Fast Cryptography in Genus 2

Abstract

Abstract. In this paper we highlight the benefits of using genus 2 curves in public-key cryptography. Compared to the standardized genus 1 curves, or elliptic curves, arithmetic on genus 2 curves is typically more involved but allows us to work with moduli of half the size. We give a taxonomy of the best known techniques to realize genus 2 based cryptography, which includes fast formulas on the Kummer surface and efficient 4-dimensional GLV decompositions. By studying different modular arithmetic approaches on these curves, we present a range of genus 2 implementations. On a single core of an Intel Core i7-3520M (Ivy Bridge), our implementation on the Kummer surface breaks the 120 thousand cycle barrier which sets a new software speed record at the 128-bit security level for constant-time scalar multiplications compared to all previous genus 1 and genus 2 implementations.

Efficient and Secure Algorithms for GLV-Based Scalar Multiplication and Their Implementation on GLV-GLS Curves

“…In [24], Hu, Longa and Xu explore a GLV-GLS curve over F p 2 supporting a 4 dimensional decomposition. In [8], Bos et al study 2 and 4 dimensional decompositions on genus 2 curves over F p . Bos et al [9] explore the combined GLV-GLS approach over genus 2 curves defined over F p 2 , which supports an 8-GLV decomposition.…”

“…Certainly, one can reduce the number of precomputations when using the regular windowed recoding by only precomputing multiples corresponding to one or some of the sub-scalars. However, these savings in memory come at the expense of computing endomorphisms during the evaluation stage, which can cost from several multiplications [8] to approximately one full point addition each (see Appendix B). The proposed method always requires the minimum storage without impacting performance.…”

“…This final operation can be efficiently carried out by employing the modular addition proposed by Bos et al [8] to get the final result in the range [0, p − 1]. Note that the computation of field multiplication above naturally accepts inputs in unreduced form without incurring in extra costs, enabling the use of additions without correction or operations with incomplete reduction (see below for more details).…”

“…Later, in [16] Galbraith et al showed how to exploit the Frobenius endomorphism to enable the use of the GLV approach on a wider set of curves defined over the quadratic extension field F p 2 . Since then, significant research has been performed to improve the performance [30,24] and to explore the applicability to other settings [20,35] or to higher dimensions on genus one curves [24,31,18] and genus two curves [8,9,18]. Unfortunately, most of the work and comparisons with other approaches have been carried out with unprotected algorithms and implementations.…”

“…Moreover, it does not require dummy operations, making it resilient to safe-error attacks [42,43], and can be used as basis for realizing constanttime implementations that guard against timing attacks [26,11,2,36]. In addition, we present different variants of the technique that are intended for different scenarios exploiting simple or complex GLV decompositions, and thus provide algorithms that have broad applicability to many settings using GLV, GLS, or a combination of both [16,20,30,24,31,35,8,9,18,39]. In comparison with the best previous approaches, the method improves the computing performance especially during the potentially expensive precomputation stage, and allows us to save at least half of the storage requirement for precomputed values without impacting performance.…”