Efficient Pairings and ECC for Embedded Systems

Abstract

Abstract. The research on pairing-based cryptography brought forth a wide range of protocols interesting for future embedded applications. One significant obstacle for the widespread deployment of pairing-based cryptography are its tremendous hardware and software requirements. In this paper we present three side-channel protected hardware/software designs for pairing-based cryptography yet small and practically fast: our plain ARM Cortex-M0+-based design computes a pairing in less than one second. The utilization of a multiply-accumulate instructionset extension or a light-weight drop-in hardware accelerator that is placed between CPU and data memory improves runtime up to six times. With a 10.1 kGE large drop-in module and a 49 kGE large platform, our design is one of the smallest pairing designs available. Its very practical runtime of 162 ms for one pairing on a 254-bit BN curve and its reusability for other elliptic-curve based crypto systems offer a great solution for every microprocessor-based embedded application.

Black-Box Wallets: Fast Anonymous Two-Way Payments for Constrained Devices

“…Furthermore, as these estimations are solely based on the number of point multiplications, execution times of concrete instantiations would be higher due to the remaining computations and I/O. The dedicated coprocessor by Unterluggauer and Wenger [36] takes 23 ms for a multiplication on Curve25519. On a Mul-tOS 4.3.1 card, point multiplication on ≈250 bit curves takes 61 ms [18].…”

“…Note that a modern smartphone represents a particularly strong device in embedded computing. To obtain performance estimations for smart cards (or other low-end micro controllers), we count the number of multiplications done and estimate the execution time based on the performance of a dedicated ECC coprocessor [36] and the MultOS card. Note that this coprocessor was designed for fast pairing execution and was thus optimized for Barreto-Naehrig (BN) curves.…”

“…Unfortunately, the instantiation of BBA+ given in [21] comes with some drawbacks: one is its reliance on Groth-Sahai zero-knowledge proofs [20], which require a large amount of computations in pairing groups and all other building blocks to also work in this setting. This leads to slow performance on weak hardware and makes it unsuited for usage on smart cards, where even with a dedicated co-processor for pairing-based operations [36], evaluation of a pairing takes about 160 ms and multiplication in G 2 about 100 ms (for the Fp254BNb and Fp254n2BNb curves). For point collection/redemption the user has to compute ≈ 100 multiplications in G 2 alone, which already takes 10 s.…”

Secure vehicle traffic data dissemination and analysis protocol in vehicular cloud computing

“…We evaluate the computational overhead of the proposed protocol and compare our protocol with Hussain et al's protocol [14] and ECDSA [4]. We consider the implementation parameters in [33] with embedding degree 6, with {G, q} represented by 161 bits and 160 bits, respectively. The obtained results are shown in Table 4.…”

A Secure and Portable Multi-Sensor Module for Distributed Air Pollution Monitoring

“…We also rely on less standardized cryptographic blocks: We use as group signature the Boneh-Boyen-Sacham short group signature [27], which builds upon bilinear pairings. In particular, for the group signature we use the implementation made available by [46]. The rest of the cryptographic implementations come from standard cryptographic libraries that were available on our platforms and are referenced in the implementation-related section.…”