Comparing Elliptic Curve Cryptography and RSA on 8-bit CPUs

Abstract

Abstract. Strong public-key cryptography is often considered to be too computationally expensive for small devices if not accelerated by cryptographic hardware. We revisited this statement and implemented elliptic curve point multiplication for 160-bit, 192-bit, and 224-bit NIST/SECG curves over GF(p) and RSA-1024 and RSA-2048 on two 8-bit microcontrollers. To accelerate multiple-precision multiplication, we propose a new algorithm to reduce the number of memory accesses. Implementation and analysis led to three observations: 1. Public-key cryptography is viable on small devices without hardware acceleration. On an Atmel ATmega128 at 8 MHz we measured 0.81s for 160-bit ECC point multiplication and 0.43s for a RSA-1024 operation with exponent e = 2 16 + 1. 2. The relative performance advantage of ECC point multiplication over RSA modular exponentiation increases with the decrease in processor word size and the increase in key size. 3. Elliptic curves over fields using pseudo-Mersenne primes as standardized by NIST and SECG allow for high performance implementations and show no performance disadvantage over optimal extension fields or prime fields selected specifically for a particular processor architecture.

Hardware/Software Co-design of Elliptic Curve Cryptography on an 8051 Microcontroller

“…Also our code size is considerable smaller, which directly translates into savings in silicon area when the program code is stored in on-chip ROM. [12] 8051 (CC1010) ECC 160 bit GF(p) 14.74 4,580.0 67.53M Gura [12] 8051 (CC1010) ECC 192 bit GF(p) 14.74 7,560.0 111.48M Gura [12] AVR (ATmega128) ECC 160 bit GF(p) 8.00 810.0 6.48M Gura [12] AVR ( …”

“…Recent research has shown that highly-optimized software implementations can reach sub-second performance on the ATmega128 [12], but not on a standard 8051 microcontroller, at least not if the order of the finite field is 160 bits or more [12,16,24]. The main reason is the rather poor performance of a standard 8051 in relation to the ATmega128 (see Appendix A).…”

“…Elliptic curve cryptography (ECC) is highly computation-intensive as it involves arithmetic operations in finite fields of large order (typically about 160 bits) [3]. The results from previous work [12,16,24] show that a "pure" software implementation of ECC does not allow to reach sub-second performance on a standard 8051 clocked at 12 MHz. Therefore, some kind of hardware acceleration of the performance-critical operations carried out in ECC is necessary.…”

A survey of secure middleware for the Internet of Things

“…Performing public key encryption on 8-bit microcontrollers has been enhanced by the use of Elliptic Curve Cryptography (ECC) (Koblitz, 1987;Miller, 1986). ECC reduces the time and power requirements for the same level of encryption as an equivalent Rivest, Shamir, and Adleman public key cryptography (RSA) public-key encryption (Rivest, Shamir & Adleman, 1978) by an order of magnitude (Gura et al, 2004;Sethi, Arkko & Keranen, 2012): RSA encryption on constrained 8-bit microcontrollers may take minutes to complete, whereas similar ECC-based cryptography completes in seconds. However, despite the fact that ECC enables 8-bit microcontrollers to participate in public-key encryption systems, in many cases it is not used.…”

Reverse Product-Scanning Multiplication and Squaring on 8-Bit AVR Processors

“…At CHES 2004, Gura et al presented a landmark paper in which they compared ECC with RSA on 8-bit CPUs and introduced the now-classical hybrid method for multiplication [9]. The hybrid method exploits the large register file of the AVR platform to store several bytes of the operands in registers and, in this way, combines the advantages of the product scanning and operand scanning technique [10].…”