Exponent Recoding and Regular Exponentiation Algorithms

Joye, Marc; Tunstall, Michael

doi:10.1007/978-3-642-02384-2_21

Cited by 54 publications

(43 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…One efficient approach in this direction is to recode the scalar to a representation exhibiting a regular pattern. In particular, for the case of variablebase scalar multiplication, the regular windowed recoding proposed by Okeya and Takagi [34] and further analyzed by Joye and Tunstall [25] represents one of the most efficient alternatives. Nevertheless, in comparison with the standard widthw non-adjacent form (wNAF) [21] used in unprotected implementations, the Okeya-Takagi recoding increases the nonzero density from 1/(w + 1) to 1/(w − 1).…”

Section: Side-channel Attacks and Countermeasuresmentioning

confidence: 99%

Efficient and Secure Algorithms for GLV-Based Scalar Multiplication and Their Implementation on GLV-GLS Curves

Faz-Hernández

Longa

Sánchez

2014

Topics in Cryptology – CT-RSA 2014

View full text Add to dashboard Cite

We propose efficient algorithms and formulas that improve the performance of side channel protected elliptic curve computations with special focus on scalar multiplication exploiting the Gallant-Lambert-Vanstone (CRYPTO 2001) and Galbraith-Lin-Scott (EUROCRYPT 2009) methods. Firstly, by adapting Feng et al.'s recoding to the GLV setting, we derive new regular algorithms for variable-base scalar multiplication that offer protection against simple side-channel and timing attacks. Secondly, we propose an efficient, sidechannel protected algorithm for fixed-base scalar multiplication which combines Feng et al.'s recoding with Lim-Lee's comb method. Thirdly, we propose an efficient technique that interleaves ARM and NEON-based multiprecision operations over an extension field to improve performance of GLS curves on modern ARM processors. Finally, we showcase the efficiency of the proposed techniques by implementing a state-of-the-art GLV-GLS curve in twisted Edwards form defined over F p 2 , which supports a four dimensional decomposition of the scalar and is fully protected against timing attacks. Analysis and performance results are reported for modern x64 and ARM processors. For instance, we compute a variable-base scalar multiplication in 89,000 and 244,000 cycles on an Intel Ivy Bridge and an ARM Cortex-A15 processor (respect.); using a precomputed table of 6KB, we compute a fixed-base scalar multiplication in 49,000 and 116,000 cycles (respect.); and using a precomputed table of 3KB, we compute a double scalar multiplication in 115,000 and 285,000 cycles (respect.). The proposed techniques represent an important improvement of the state-ofthe-art performance of elliptic curve computations, and allow us to set new speed records in several modern processors. The techniques also reduce the cost of adding protection against timing attacks in the computation of GLV-based variable-base scalar multiplication to below 10%. This work is the extended version of a publication that appeared at CT-RSA 2014 [12].

show abstract

Section: Side-channel Attacks and Countermeasuresmentioning

confidence: 99%

Efficient and Secure Algorithms for GLV-Based Scalar Multiplication and Their Implementation on GLV-GLS Curves

Faz-Hernández

Longa

Sánchez

2014

Topics in Cryptology – CT-RSA 2014

View full text Add to dashboard Cite

show abstract

“…This gives a strong argument for using regular exponentiation algorithms (see [17] for a summary of this topic) rather than side channel atomic algorithms.…”

Section: Resultsmentioning

confidence: 99%

Using templates to distinguish multiplications from squaring operations

Hanley

Tunstall

Marnane

2011

Int. J. Inf. Secur.

Self Cite

View full text Add to dashboard Cite

Abstract. Since side channel analysis was introduced as a method to recover secret information from an otherwise secure cryptosystem, many countermeasures have been proposed to prevent leakage from secure devices. Among these countermeasures is side channel atomicity that makes operations indistinguishable using side channel analysis. In this paper we present practical results of an attack on RSA signature generation, protected in this manner, based on the expected difference in Hamming weight between the result of a multiplication and a squaring operation. This work presents the first attack that we are aware of where template analysis can be used without requiring an open device to characterize an implementation of a given cryptographic algorithm. Moreover, an attacker does not need to know the plaintexts being operated on and, therefore, blinding and padding countermeasures applied to the plaintext do not hinder the attack in any way.

show abstract

“…This work uses the "(Odd) Signed-Digit Recoding Algorithm" described by Joye and Tunstall [10,Sec. 3…”

Section: Regular Scalar Encodingsmentioning

confidence: 99%

Faster Software for Fast Endomorphisms

Brumley

2015

Constructive Side-Channel Analysis and Secure Design

View full text Add to dashboard Cite

Abstract. GLV curves (Gallant et al.) have performance advantages over standard elliptic curves, using half the number of point doublings for scalar multiplication. Despite their introduction in 2001, implementations of the GLV method have yet to permeate widespread software libraries. Furthermore, side-channel vulnerabilities, specifically cachetiming attacks, remain unpatched in the OpenSSL code base since the first attack in 2009 (Brumley and Hakala) even still after the most recent attack in 2014 (Benger et al.). This work reports on the integration of the GLV method in OpenSSL for curves from 160 to 256 bits, as well as deploying and evaluating two side-channel defenses. Performance gains are up to 51%, and with these improvements GLV curves are now the fastest elliptic curves in OpenSSL for these bit sizes.

show abstract

Exponent Recoding and Regular Exponentiation Algorithms

Cited by 54 publications

References 28 publications

Efficient and Secure Algorithms for GLV-Based Scalar Multiplication and Their Implementation on GLV-GLS Curves

Efficient and Secure Algorithms for GLV-Based Scalar Multiplication and Their Implementation on GLV-GLS Curves

Using templates to distinguish multiplications from squaring operations

Faster Software for Fast Endomorphisms

Contact Info

Product

Resources

About