Differential Addition in Generalized Edwards Coordinates

Justus, Benjamin; Loebenberger, Daniel

doi:10.1007/978-3-642-16825-3_21

Cited by 10 publications

(7 citation statements)

References 12 publications

(12 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This is the case since one can use large window sizes when computing the scalar multiplication with twisted Edwards curves: something which is not possible with the differential addition law of Montgomery curves (see Section 2.2 and the counts in Table 1). We are aware of the y-only efficient differential formulas for twisted Edwards curves (see [26], [14], [32]) and their potential application to SIDH [44] but since these are comparatively slower than the differential addition law of Montgomery curves and our addition-subtraction chains do not work 11M + 7S 7.00 Montgomery septuple 715M + 9S 7.75 twisted Edwards double (2) 4M + 4S 7.01 twisted Edwards triple 310M + 3S 7.73 twisted Edwards quantuple 518M + 8S 10.34 twisted Edwards septuple 725M + 7S 10.42…”

Section: Addition-subtraction Chainsmentioning

confidence: 99%

Arithmetic Considerations for Isogeny-Based Cryptography

Bos

Friedberger

2019

IEEE Trans. Comput.

View full text Add to dashboard Cite

In this paper we investigate various arithmetic techniques which can be used to potentially enhance the performance in the supersingular isogeny Diffie-Hellman (SIDH) key-exchange protocol which is one of the more recent contenders in the post-quantum public-key arena. Firstly, we give a systematic overview of techniques to compute efficient arithmetic modulo 2 x p y ± 1. Our overview shows that in the SIDH setting, where arithmetic over a quadratic extension field is required, the approaches based on Montgomery reduction for such primes of a special shape are to be preferred. Moreover, the outcome of our investigation reveals that there exist moduli which allow even faster implementations. Secondly, we investigate if it is beneficial to use other curve models to speed-up the elliptic curve scalar multiplication. The use of twisted Edwards curves allows one to search for efficient addition-subtraction chains for fixed scalars while this is not possible with the differential addition law when using Montgomery curves. Our preliminary results show that despite the fact that we found such efficient chains, using twisted Edwards curves does not result in faster scalar multiplication arithmetic in the setting of SIDH.

show abstract

Section: Addition-subtraction Chainsmentioning

confidence: 99%

Arithmetic Considerations for Isogeny-Based Cryptography

Bos

Friedberger

2019

IEEE Trans. Comput.

View full text Add to dashboard Cite

show abstract

“…Denoted by nP, where n is the secret key (scalar) and P a point on the elliptic curve, the scalar multiplication, the most fundamental and time consuming operation of elliptic curve cryptosystem, has been the subject of intense research [2][3][4].…”

Section: Introductionmentioning

confidence: 99%

Optimized Approach for Computing Multi-base Chains

Yin

Yang

Ning

2011

2011 Seventh International Conference on Computational Intelligence and Security

View full text Add to dashboard Cite

As a generalization of double base chains, multi-base number system were very suitable for efficient computation of scalar multiplications of elliptic curves because of shorter representation length and less Hamming weight. Thus it is needed to search efficient multi-base chains. We considered settings with different computing cost of point operations and introduced an optimized tree-based method for searching multi-base chains. Experimental results show that compared with NAF, greedy algorithm and tree based computing double base chain method, applying the multi-base representation returned by our proposed algorithms, the scalar computing costs reduced by 22%, 12.9%, 10.6% respectively on prime elliptic curves and 20.2%, 11.5%, 9.7% on binary elliptic curves.

show abstract

“…We derive the above proposition from Theorem 2 of [1] (specialized to the case c = 1). The theorem allows one to express the affine x-coordinate of [n]P in terms of the coordinates of the points P, [n]P, [n + 1]P .…”

Section: Decompression Typementioning

confidence: 99%

“…This question is investigated in [9] for Montgomery curves, and [1] for Edwards curves. Let [n]P be the n-fold of a point P on a curve.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Point Compression and Coordinate Recovery for Edwards Curves over Finite Field

Justus¹

2014

Annals of West University of Timisoara - Mathematics

Self Cite

View full text Add to dashboard Cite

Abstract. We present two computational approaches for the purpose of point compression and decompression on Edwards curves over the finite field F p where p is an odd prime. The proposed algorithms allow compression and decompression for the x or y affine coordinates. We also present a x-coordinate recovery algorithm that can be used at any stage of a differential addition chain during the scalar multiplication of a point on the Edwards curve.

show abstract

Differential Addition in Generalized Edwards Coordinates

Cited by 10 publications

References 12 publications

Arithmetic Considerations for Isogeny-Based Cryptography

Arithmetic Considerations for Isogeny-Based Cryptography

Optimized Approach for Computing Multi-base Chains

Point Compression and Coordinate Recovery for Edwards Curves over Finite Field

Contact Info

Product

Resources

About