Fast Architectures for the \eta_T Pairing over Small-Characteristic Supersingular Elliptic Curves

Abstract

This paper is devoted to the design of fast parallel accelerators for the cryptographic ηT pairing on supersingular elliptic curves over finite fields of characteristics two and three. We propose here a novel hardware implementation of Miller's algorithm based on a parallel pipelined Karatsuba multiplier. After a short description of the strategies we considered to design our multiplier, we point out the intrinsic parallelism of Miller's loop and outline the architecture of coprocessors for the ηT pairing over F2m and F3m. Thanks to a careful choice of algorithms for the tower field arithmetic associated with the ηT pairing, we manage to keep the pipelined multiplier at the heart of each coprocessor busy. A final exponentiation is still required to obtain a unique value, which is desirable in most cryptographic protocols. We supplement our pairing accelerators with a coprocessor responsible for this task. An improved exponentiation algorithm allows us to save hardware resources. According to our place-and-route results on Xilinx FPGAs, our designs improve both the computation time and the area-time trade-off compared to previously published coprocessors.

High Speed Cryptoprocessor for η T Pairing on 128-bit Secure Supersingular Elliptic Curves over Characteristic Two Fields

“…The pairing computation consists of two major operations − the non-reduced pairing (Miller's algorithm) and the final exponentiation. Beuchat et al in [5] proposed two separate coprocessors on which these two tasks are pipelined. Two separate coprocessors in pipeline helps to reduce the computation time.…”

“…To the best of the authors' knowledge no hardware implementation is available for computing 128-bit secure η T pairing on supersingular elliptic curves over characteristic-two fields. The existing designs in this respect are for a maximum of 105-bit secure design over F 2 691 field, which is proposed by Beuchat et al in [5]. The design proposed in [5] computes 105-bit secure η T pairing and achieves a very good speed of 18.8μs.…”

“…The existing designs in this respect are for a maximum of 105-bit secure design over F 2 691 field, which is proposed by Beuchat et al in [5]. The design proposed in [5] computes 105-bit secure η T pairing and achieves a very good speed of 18.8μs. However, compared to the respective design in [5] our design with higher security level demands much lesser, less than half, number of slices on the same FPGA family.…”

“…In practice, pairing could be implemented either as a software library executed on general purpose processors or as a dedicated cryptoprocessor. However, the later one is favored due to huge mathematical operations required for pairing computation [5]. This paper broadly addresses design techniques of a pairing cryptoprocessor for high security level.…”

“…Highspeed software implementations reported in [6,7] compute 128-bit secure pairings in 0.832ms and 1.87ms. The work proposed by Beuchat et al [5] describes design architectures for η T pairings on supersingular elliptic curves over characteristic two and three fields for a maximum of 105-bit and 109-bit security, respectively. However, to the best of the authors' knowledge no hardware architectures are available for computing η T pairing on 128-bit secure supersingular elliptic curves over binary fields.…”