International Conference on the Theory and Application of Cryptology and Information Security

ASIACRYPT 2012: Advances in Cryptology – ASIACRYPT 2012 pp 718-739

Four-Dimensional Gallant-Lambert-Vanstone Scalar Multiplication

  • Patrick Longa
  • Francesco Sica
Conference paper

DOI: 10.1007/978-3-642-34961-4_43

Volume 7658 of the book series Lecture Notes in Computer Science (LNCS)

Abstract

The GLV method of Gallant, Lambert and Vanstone (CRYPTO 2001) computes any multiple kP of a point P of prime order n lying on an elliptic curve with a low-degree endomorphism Φ (called GLV curve) over \(\mathbb{F}_p\) as \(kP = k_1P + k_2\Phi(P), \text{with } \max\{|k_1|,|k_2|\}\leq C_1\sqrt n\), for some explicit constant C1 > 0. Recently, Galbraith, Lin and Scott (EUROCRYPT 2009) extended this method to all curves over \(\mathbb{F}_{p^2}\) which are twists of curves defined over \(\mathbb{F}_p\). We show in this work how to merge the two approaches in order to get, for twists of any GLV curve over \(\mathbb{F}_{p^2}\), a four-dimensional decomposition together with fast endomorphisms Φ, Ψ over \(\mathbb{F}_{p^2}\) acting on the group generated by a point P of prime order n, resulting in a proven decomposition for any scalar k ∈ [1,n] given by kP = k1P + k2Φ(P) + k3Ψ(P) + k4ΨΦ(P)  with max i (|ki|) < C2n1/4, for some explicit C2 > 0. Remarkably, taking the best C1, C2, we obtain C2/C1 < 412, independently of the curve, ensuring in theory an almost constant relative speedup. In practice, our experiments reveal that the use of the merged GLV-GLS approach supports a scalar multiplication that runs up to 50% times faster than the original GLV method. We then improve this performance even further by exploiting the Twisted Edwards model and show that curves originally slower may become extremely efficient on this model. In addition, we analyze the performance of the method on a multicore setting and describe how to efficiently protect GLV-based scalar multiplication against several side-channel attacks. Our implementations improve the state-of-the-art performance of point multiplication for a variety of scenarios including side-channel protected and unprotected cases with sequential and multicore execution.

Keywords

Elliptic curvesGLV-GLS methodscalar multiplicationTwisted Edwards curveside-channel protectionmulticore computation
Download to read the full conference paper text

Copyright information

© International Association for Cryptologic Research 2012

Authors and Affiliations

  • Patrick Longa
    • 1
  • Francesco Sica
    • 2
  1. 1.Microsoft ResearchUSA
  2. 2.Nazarbayev UniversityKazakhstan