Extending Scalar Multiplication Using Double Bases

Abstract

Abstract. It has been recently acknowledged [4,6,9] that the use of double bases representations of scalars n, that is an expression of the form n = È e,s,t (−1) e A s B t can speed up significantly scalar multiplication on those elliptic curves where multiplication by one base (say B) is fast. This is the case in particular of Koblitz curves and supersingular curves, where scalar multiplication can now be achieved in o(log n) curve additions. Previous literature dealt basically with supersingular curves (in characteristic 3, although the methods can be easily extended to arbitrary characteristic), where A, B ∈ N. Only [4] attempted to provide a similar method for Koblitz curves, where at least one base must be non-real, although their method does not seem practical for cryptographic sizes (it is only asymptotic), since the constants involved are too large. We provide here a unifying theory by proposing an alternate recoding algorithm which works in all cases with optimal constants. Furthermore, it can also solve the until now untreatable case where both A and B are nonreal. The resulting scalar multiplication method is then compared to standard methods for Koblitz curves. It runs in less than log n/ log log n elliptic curve additions, and is faster than any given method with similar storage requirements already on the curve K-163, with larger improvements as the size of the curve increases, surpassing 50% with respect to the τ -NAF for the curves K-409 and K-571. With respect of windowed methods, that can approach our speed but require O(log(n)/ log log(n)) precomputations for optimal parameters, we offer the advantage of a fixed, small memory footprint, as we need storage for at most two additional points.

The double-base number system and its application to elliptic curve cryptography

“…k ) be the m-th solution of (3). By substituting each h (m) i into (3) with its (unique) binary representation, we obtain a specific partition of n as the sum of numbers of the form…”

“…Note also that the TA A operation for computing [3]P ± Q is only used in step 6, when u i = 0. Another approach of similar cost is to start with all the quadruplings plus one possible doubling when u i is odd, and then perform v i − 1 triplings followed by one final triple-and-add.…”

“…For completeness, we also give the operation counts for a recent ternary/binary algorithm presented in [12], which is based on the following recursive decomposition: if n ≡ 0 or 3 (mod 6), return [3]([n/3]P ); if n ≡ 2 or 4 (mod 6), return [2]([k/2]P ); if n ≡ 1 (mod 6), i.e., n = 6m + 1, return [2]([3m]P ) + P ; if n ≡ 5 (mod 6), i.e., n = 6m − 1, return [2]([3m]P ) − P . The recursion stops whenever n = 1 and returns P .…”

“…Methods based on efficiently computable endomorphisms on special curves, such as Koblitz curves, are also very attractive. Since the original submission of this manuscript, several interesting papers have been published, which merge the properties of the double-base number system and the efficiently computable endomorphisms on these curves [17,3].…”

The double-base number system in elliptic curve cryptography

“…More recently, the concept of double-base number system (DBNS) has shown some advantages in implementing ellipticcurve scalar multiplication [5], [6], [7], [8]. In DBNS, an integer n is represented as a sum (or difference) of mixed powers of 2 and 3:…”