editors, Proc. 18th International Conference on Cryptology in India (IndoCrypt), volume 10698 of LNCS, pages 44–64, Chennai, India, December 2017. Springer. [12]

  • G. Gallin and A. Tisserand.

Hyper-threaded multiplier for HECC. In Proc. 51st Asilomar Conference on Signals, Systems and Computers, pages 447–451, Pacific Grove, CA, USA, October

  • 2017. IEEE.

[13]

  • G. Gallin and A. Tisserand.

Generation of finely-pipelined GF(P) multipliers for flexible curve based cryptography on FPGAs. IEEE Transactions on Computers, 69(11):1612–1622, November 2019. [14]

  • D. Hankerson, A. Menezes, and S. Vanstone.

Guide to Elliptic Curve Cryptography. Springer, 2004. Arnaud Tisserand. CNRS – Lab-STICC 20/20

slide-55
SLIDE 55

References III

[15]

  • A. Lucas and A. Tisserand.

Microcontroller implementation of simultaneous protections against observation and perturbation attacks for ECC. In Proc. 15th International Conference on Security and Cryptography (SECRYPT), Porto, Portugal, July 2018. Springer. [16]

  • D. Pamula.

Arithmetic Operators on GF(2m) for Cryptographic Applications: Performance - Power Consumption - Security Tradeoffs. Phd thesis, University of Rennes 1 and Silesian University of Technology, December 2012. [17]

  • D. Pamula, E. Hrynkiewicz, and A. Tisserand.

Analysis of GF(2233) multipliers regarding elliptic curve cryptosystem applications. In 11th IFAC/IEEE International Conference on Programmable Devices and Embedded Systems (PDeS), pages 271–276, Brno, Czech Republic, May 2012. [18]

  • D. Pamula and A. Tisserand.

GF(2m) finite-field multipliers with reduced activity variations. In 4th International Workshop on the Arithmetic of Finite Fields, volume 7369 of LNCS, pages 152–167, Bochum, Germany, July 2012. Springer. [19]

  • D. Pamula and A. Tisserand.

Fast and secure finite field multipliers. In Proc. 18th Euromicro Conference on Digital System Design (DSD), pages 653–660, Madeira, Portugal, August 2015. [20]

  • J. Proy, N. Veyrat-Charvillon, A. Tisserand, and N. Meloni.

Full hardware implementation of short addition chains recoding for ECC scalar multiplication. In Actes Conf´ erence d’informatique en Parall´ elisme, Architecture et Syst` eme (ComPAS), Lille, France, June 2015. [21]

  • A. Tisserand.

Hardware accelerators for ECC and HECC. In 19th Workshop on Elliptic Curve Cryptography (ECC), Bordeaux, France, September 2015. Invited talk. Arnaud Tisserand. CNRS – Lab-STICC 20/20