Skip to main content

Fast Scalar Multiplication for Elliptic Curves over Binary Fields by Efficiently Computable Formulas

  • Conference paper
  • First Online:
Progress in Cryptology – INDOCRYPT 2017 (INDOCRYPT 2017)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 10698))

Included in the following conference series:

Abstract

This paper considers efficient scalar multiplication of elliptic curves over binary fields with a twofold purpose. Firstly, we derive the most efficient 3P formula in \(\lambda \)-projective coordinates and 5P formula in both affine and \(\lambda \)-projective coordinates. Secondly, extensive experiments have been conducted to test various multi-base scalar multiplication methods (e.g., greedy, ternary/binary, multi-base NAF, and tree-based) by integrating our fast formulas. The experiments show that our 3P and 5P formulas had an important role in speeding up the greedy, the ternary/binary, the multi-base NAF, and the tree-based methods over the NAF method. We also establish an efficient 3P formula for Koblitz curves and use it to construct an improved set for the optimal pre-computation of window TNAF.

Research supported in part by the National 973 Project of China (No. 2013CB834205).

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Avanzi, R.M., Cohen, H., Doche, C., Frey, G., Nguyen, K., Lange, T., Vercauteren, F.: Handbook of Elliptic and Hyperelliptic Curve Cryptography. Chapman & Hall/CRC, Boca Raton (2005)

    MATH  Google Scholar 

  2. Bernstein, D.J., Birkner, P., Lange, T., Peters, C.: Optimizing double-base elliptic-curve single-scalar multiplication. In: Srinathan, K., Rangan, C.P., Yung, M. (eds.) INDOCRYPT 2007. LNCS, vol. 4859, pp. 167–182. Springer, Heidelberg (2007). https://doi.org/10.1007/978-3-540-77026-8_13

    Chapter  Google Scholar 

  3. Berthé, V., Imbert, L.: On converting numbers to the double-base number system. In: Advanced Signal Processing Algorithms, Architecture and Implementations XIV, vol. 5559, pp. 70–78 (2004)

    Google Scholar 

  4. Blake, I.F., Murty, V.K., Xu, G.: A note on window \(\tau \)-NAF algorithm. Inf. Process. Lett. 95(5), 496–502 (2005)

    Article  MathSciNet  MATH  Google Scholar 

  5. Blake, I.F., Murty, V.K., Xu, G.: Nonadjacent radix-\(\tau \) expansions of integers in euclidean imaginary quadratic number fields. Can. J. Math. 60, 1267–1282 (2008)

    Article  MathSciNet  MATH  Google Scholar 

  6. Blake, I.F., Seroussi, G., Smart, N.P.: Elliptic Curves in Cryptography. Cambridge University Press, Cambridge (1999)

    Book  MATH  Google Scholar 

  7. Ciet, M., Joye, M., Lauter, K., Montgomery, P.L.: Trading inversions for multiplications in elliptic curve cryptography. Desi. Codes Cryptogr. 39(2), 189–206 (2006)

    Article  MathSciNet  MATH  Google Scholar 

  8. Dimitrov, V., Imbert, L., Mishra, P.K.: The double-base number system and its application to elliptic curve cryptography. Math. Comput. 77(262), 1075–1104 (2008)

    Article  MathSciNet  MATH  Google Scholar 

  9. Doche, C.: On the enumeration of double-base chains with applications to elliptic curve cryptography. In: Sarkar, P., Iwata, T. (eds.) ASIACRYPT 2014. LNCS, vol. 8873, pp. 297–316. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-662-45611-8_16

    Google Scholar 

  10. Doche, C., Habsieger, L.: A tree-based approach for computing double-base chains. In: Mu, Y., Susilo, W., Seberry, J. (eds.) ACISP 2008. LNCS, vol. 5107, pp. 433–446. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-70500-0_32

    Chapter  Google Scholar 

  11. Doche, C., Imbert, L.: Extended double-base number system with applications to elliptic curve cryptography. In: Barua, R., Lange, T. (eds.) INDOCRYPT 2006. LNCS, vol. 4329, pp. 335–348. Springer, Heidelberg (2006). https://doi.org/10.1007/11941378_24

    Chapter  Google Scholar 

  12. Doche, C., Kohel, D.R., Sica, F.: Double-base number system for multi-scalar multiplications. In: Joux, A. (ed.) EUROCRYPT 2009. LNCS, vol. 5479, pp. 502–517. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-01001-9_29

    Chapter  Google Scholar 

  13. Galbraith, S.D., Lin, X., Scott, M.: Endomorphisms for faster elliptic curve cryptography on a large class of curves. In: Joux, A. (ed.) EUROCRYPT 2009. LNCS, vol. 5479, pp. 518–535. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-01001-9_30

    Chapter  Google Scholar 

  14. Gallant, R.P., Lambert, R.J., Vanstone, S.A.: Faster point multiplication on elliptic curves with efficient endomorphisms. In: Kilian, J. (ed.) CRYPTO 2001. LNCS, vol. 2139, pp. 190–200. Springer, Heidelberg (2001). https://doi.org/10.1007/3-540-44647-8_11

    Chapter  Google Scholar 

  15. Hankerson, D., Karabina, K., Menezes, A.: Analyzing the Galbraith-Lin-Scott point multiplication method for elliptic curves over binary fields. IEEE Trans. Comput. 58(10), 1411–1420 (2009)

    Article  MathSciNet  MATH  Google Scholar 

  16. Hankerson, D., López Hernandez, J., Menezes, A.: Software implementation of elliptic curve cryptography over binary fields. In: Koç, Ç.K., Paar, C. (eds.) CHES 2000. LNCS, vol. 1965, pp. 1–24. Springer, Heidelberg (2000). https://doi.org/10.1007/3-540-44499-8_1

    Chapter  Google Scholar 

  17. Hankerson, D., Menezes, A., Vanstone, S.: Guide to Elliptic Curve Cryptography. Springer, New York (2004). https://doi.org/10.1007/b97644

    MATH  Google Scholar 

  18. Koblitz, N.: CM-curves with good cryptographic properties. In: Feigenbaum, J. (ed.) CRYPTO 1991. LNCS, vol. 576, pp. 279–287. Springer, Heidelberg (1992). https://doi.org/10.1007/3-540-46766-1_22

    Google Scholar 

  19. Koblitz, N.: Elliptic curve cryptosystems. Math. Computat. 48(177), 203–209 (1987)

    Article  MathSciNet  MATH  Google Scholar 

  20. Lange, T.: A note on López-Dahab coordinates. Cryptology ePrint Archive, Report 2004/323 (2004). https://eprint.iacr.org

  21. Lenstra, A., Verheul, E.: Selecting cryptographic key sizes. J. Cryptol. 14, 255–293 (2001)

    Article  MathSciNet  MATH  Google Scholar 

  22. Longa, P.: Accelerating the scalar multiplication on elliptic curve cryptosystems over prime fields. Cryptology ePrint Archive, Report 2008/100 (2008). https://eprint.iacr.org

  23. Longa, P., Gebotys, C.: Fast multibase methods and other several optimizations for elliptic curve scalar multiplication. In: Jarecki, S., Tsudik, G. (eds.) PKC 2009. LNCS, vol. 5443, pp. 443–462. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-00468-1_25

    Chapter  Google Scholar 

  24. López, J., Dahab, R.: Improved algorithms for elliptic curve arithmetic in GF(2n). In: Tavares, S., Meijer, H. (eds.) SAC 1998. LNCS, vol. 1556, pp. 201–212. Springer, Heidelberg (1999). https://doi.org/10.1007/3-540-48892-8_16

    Chapter  Google Scholar 

  25. Méloni, N., Hasan, M.: Efficient double bases for scalar multiplication. IEEE Trans. Comput. 64, 2204–2212 (2015)

    Article  MathSciNet  MATH  Google Scholar 

  26. Miller, V.S.: Use of elliptic curves in cryptography. In: Williams, H.C. (ed.) CRYPTO 1985. LNCS, vol. 218, pp. 417–426. Springer, Heidelberg (1986). https://doi.org/10.1007/3-540-39799-X_31

    Google Scholar 

  27. Mishra, P.K., Dimitrov, V.: Efficient quintuple formulas for elliptic curves and efficient scalar multiplication using multibase number representation. In: Garay, J.A., Lenstra, A.K., Mambo, M., Peralta, R. (eds.) ISC 2007. LNCS, vol. 4779, pp. 390–406. Springer, Heidelberg (2007). https://doi.org/10.1007/978-3-540-75496-1_26

    Chapter  Google Scholar 

  28. Oliveira, T., López, J., Aranha, D.F., Rodriguez-Henriquez, F.: Two is the fastest prime: lambda coordinates for binary elliptic curves. J. Cryptogr. Eng. 4(1), 3–17 (2014)

    Article  Google Scholar 

  29. Solinas, J.A.: Efficient arithmetic on Koblitz curves. Des. Codes Cryptogr. 19(2–3), 195–249 (2000)

    Article  MathSciNet  MATH  Google Scholar 

  30. Trost, W., Xu, G.: On the optimal pre-computation of window tNAF for Koblitz curves. IEEE Trans. Comput. 65, 2918–2924 (2016)

    Article  MathSciNet  MATH  Google Scholar 

  31. Yasin, S., Muda, Z.: Tripling formulae of elliptic curve over binary field in Lopez-Dahab model. J. Theor. Appl. Inf. Technol. 75(2), 212–217 (2015)

    Google Scholar 

  32. Yu, W., Kim, K.H., Jo, M.S.: New fast algorithms for elliptic curve arithmetic in affine coordinates. In: Tanaka, K., Suga, Y. (eds.) IWSEC 2015. LNCS, vol. 9241, pp. 56–64. Springer, Cham (2015). https://doi.org/10.1007/978-3-319-22425-1_4

    Chapter  Google Scholar 

  33. Yu, W., Wang, K., Li, B., Tian, S.: Triple-base number system for scalar multiplication. In: Youssef, A., Nitaj, A., Hassanien, A.E. (eds.) AFRICACRYPT 2013. LNCS, vol. 7918, pp. 433–451. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-38553-7_26

    Chapter  Google Scholar 

  34. Digital Signature Standard (DSS): FIPS PUB. 186–4 (2013)

    Google Scholar 

  35. The GNU Multiple Precision Arithmetic Library. http://www.gmplib.org

Download references

Author information

Authors and Affiliations

Authors

Corresponding author

Correspondence to Guangwu Xu .

Editor information

Editors and Affiliations

A Appendix: Proofs

A Appendix: Proofs

1.1 A.1 Theorem 1

Proof

Let \(P=(x_P,y_P)\in E({\mathbb F}_{2^m})\) and \(6P\ne \mathcal{O}\). Otherwise, if \(6P = \mathcal{O}\) then \(5P = -P\). We shall prove Theorem 1 by the fact

$$ (x_{5P},\lambda _{5P})= (x_{2P},\lambda _{2P})+(x_{3P},\lambda _{3P}). $$

By using the \(P+Q\) \(\lambda \)-affine formula given in [28], we have

$$\begin{aligned} x_{5P} = \frac{x_{3P} x_{2P}}{(x_{3P}+ x_{2P})^2} (\lambda _{3P}+\lambda _{2P}) . \end{aligned}$$
(3)
$$\begin{aligned} \lambda _{5P} = \frac{x_{3P} (x_{5P} + x_{2P})^2}{x_{5P} x_{2P}} + \lambda _{2P}+ 1. \end{aligned}$$
(4)

We apply \(x_{3P}=x_P+\frac{x_P^3}{\alpha }+\big (\frac{x_P^3}{\alpha }\big )^2\) and \( x_{2P} = \frac{x_P^4+b}{x_P^2} \) in Eq. (3). We have

$$\begin{aligned} x_{5P}&= \frac{x_P^3(\alpha ^2+x_P^2(x_P^4+b)) \alpha ^2 (x_P^4+b)}{ \big ( \alpha ^2 (x_P^4+b) + x_P^3(\alpha ^2+x_P^2(x_P^4+b))\big )^2} (\lambda _{3P}+\lambda _{2P}) \end{aligned}$$
(5)
$$\begin{aligned}&=\frac{x_P^3 \beta \alpha ^2 (x_P^4+b) }{\gamma ^2} (\lambda _{3P}+\lambda _{2P}) \end{aligned}$$
(6)

We note that

$$\begin{aligned} \lambda _{3P}+\lambda _{2P} = \frac{x_P \gamma ^2}{x_P^3 \beta \alpha ^2 (x_P^4+b)}+1. \end{aligned}$$
(7)

By applying Eq. (7) in Eq. (6), we have

$$\begin{aligned} x_{5P}&= x_P + \frac{x_P^3 \beta \alpha ^2 (x_P^4+b) }{\gamma ^2} \end{aligned}$$
(8)
$$\begin{aligned}&= x_P + \frac{x_P^3 \beta }{\gamma }+\big (\frac{x_P^3 \beta }{\gamma }\big )^2 . \end{aligned}$$
(9)

We have derived \( x_{5P}\). Next, we want to derive \( y_{5P}\). From Eq. (4), we have

$$\begin{aligned} \lambda _{5P} = \frac{x_{3P}}{x_{2P}} x_{5P} + \frac{x_{3P} x_{2P}}{x_{5P}} + \lambda _{2P} +1 . \end{aligned}$$
(10)

We apply Eq. (10) to the fact \( y_{5P} = x_{5P} (\lambda _{5P} + x_{5P}) \). We have

$$\begin{aligned} y_{5P} = x_{5P} ( \frac{x_{3P}}{x_{2P}} x_{5P}+\lambda _{2P} +1+ x_{5P}) + x_{3P} x_{2P} . \end{aligned}$$
(11)

We apply \( x_{3P} , x_{2P} \), and \( \lambda _{2P}= \frac{x_P^4}{x_P^4+b}+\lambda _P^2+a+1\) in Eq. (11). We have

$$\begin{aligned} y_{5P}&= x_{5P} \big ( \frac{x_P^3 \beta }{\alpha ^2(x_P^4+b)} x_{5P} + \frac{x_P^4}{x_P^4+b} + \frac{y_P^2}{x_P^2} + x_P^2+a+x_{5P} \big ) + \frac{(x_P^4+b) \beta }{x_P \alpha ^2}\\&= x_{5P} \big ( \big (\frac{x_P^3 \beta }{\gamma } \big )^2 + x_P^2+a+x_{5P} \big ) + \frac{(x_P^4+b) \beta }{x_P \alpha ^2} + \frac{ x_P^4 \beta }{\alpha ^2 (x_P^4+b) } x_{5P}\\ {}&\quad + \frac{ x_P^6 + y_P^2 (x_P^4+b)}{x_P^2 (x_P^4+b) } x_{5P}\\&= y_P + x_P + (x_{5P}+x_P) \big ( \big (\frac{x_P^3 \beta }{\gamma } \big )^2 + x_P^2+a+x_{5P}+x_P \big )\\ {}&\quad + \frac{x_P \beta \alpha ^2(x_P^6 + y_P^2(x_P^4+b))}{\gamma ^2} . \end{aligned}$$

We note that \( x_P^6= \beta + (x_P^4+b)^2 + x_P^2(x_P^4+b) \) and \( \big (\frac{x_P^3 \beta }{\gamma } \big )^2 = \frac{x_P^3 \beta }{\gamma } + x_{5P} + x_P\). We have

$$\begin{aligned} \begin{array}{l} y_{5P} = y_P + x_P + (x_{5P}+x_P) \big (\frac{x_P^3 \beta }{\gamma } + x_P^2+a \big ) + \frac{x_P \beta \alpha ^2(\beta +(x_P^4+b)(x_P^4+b+y_P^2+x_P^2))}{\gamma ^2}. \end{array} \end{aligned}$$

1.2 A.2 Theorem 2

Proof

We shall prove Theorem 2 by the fact

$$\begin{aligned} (x_{3P},\lambda _{3P}) = (x_P,\lambda _P) + (x_{2P},\lambda _{2P}) . \end{aligned}$$
(12)

By using the \(P+Q\) \(\lambda \)-affine formula given in [28], we have

$$\begin{aligned} x_{3P}=\frac{x_P x_{2P}}{(x_P+x_{2P})^2} (\lambda _P + \lambda _{2P}). \end{aligned}$$
(13)
$$\begin{aligned} \lambda _{3P} = \frac{x_{2P} (x_{3P}+x_P)^2}{x_{3P} x_P}+\lambda _P+1. \end{aligned}$$
(14)

We apply the relation \(\lambda _P + \lambda _{2P}= \frac{ (x_P+x_{2P})^2}{x_{2P}}+ 1\) in Eq. (13). We have

$$\begin{aligned} x_{3P}= & {} x_P + \frac{x_P x_{2P}}{(x_P+x_{2P})^2} \end{aligned}$$
(15)
$$\begin{aligned}= & {} \frac{x_P \big (x_{2P} + (x_{2P} +x_P)^2 \big )}{(x_P+x_{2P})^2}. \end{aligned}$$
(16)

We convert \(\lambda \)-affine point \((x_P,\lambda _P)\) to \(\lambda \)-projective point \((X_P,L_P,Z_P)\) by using the relation \((x_P,\lambda _P)=(\frac{X_P}{Z_P},\frac{L_P}{Z_P})\). Thus, the equations above become

$$\begin{aligned} x_{2P}&= \frac{L_P^2+L_P Z_P+a Z^2}{Z_P^2} = \frac{T}{Z_P^2}. \end{aligned}$$
$$\begin{aligned} x_{3P}&= \frac{ \frac{X_P}{Z_P} \big (\frac{T}{Z_P^2} + \frac{(T + X_P Z_P)^2}{Z_P^4} \big ) }{\frac{(T + X_P Z_P)^2}{Z_P^4}} \\&= \frac{X_P \big (T Z_P^2 + (T + X_P Z_P)^2 \big )}{Z_P (T + X_P Z_P)^2} \\&= \frac{X_P B}{Z_P A} .\\ \lambda _{3P}&= \frac{ \frac{T}{Z_P^2} \big (\frac{X_P B}{Z_P A} + \frac{X_P}{Z_P} \big )^2 }{\frac{X_P^2 B}{Z_P^2 A}} + \frac{L_P Z_P+Z_P^2}{Z_P^2} \\&= \frac{T (A+B)^2}{Z_P^2 A B} + \frac{L_P Z_P+ Z_P^2}{Z_P^2}\\&= \frac{T (A+B)^2 + (L_P Z_P+Z_P^2) A B }{Z_P^2 A B}. \end{aligned}$$

1.3 A.3 Theorem 3

Proof

We shall proof \(x_{5P}\) by the fact

$$ (x_{5P},\lambda _{5P}) = (x_{2P},\lambda _{2P}) + (x_{3P},\lambda _{3P}). $$

By using the \(P+Q\) \(\lambda \)-affine formula given in [28], we have

$$\begin{aligned} x_{5P}=\frac{x_{2P} x_{3P}}{(x_{2P}+x_{3P})^2} (\lambda _{2P} + \lambda _{3P}). \end{aligned}$$
(17)

We apply the relation \(\lambda _{2P} + \lambda _{3P}= \frac{ x_P (x_{2P}+x_{3P})^2}{x_{2P} x_{3P}}+ 1\) to Eq. (17). We have

$$\begin{aligned} x_{5P}= & {} x_P + \frac{x_{2P} x_{3P}}{(x_{2P}+x_{3P})^2} \end{aligned}$$
(18)
$$\begin{aligned}= & {} \frac{x_{P} (x_{2P}+x_{3P})^2 + x_{2P} x_{3P} }{(x_{2P}+x_{3P})^2}. \end{aligned}$$
(19)

Next, we shall derive \(\lambda _{5P}\) by the fact

$$ (x_{5P},\lambda _{5P}) = (x_{P},\lambda _{P}) + (x_{4P},\lambda _{4P}). $$

By using the \(P+Q\) \(\lambda \)-affine formula, we have

$$\begin{aligned} \lambda _{5P} = \frac{x_{4P} (x_{5P}+x_P)^2}{x_{5P} x_P}+\lambda _P+1. \end{aligned}$$
(20)

We convert \(\lambda \)-affine point \((x_P,\lambda _P)\) to \(\lambda \)-projective point \((X_P,L_P,Z_P)\) by using the relation \((x_P,\lambda _P)=(\frac{X_P}{Z_P},\frac{L_P}{Z_P})\). Thus, the equations above become

$$\begin{aligned} x_{2P}&= \frac{L_P^2+L_P Z_P+a Z^2}{Z_P^2} = \frac{T}{Z_P^2}. \\ x_{3P}&= \frac{X_P \big (T Z_P^2 + (T + X_P Z_P)^2 \big )}{Z_P (T + X_P Z_P)^2} = \frac{X_P B}{Z_P A} .\\ x_{4P}&= \frac{L_{2P}^2+L_{2P} T Z_P^2+a (T Z^2)^2}{(T Z_P^2)^2} = \frac{T_2}{(T Z_P^2)^2}. \\ x_{5P}&= \frac{ \frac{X_P}{Z_P} \big (\frac{T}{Z_P^2} + \frac{X_{P} B}{Z_P A} \big )^2 + \frac{T X_P B}{Z_P^3 A} }{{(\frac{T}{Z_P^2} + \frac{X_{P} B}{Z_P A})^2}} \\&= \frac{X_P \big ( (TA + X_P Z_P B )^2 + T Z_P^2 A B \big )}{Z_P (TA + X_P Z_P B )^2} \\&= \frac{X_P D}{Z_P C} .\\ \lambda _{5P}&= \frac{ \frac{T_2}{(T Z_P^2)^2} \big (\frac{X_P D}{Z_P C} + \frac{X_P}{Z_P} \big )^2 }{\frac{X_P^2 D}{Z_P^2 C}} + \frac{L_P Z_P+Z_P^2}{Z_P^2} \\&= \frac{T_2 (C+D)^2}{(T Z_P^2)^2 C D} + \frac{L_P Z_P+ Z_P^2}{Z_P^2}\\&= \frac{Z^2 T_2 (AB)^2 + (L_P Z_P+Z_P^2) CD }{Z_P^2 C D}. \end{aligned}$$

We note the following relations

$$\begin{aligned} Z_P^2 T_2= & {} T (A+B)^2 + Z_P^2 A B. \\ C= & {} (TA + X_P Z_P B )^2 = (T (A+B))^2 + A B^2. \\ D= & {} T Z_P^2 A B + C =A^2 B + A B^2 + C. \end{aligned}$$

Thus, we have

$$\begin{aligned} L_{5P} = T (C + D)^2 + (L_P Z_P + Z_P^2) C D + Z_P^2 (A B)^3. \end{aligned}$$

Rights and permissions

Reprints and permissions

Copyright information

© 2017 Springer International Publishing AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Al Musa, S., Xu, G. (2017). Fast Scalar Multiplication for Elliptic Curves over Binary Fields by Efficiently Computable Formulas. In: Patra, A., Smart, N. (eds) Progress in Cryptology – INDOCRYPT 2017. INDOCRYPT 2017. Lecture Notes in Computer Science(), vol 10698. Springer, Cham. https://doi.org/10.1007/978-3-319-71667-1_11

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-71667-1_11

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-71666-4

  • Online ISBN: 978-3-319-71667-1

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics