High-performance Elliptic Curve Cryptography by Using the CIOS Method for Modular Multiplication A mine Mrabet , Nadia El-Mrabet, Ronan Lashermes , Jean-Baptiste Rigaud, Belgacem Bouallegue, Sihem Mesnager and Mohsen Machhout September 2016 Efficient MMM for ECC Mrabet et al. September 2016 1/37
Arithmetic Our architecture Results Introduction Public key cryptography is still costly (computing resources). Elliptic Curve Cryptography has a better cost/security trade-off w.r.t. RSA. We can still reduce the cost with better hardware architectures . Efficient MMM for ECC Mrabet et al. September 2016 2/37
Arithmetic Our architecture Results Arithmetic 1 ECC Montgomery Modular Multiplication Our architecture 2 Basics PEs Scheduling Resources Results 3 Results Conclusion Efficient MMM for ECC Mrabet et al. September 2016 3/37
Arithmetic Our architecture Results ECC Elliptic Curve Cryptography (ECC) Why? Elliptic curves allow to define groups with a hard Discrete Logarithm Problem. In the general case, cracking methods are far less efficient than for RSA. Efficient MMM for ECC Mrabet et al. September 2016 4/37
Arithmetic Our architecture Results ECC Elliptic Curve Cryptography (ECC) Why? Elliptic curves allow to define groups with a hard Discrete Logarithm Problem. In the general case, cracking methods are far less efficient than for RSA. How? (simplified) Let p > 3 a big prime, E ( F p ) is the (short Weierstrass) elliptic curve E ( F p ) : y 2 = x 3 + ax + b , where x , y , a , b ∈ F p with 4 a 3 + 27 b 2 � = 0. Efficient MMM for ECC Mrabet et al. September 2016 4/37
Arithmetic Our architecture Results ECC EC Group The points ( x , y ) on the curve define an abelian group together with the point at infinity 0 ∞ , the neutral element for addition. Efficient MMM for ECC Mrabet et al. September 2016 5/37
Arithmetic Our architecture Results ECC EC Group The points ( x , y ) on the curve define an abelian group together with the point at infinity 0 ∞ , the neutral element for addition. Jacobian coordinates The triple ( x : y : z ) can be mapped to ( x / z 2 , y / z 3 ) if z � = 0. If z = 0 it is 0 ∞ . The curve becomes: y 2 = x 3 + axz 4 + bz 6 . Efficient MMM for ECC Mrabet et al. September 2016 5/37
Arithmetic Our architecture Results ECC Operations in Jacobian coordinates ( a = 0, points � = 0 ∞ ) Doubling (7S+5M+13A) T ( X T : Y T : Z T ) = 2 · Q ( X Q : Y Q : Z Q ) . X T = 9 X 4 Q − 8 X Q Y 2 Q , Y T = 3 X 2 Q ( 4 X Q Y Q − X T ) − 8 Y 4 Q , Z T = 2 Y Q Z Q . Efficient MMM for ECC Mrabet et al. September 2016 6/37
Arithmetic Our architecture Results ECC Operations in Jacobian coordinates ( a = 0, points � = 0 ∞ ) Doubling (7S+5M+13A) T ( X T : Y T : Z T ) = 2 · Q ( X Q : Y Q : Z Q ) . X T = 9 X 4 Q − 8 X Q Y 2 Q , Y T = 3 X 2 Q ( 4 X Q Y Q − X T ) − 8 Y 4 Q , Z T = 2 Y Q Z Q . Addition (4S + 14M + 6A) R = T + Q . T − 2 Y T ) 2 − 4 ( X Q Z 2 T − X T ) 3 − 8 ( X Q Z 2 X R = ( 2 Y Q Z 3 T − X T ) 2 X T , Y R = ( 2 Y Q Z 3 T − 2 Y T )( 4 X T ( X Q Z 2 T − X T ) − X R ) − 8 Y T ( X Q Z 2 T − X T ) 3 , Z R = 2 Z T ( X Q Z 2 T − X T ) . Efficient MMM for ECC Mrabet et al. September 2016 6/37
Arithmetic Our architecture Results Montgomery Modular Multiplication Montgomery Modular Multiplication (MMM) MMM MMM provides an efficient way for modular multiplication mod p (noted · ): there is no division by p . Efficient MMM for ECC Mrabet et al. September 2016 7/37
Arithmetic Our architecture Results Montgomery Modular Multiplication Montgomery Modular Multiplication (MMM) MMM MMM provides an efficient way for modular multiplication mod p (noted · ): there is no division by p . Residue Let a , b , R ∈ F p where R is Montgomery’s residue. a ′ = aR mod p is said to be a in Montgomery’s form. a · b = abR − 1 mod p , as a consequence a ′ · b ′ = aRbRR − 1 mod p = abR mod p = ( ab ) ′ . Efficient MMM for ECC Mrabet et al. September 2016 7/37
Arithmetic Our architecture Results Montgomery Modular Multiplication Montgomery Modular Multiplication (MMM) MMM MMM provides an efficient way for modular multiplication mod p (noted · ): there is no division by p . Residue Let a , b , R ∈ F p where R is Montgomery’s residue. a ′ = aR mod p is said to be a in Montgomery’s form. a · b = abR − 1 mod p , as a consequence a ′ · b ′ = aRbRR − 1 mod p = abR mod p = ( ab ) ′ . Conversion Field values are converted in Montgomery’s form at the beginning of the computation and back to normal at the end. Efficient MMM for ECC Mrabet et al. September 2016 7/37
Arithmetic Our architecture Results Montgomery Modular Multiplication How to compute MMM? Koç’s multiword CIOS algorithm Efficient MMM for ECC Mrabet et al. September 2016 8/37
Arithmetic Our architecture Results Montgomery Modular Multiplication CIOS details Efficient MMM for ECC Mrabet et al. September 2016 9/37
Arithmetic Our architecture Results Montgomery Modular Multiplication Benefits Low memory footprint, apart from some precomputations ( p ′ , R ...), easy to change p and operand sizes, neat structure, without divisions, easy to implement in hardware. Efficient MMM for ECC Mrabet et al. September 2016 10/37
Arithmetic Our architecture Results Basics Basics Here, each operation takes 1 unit of time. Let’s compute r = a · b + b + c . Sequential Time · + Operations 1 x t 1 = a · b 2 x t 2 = b + c 3 x r = t 1 + t 2 Efficient MMM for ECC Mrabet et al. September 2016 11/37
Arithmetic Our architecture Results Basics Basics Here, each operation takes 1 unit of time. Let’s compute r = a · b + b + c . Sequential Time · + Operations 1 x t 1 = a · b 2 x t 2 = b + c 3 x r = t 1 + t 2 Parallel Time · + Operations 1 x x t 1 = a · b , t 2 = b + c 2 x r = t 1 + t 2 Efficient MMM for ECC Mrabet et al. September 2016 11/37
Arithmetic Our architecture Results Basics Basics - 2 Here, each operation takes 1 unit of time. Let’s compute r = a · b + b + c . Atomic Latency Throughput + Operations · 2 0.5 1 2 r = a · b + b + c The choice of operations and how they are chained together is called scheduling . Efficient MMM for ECC Mrabet et al. September 2016 12/37
Arithmetic Our architecture Results Basics Basics - 2 Here, each operation takes 1 unit of time. Let’s compute r = a · b + b + c . Atomic Latency Throughput + Operations · 2 0.5 1 2 r = a · b + b + c Pipelined Latency Throughput · + Operations 2 + ǫ 0 . 5 1 1 1 : t 1 = a · b , t 2 = b + c , 2 : r = t 1 + t 2 2 + ǫ 1 1 2 1 : t 1 = a · b , t 2 = b + c , 2 : r = t 1 + t 2 The choice of operations and how they are chained together is called scheduling . Efficient MMM for ECC Mrabet et al. September 2016 12/37
Arithmetic Our architecture Results Basics Systolic arrays A systolic array is an architecture both parallel and pipelined. To create such an architecture, we have to identify small Processing Elements (PEs) (no control flow logic). Efficient MMM for ECC Mrabet et al. September 2016 13/37
Arithmetic Our architecture Results PEs Where is Waldo the PE? Efficient MMM for ECC Mrabet et al. September 2016 14/37
Arithmetic Our architecture Results PEs α Efficient MMM for ECC Mrabet et al. September 2016 15/37
Arithmetic Our architecture Results PEs α f Efficient MMM for ECC Mrabet et al. September 2016 16/37
Arithmetic Our architecture Results PEs β Efficient MMM for ECC Mrabet et al. September 2016 17/37
Arithmetic Our architecture Results PEs γ Efficient MMM for ECC Mrabet et al. September 2016 18/37
Arithmetic Our architecture Results PEs γ f Efficient MMM for ECC Mrabet et al. September 2016 19/37
Arithmetic Our architecture Results Scheduling S=8, Time=1 Efficient MMM for ECC Mrabet et al. September 2016 20/37
Arithmetic Our architecture Results Scheduling S=8, Time=2 Efficient MMM for ECC Mrabet et al. September 2016 21/37
Arithmetic Our architecture Results Scheduling S=8, Time=3 Efficient MMM for ECC Mrabet et al. September 2016 22/37
Arithmetic Our architecture Results Scheduling S=8, Time=4 Efficient MMM for ECC Mrabet et al. September 2016 23/37
Arithmetic Our architecture Results Scheduling S=8, Time=10 Efficient MMM for ECC Mrabet et al. September 2016 24/37
Arithmetic Our architecture Results Scheduling S=8, Time=10 Efficient MMM for ECC Mrabet et al. September 2016 25/37
Arithmetic Our architecture Results Scheduling S=8, Time=13 Efficient MMM for ECC Mrabet et al. September 2016 26/37
Arithmetic Our architecture Results Scheduling S=8, All Efficient MMM for ECC Mrabet et al. September 2016 27/37
Arithmetic Our architecture Results Resources Alpha Efficient MMM for ECC Mrabet et al. September 2016 28/37
Arithmetic Our architecture Results Resources Gamma Efficient MMM for ECC Mrabet et al. September 2016 29/37
Arithmetic Our architecture Results Resources Resources Our architecture requires: 3 α , 3 γ , 1 β , 1 α f , 1 γ f . Efficient MMM for ECC Mrabet et al. September 2016 30/37
Recommend
More recommend
