Skip to main content
SpringerLink
Log in
Book cover

International Conference on Cryptology in Africa

AFRICACRYPT 2016: Progress in Cryptology – AFRICACRYPT 2016 pp 84–106Cite as

Three Dimensional Montgomery Ladder, Differential Point Tripling on Montgomery Curves and Point Quintupling on Weierstrass’ and Edwards Curves

  • Conference paper
  • First Online:

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 9646))

Abstract

Elliptic Curve Cryptography is an important alternative to traditional public key schemes such as RSA. This paper presents

  1. (i)

    a simultaneous triple scalar multiplication algorithm to compute the x-coordinate of \(kP+lQ+uR\) on a Montgomery Curve \(E_{m}\) defined over \(\mathbb {F}_p\) which is about 15 to 22 % faster than the straight forward method of doing the same. The algorithm, motivated by Bernstein’s paper on Differential Addition Chains, where the author proposes various 2-dimensional differential addition chains and asks for 3-dimensional versions to be constructed, can be generalized to other elliptic curve forms with differential addition formula,

  2. (ii)

    a formula for Differential point tripling on Montgomery Curves which is slightly better than computing 3P as \(2P+P\) and relevant in the implementation of Montgomery’s PRAC and

  3. (iii)

    an improvement in Mishra and Dimitrov’s point Quintupling algorithm for Weierstrass’ curves and an efficient Quintupling algorithm for Edwards Curves.

This is a preview of subscription content, log in via an institution.

Chapter
USD   29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD   39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD   54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Learn about institutional subscriptions

References

  1. Stinson, D.: Cryptography: Theory and Practice, 3rd edn. CRC Press, Boca Raton (2005)

    MATH  Google Scholar 

  2. Bellman, R., Straus, E.G.: Addition chains of vectors (problem 5125). Am. Math. Mon. 71, 806–808 (1964)

    Article  MathSciNet  Google Scholar 

  3. ElGamal, T.: A public key cryptosystem and a signature scheme base on discrete logarithms. In: Blakley, G.R., Chaum, D. (eds.) CRYPTO 1984. LNCS, vol. 196, pp. 10–18. Springer, Heidelberg (1985)

    Chapter  Google Scholar 

  4. Cohen, H., Frey, G.: Handbook of Elliptic and Hyperelliptic Curve Cryptography. CRC Press, Boca Raton (2006)

    MATH  Google Scholar 

  5. Solinas, J.A.: Low-weight binary representations for pairs of integers. Combinatorics and Optimization Research Report CORR 2001-41. University of Waterloo (2001)

    Google Scholar 

  6. Montgomery, P.L.: Speeding the pollard and elliptic curve methods of factorization. Math. Comput. 48(177), 243–264 (1987)

    Article  MathSciNet  MATH  Google Scholar 

  7. Akishita, T.: Fast simultaneous scalar multiplication on elliptic curve with montgomery form. In: Vaudenay, S., Youssef, A.M. (eds.) SAC 2001. LNCS, vol. 2259, pp. 255–267. Springer, Heidelberg (2001)

    Chapter  Google Scholar 

  8. Stam, M.: Speeding up subgroup cryptosystems. Ph.D. thesis, Technische Universiteit Eindhoven (2003)

    Google Scholar 

  9. Knuth, D.E.: The Art of Computer Programming. Seminumerical algorithms, vol. 2, 3rd edn. Pearson, London (1998)

    Google Scholar 

  10. Bernstein, D.J.: Differential Addition Chains (2006). http://cr.yp.to/ecdh/diffchain-20060219.pdf. Accessed 25 January 2015

  11. Brown, D.R.L.: Multi-dimensional Montgomery ladders for elliptic curves (2006). http://eprint.iacr.org/2006/220. Accessed 25 January 2015

  12. Brown, D.R.L.: Multi-dimensional Montgomery ladders for elliptic curves. Patent No. US8750500 B2 (2014). http://www.google.com/patents/US8750500

  13. Montgomery, P.L.: Evaluating recurrences of form \(X_{m+n} = f(x_{m}, X_{n}, X_{m-n})\) via Lucas chains (1992). https://cr.yp.to/bib/1992/montgomery-lucas.ps. Accessed 2 February 2016

  14. Azarderakhsh, R., Karabina, K.: A New Double Point Multiplication Method and its Implementation on Binary Elliptic Curves with Endomorphisms. http://cacr.uwaterloo.ca/techreports/2012/cacr2012-24.pdf

  15. Okeya, K., Sakurai, K.: Efficient elliptic curve cryptosystems from a scalar multiplication algorithm with recovery of the y-coordinate on a montgomery form elliptic curve. In: Ko, K., Naccache, D., Paar, C. (eds.) CHES 2001. LNCS, vol. 2162, pp. 126–141. Springer, Heidelberg (2001)

    Chapter  Google Scholar 

  16. Brent, R., Zimmermann, P.: Modern Computer Arithmetic. Cambridge Monographs on Applied and Computational Mathematics. Cambridge University Press, Cambridge (2010)

    Book  MATH  Google Scholar 

  17. Subramanya Rao, S.R.: A note on Schoenmakers’ algorithm for multi-exponentiation. In: Obaidat, M.S., Lorenz, P., Samarati, P. (eds.) Proceedings of International Conference on Security and Cryptography, SECRYPT 2015, pp. 384–391. SciTePress, Setúbal (2015)

    Google Scholar 

  18. Menezes, A., van Oorschot, P., Vanstone, S.: Handbook of Applied Cryptography. Taylor and Francis, London (1997)

    MATH  Google Scholar 

  19. Antipa, A., Brown, D., Gallant, R., Lambert, R., Struik, R., Vanstone, S.: Accelerated verification of ECDSA signatures. http://cacr.uwaterloo.ca/techreports/2005/cacr2005-28.pdf. Accessed 2 February 2016

  20. Cheon, J.H., Yi, J.H.: Fast batch verification of multiple signatures. In: Okamoto, T., Wang, X. (eds.) PKC 2007. LNCS, vol. 4450, pp. 442–457. Springer, Heidelberg (2007)

    Google Scholar 

  21. Karati, S., Das, A., Roychoudhury, D.: Randomized batch verification of standard ECDSA signatures. In: Chakraborty, R.S., Matyas, V., Schaumont, P. (eds.) SPACE 2014. LNCS, vol. 8804, pp. 237–255. Springer, Heidelberg (2014)

    Google Scholar 

  22. Bernstein, D.J., Birkner, P., Lange, T., Peters, C.: Optimizing Double-Base Elliptic-Curve Single-Scalar Multiplication. https://cr.yp.to/antiforgery/doublebase-20071028.pdf. Accessed 2 February 2016

  23. Dimitrov, V.S., Imbert, L., Mishra, P.K.: Efficient and Secure Elliptic Curve Point Multiplicaton Using Double-Base Chains. https://www.iacr.org/archive/asiacrypt2005/059/059.pdf. Accessed 2 February 2016

  24. Dimitrov, V.S., Cooklev, T.: Hybrid algorithm for the computation of the matrix polynomial \(I+A+ \dots +A^{n-1}\). IEEE Trans. Circ. Syst. 42(7), 377–380 (1995)

    Article  MathSciNet  MATH  Google Scholar 

  25. Mishra, P.K., Dimitrov, V.S.: Efficient Quintuple Formuals for Elliptic Curves and Efficeint Scalar Multiplication Using Multibase Number Representation. https://eprint.iacr.org/2007/040.pdf. Accessed 2 February 2016

  26. Giorgi, P., Imbert, L., Izard, T.: Optimizing elliptic curve scalar multiplications for small scalars. In: Mathematics for Signal and Information Processing, San Diego, CA, United States, p. 74440N (2009)

    Google Scholar 

  27. Longa, P., Miri, A.: New Multibase Non-Adjacent Form Scalar Multiplication and its applications to Elliptic Curve Cryptosystems. https://eprint.iacr.org/2008/052.pdf. Accessed 2 February 2016

  28. Lopez, J., Dahab, R.: Fast multiplication on elliptic curves over \(GF(2^m)\) without precomputation. In: Ko, K., Paar, C. (eds.) CHES 1999. LNCS, vol. 1717, pp. 316–327. Springer, Heidelberg (1999)

    Chapter  Google Scholar 

  29. Fischer, W., Giraud, C., Knudsen, E.W., Seifert, J.-P.: Parallel scalar multiplication on general elliptic curves over \(\mathbb{F}_p\) hedged against Non-Differential Side-Channel Attacks. http://eprint.iacr.org/2002/007.pdf. Accessed 2 February 2016

  30. Brier, E., Joye, M.: Weierstrass elliptic curves and side-channel attacks. In: Naccache, D., Paillier, P. (eds.) PKC 2002. LNCS, vol. 2274, pp. 335–345. Springer, Heidelberg (2002)

    Google Scholar 

  31. Bernstein, D.J., Lange, T., Rezaeian Farashahi, R.: Binary edwards curves. In: Oswald, E., Rohatgi, P. (eds.) CHES 2008. LNCS, vol. 5154, pp. 244–265. Springer, Heidelberg (2008)

    Chapter  Google Scholar 

  32. Justus, B., Loebenberger, D.: Differential addition in generalized edwards coordinates. In: Echizen, I., Kunihiro, N., Sasaki, R. (eds.) IWSEC 2010. LNCS, vol. 6434, pp. 316–325. Springer, Heidelberg (2010)

    Chapter  Google Scholar 

  33. Devigne, J., Joye, M.: Binary huff curves. In: Kiayias, A. (ed.) CT-RSA 2011. LNCS, vol. 6558, pp. 340–355. Springer, Heidelberg (2011)

    Chapter  Google Scholar 

  34. Hutter, M., Joye, M., Sierra, Y.: Memory-constrained implementations of elliptic curve cryptography in co-Z coordinate representation. In: Nitaj, A., Pointcheval, D. (eds.) AFRICACRYPT 2011. LNCS, vol. 6737, pp. 170–187. Springer, Heidelberg (2011)

    Chapter  Google Scholar 

  35. Wu, H., Tang, C., Feng, R.: A new model of binary elliptic curves. In: Galbraith, S., Nandi, M. (eds.) INDOCRYPT 2012. LNCS, vol. 7668, pp. 399–411. Springer, Heidelberg (2012)

    Chapter  Google Scholar 

  36. Farashahi, R.R., Joye, M.: Efficient arithmetic on hessian curves. In: Nguyen, P.Q., Pointcheval, D. (eds.) PKC 2010. LNCS, vol. 6056, pp. 243–260. Springer, Heidelberg (2010)

    Chapter  Google Scholar 

  37. Abarzúa, R., Thériault, N.: Complete atomic blocks for elliptic curves in jacobian coordinates over prime fields. In: Hevia, A., Neven, G. (eds.) LatinCrypt 2012. LNCS, vol. 7533, pp. 37–55. Springer, Heidelberg (2012)

    Chapter  Google Scholar 

  38. Longa, P., Miri, A.: Fast and flexible elliptic curves point arithmetic over prime fields. IEEE Trans. Comput. 57(3), 289–302 (2008)

    Article  MathSciNet  MATH  Google Scholar 

  39. Bernstein, D.J.: Curve25519: New Diffie Hellman Speed Records. https://cr.yp.to/ecdh/curve25519-20060209.pdf. Accessed 2 February 2016

Download references

Acknowledgments

Many thanks to the anonymous reviewers of Africacrypt 2016 for their valuable feedback.

Author information

Authors and Affiliations

  1. Mathematical Sciences Institute (MSI), The Australian National University (ANU), Canberra, Australia

    Srinivasa Rao Subramanya Rao

Authors
  1. Srinivasa Rao Subramanya Rao
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Srinivasa Rao Subramanya Rao .

Editor information

Editors and Affiliations

  1. Ecole Normale Supérieure, Paris, France

    David Pointcheval

  2. University of Caen, Caen, France

    Abderrahmane Nitaj

  3. Al Akhawayn University in Ifrane, Ifrane, Morocco

    Tajjeeddine Rachidi

Appendices

Appendices

A Five Element Set \(G_{i+1}\) for all Combinations of \((k_{i},l_{i},u_{i})\)

Here, we list the five elements in \(G_{i+1}\) for all eight combinations of \((k_{i},l_{i},u_{i})\), that was used to construct the three dimensional Montgomery Ladder presented in Sect. 3 of this paper.

figure e

B Derivation of Differential Tripling Formula on Montgomery Curves and an Algorithm for Differential Tripling

We derive the differential point tripling formulae for Montgomery Curves. Let \(P_{1}=(X_{1},Y_{1},Z_{1})\), \(P_{2}=(X_{2},Y_{2},Z_{2})\) and \(P_{3}=(X_{3},Y_{3},Z_{3})\) be points on a Montgomery curve \(E_{m}\) with \(P_{2}=2P_{1}\) and\(P_{3}=3P_{1}\). We can write \(P_{3}=3P_{1}=2P_{1}+P_{1}=P_{2}+P_{1}\). Then,

$$\begin{aligned} X_{2}&=(X_{1} + Z_{1})^2(X_{1} - Z_{1})^2 \end{aligned}$$
(7)
$$\begin{aligned} Z_{2}&= 4X_{1}Z_{1}((X_{1}-Z_{1})^2+((A+2)/4)(4X_{1}Z_{1})) \end{aligned}$$
(8)
$$\begin{aligned} X_{3}&= Z_{1}[(X_{1}-Z_{1})(X_{2}+Z_{2})+(X_{1}+Z_{1})(X_{2}-Z_{2})]^2 \end{aligned}$$
(9)
$$\begin{aligned} Z_{3}&= X_{1}[(X_{1}-Z_{1})(X_{2}+Z_{2})-(X_{1}+Z_{1})(X_{2}-Z_{2})]^2 \end{aligned}$$
(10)

From Eqs. (7), (8), (9) and (10) we can write

$$\begin{aligned} X_{3} = Z_{1}\bigl [&\left( X_{1}-Z_{1}\right) \bigl \{\left( X_{1}+Z_{1}\right) ^2\left( X_{1}-Z_{1}\right) ^2+4X_{1}Z_{1}\left( X_{1}-Z_{1}\right) ^2 + \left( \left( A+2\right) /4\right) \left( 4X_{1}Z_{1}\right) ^2\bigr \} +\\&(X_{1}+Z_{1})\bigl \{\left( X_{1}+Z_{1}\right) ^2\left( X_{1}-Z_{1}\right) ^2-4X_{1}Z_{1}\left( X_{1}-Z_{1}\right) ^2 - \left( \left( A+2\right) /4\right) \left( 4X_{1}Z_{1}\right) ^2\bigr \}\bigr ]^2 \\ {}&= Z_{1}\bigl [\bigl ( \left( X_{1}+Z_{1}\right) \left( X_{1}-Z_{1}\right) \bigr )^2\bigl \{2X_{1}\bigr \}-4X_{1}Z_{1}\left( X_{1}-Z_{1}\right) ^2\bigl \{2Z_{1}\bigr \}-\\& \qquad \qquad \qquad \qquad \qquad \qquad \bigl ((A+2)/4\bigr )(4X_{1}Z_{1})^2\bigl \{2Z_{1}\bigr \}\bigr ]^2 \\&=4X_{1}^2Z_{1}\bigl [\bigl (\left( X_{1}+Z_{1}\right) \left( X_{1}-Z_{1}\right) \bigr )^2 - 4Z_{1}^2\left( X_{1}-Z_{1}\right) ^2 - \bigl (\left( A+2\right) /4 \bigr )\left( 16X_{1}Z_{1}^3\right) \bigr ]^2\\&=4X_{1}^2Z_{1}\bigl (\left( X_{1}^2-Z_{1}^2\right) ^2 - \left( X_{1}^2 + Z_{1}^2 + AX_{1}Z_{1}\right) \left( 2Z_{1} \right) ^2\bigr )^2 \end{aligned}$$

Similarly,

$$\begin{aligned} Z_{3} = X_{1}\bigl [&\left( X_{1}-Z_{1}\right) \bigl \{\left( X_{1}+Z_{1}\right) ^2\left( X_{1}-Z_{1}\right) ^2+4X_{1}Z_{1}\left( X_{1}-Z_{1}\right) ^2 + \left( \left( A+2\right) /4\right) \left( 4X_{1}Z_{1}\right) ^2\bigr \} -\\&(X_{1}+Z_{1})\bigl \{\left( X_{1}+Z_{1}\right) ^2\left( X_{1}-Z_{1}\right) ^2-4X_{1}Z_{1}\left( X_{1}-Z_{1}\right) ^2 - \left( \left( A+2\right) /4\right) \left( 4X_{1}Z_{1}\right) ^2\bigr \}\bigr ]^2 \\&= X_{1}\bigl [\bigl ( \left( X_{1}+Z_{1}\right) \left( X_{1}-Z_{1}\right) \bigr )^2\bigl \{-2Z_{1}\bigr \}-4X_{1}Z_{1}\left( X_{1}-Z_{1}\right) ^2\bigl \{2X_{1}\bigr \}-\\& \qquad \qquad \qquad \qquad \qquad \qquad \bigl ((A+2)/4\bigr )(4X_{1}Z_{1})^2\bigl \{2X_{1}\bigr \}\bigr ]^2 \\&=4X_{1}Z_{1}^2\bigl [-\bigl (\left( X_{1}+Z_{1}\right) \left( X_{1}-Z_{1}\right) \bigr )^2 + 4X_{1}^2\left( X_{1}-Z_{1}\right) ^2 + \bigl (\left( A+2\right) /4 \bigr )\left( 16X_{1}^3Z_{1}\right) \bigr ]^2\\&=4X_{1}Z_{1}^2\bigl (-\left( X_{1}^2-Z_{1}^2\right) ^2 + \left( X_{1}^2 + Z_{1}^2 + AX_{1}Z_{1}\right) \left( 2X_{1} \right) ^2\bigr )^2\\&=4X_{1}Z_{1}^2\bigl (\left( X_{1}^2-Z_{1}^2\right) ^2 - \left( X_{1}^2 + Z_{1}^2 + AX_{1}Z_{1}\right) \left( 2X_{1} \right) ^2\bigr )^2 \end{aligned}$$

Dividing both \(X_{3}\) and \(Z_{3}\) by \(4X_{1}Z_{1}\) we get, when \((X_{1}, Y_{1}) \ne (0,0)\)

$$\begin{aligned} X_{3}=X_{1}\bigl (\left( X_{1}^2-Z_{1}^2\right) ^2 - \left( X_{1}^2 + Z_{1}^2 + AX_{1}Z_{1}\right) \left( 2Z_{1} \right) ^2\bigr )^2\\ Z_{3}=Z_{1}\bigl (\left( X_{1}^2-Z_{1}^2\right) ^2 - \left( X_{1}^2 + Z_{1}^2 + AX_{1}Z_{1}\right) \left( 2X_{1} \right) ^2\bigr )^2 \end{aligned}$$

The formulae for \(X_{3}\) and \(Y_{3}\) derived above can be computed using the following algorithm:

$$\begin{aligned} T_{1}&\leftarrow X_{1}; T_{2} \leftarrow Z_{1}\\ T_{1}&\leftarrow T_{1}^2&&(=X_{1}^2)\\ T_{2}&\leftarrow T_{2}^2&&(=Z_{1}^2)\\ T_{3}&\leftarrow (T_{1}-T_{2})^2&&(=(X_{1}^2-Z_{1}^2)^2)\\ T_{4}&\leftarrow X_{1}Z_{1}&&(=X_{1}Z_{1})\\ T_{4}&\leftarrow A.T_{4}&&(=AX_{1}Z_{1})\\ T_{5}&\leftarrow T_{2}+T_{2}+T_{2}+T_{2}&&(=4Z_{1}^2)\\ T_{6}&\leftarrow T_{1}+T_{1}+T_{1}+T_{1}&&(=4X_{1}^2)\\ T_{4}&\leftarrow T_{1}+T_{2}+T_{4}&&(=X_{1}^2+Z_{1}^2+AX_{1}Z_{1})\\ T_{7}&\leftarrow T_{4}.T_{5}&&(=(X_{1}^2+Z_{1}^2+AX_{1}Z_{1})(4Z_{1}^2))\\ T_{8}&\leftarrow T_{4}.T_{6}&&(=(X_{1}^2+Z_{1}^2+AX_{1}Z_{1})(4X_{1}^2))\\ T_{1}&\leftarrow (T_{3}-T_{7})^2&&\bigl (=\bigl (\left( X_{1}^2-Z_{1}^2\right) ^2 - \left( X_{1}^2 + Z_{1}^2 + AX_{1}Z_{1}\right) \left( 2Z_{1} \right) ^2\bigr )^2\bigr )\\ T_{2}&\leftarrow (T_{3}-T_{8})^2&&\bigl (=\bigl (\left( X_{1}^2-Z_{1}^2\right) ^2 - \left( X_{1}^2 + Z_{1}^2 + AX_{1}Z_{1}\right) \left( 2X_{1} \right) ^2\bigr )^2\bigr )\\ X_{3}&\leftarrow X_{1}.T_{1}&&\bigl (=X_{1}\bigl (\left( X_{1}^2-Z_{1}^2\right) ^2 - \left( X_{1}^2 + Z_{1}^2 + AX_{1}Z_{1}\right) \left( 2Z_{1} \right) ^2\bigr )^2 \bigr )\\ Z_{3}&\leftarrow Z_{1}.T_{2}&&\bigl (=Z_{1}\bigl (\left( X_{1}^2-Z_{1}^2\right) ^2 - \left( X_{1}^2 + Z_{1}^2 + AX_{1}Z_{1}\right) \left( 2X_{1} \right) ^2\bigr )^2\bigr ) \end{aligned}$$

C Edwards Curve Quintupling Formulae

Algorithms A and B were verified by the authors in [22]. The only difference between Algorithm C presented in this paper and Algorithm B in [22] is in the computation of R. It was computed in Algorithm B as

$$\begin{aligned} R=((D+E)^2-J-H-I)^2 -2N \end{aligned}$$

In Algorithm C, we employ \(R=2(2JH-L)\) as we can rewrite R as follows:

$$\begin{aligned} R&=\bigg \{\big [(X_{1}^2+Y_{1}^2)+(2Z_{1}^2-(X_{1}^2+Y_{1}^2) \big ]^2 \\&\qquad - \big [2Z_{1}^2 -(X_{1}^2+Y_{1}^2) \big ]^2 -\big [X_{1}^4+Y_{1}^4 \big ] - 2X_{1}^2Y_{1}^2 \bigg \}^2-2N\\&=\big [2(X_{1}^2+Y_{1}^2)(2Z_{1}^2 -(X_{1}^2+Y_{1}^2))\big ]^2\\ {}&\qquad -2\big [(Y_{1}^4-X_{1}^4)^2+4(X_{1}^2Y_{1}^2)\{2Z_{1}^2-(X_{1}^2+Y_{1}^2)\}^2 \big ]\\&= 4\big [2Z_{1}^2-(X_{1}^2+Y_{1}^2) \big ]^2 \big \{X_{1}^4+Y_{1}^4\big \}-2\big [(Y_{1}^4-X_{1}^4)^2 \big ]=4JH-2L=2(2JH-L) \end{aligned}$$

D Three Dimensional Montgomery Ladder Algorithm

figure f

Rights and permissions

Reprints and permissions

Copyright information

© 2016 Springer International Publishing Switzerland

About this paper

Cite this paper

Subramanya Rao, S.R. (2016). Three Dimensional Montgomery Ladder, Differential Point Tripling on Montgomery Curves and Point Quintupling on Weierstrass’ and Edwards Curves. In: Pointcheval, D., Nitaj, A., Rachidi, T. (eds) Progress in Cryptology – AFRICACRYPT 2016. AFRICACRYPT 2016. Lecture Notes in Computer Science(), vol 9646. Springer, Cham. https://doi.org/10.1007/978-3-319-31517-1_5

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-31517-1_5

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-31516-4

  • Online ISBN: 978-3-319-31517-1

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation