Fast Scalar Multiplication Method Using Change-of-Basis Matrix to Prevent Power Analysis Attacks on Koblitz Curves

Selected Areas in Cryptography

Heuberger

Prodinger

2007

Abstract. This paper studies τ -adic expansions of scalars, which are important in the design of scalar multiplication algorithms on Koblitz Curves, and are less understood than their binary counterparts.At Crypto '97 Solinas introduced the width-w τ-adic non-adjacent form for use with Koblitz curves. It is an expansion of integers z = È i=0 ziτ i , where τ is a quadratic integer depending on the curve, such that zi = 0 implies zw+i−1 = . . . = zi+1 = 0, like the sliding window binary recodings of integers. We show that the digit sets described by Solinas, formed by elements of minimal norm in their residue classes, are uniquely determined. However, unlike for binary representations, syntactic constraints do not necessarily imply minimality of weight.Digit sets that permit recoding of all inputs are characterized, thus extending the line of research begun by Muir and Stinson at SAC 2003 to Koblitz Curves.Two new useful digit sets are introduced: one set makes precomputations easier, the second set is suitable for low-memory applications, generalising an approach started by Avanzi, Ciet, and Sica at PKC 2004 and continued by several authors since. Results by Solinas, and by Blake, Murty, and Xu are generalized.Termination, optimality, and cryptographic applications are considered. We show how to perform a "windowed" scalar multiplication on Koblitz curves without doing precomputations first, thus reducing memory storage dependent on the base point to just one point.

Section: Return (X)mentioning

confidence: 99%

Section: A Performance Remarkmentioning

confidence: 99%

On Redundant τ-Adic Expansions and Non-adjacent Digit Sets

Selected Areas in Cryptography

Heuberger

Prodinger

2007

“…Thus, the number of Frobenius operations can increase exponentially with u. To ensure that this does not become a performance problem if polynomial bases are used, a technique from [20] is adopted to convert between normal and polynomial bases as required to quickly compute iterated Frobenius operations.…”

Section: Further Developments In τ -Adic Representationsmentioning

confidence: 99%

“…One solution is provided, as already mentioned, by a technique introduced by Park et al in [20] and used by Okeya et al in [19]. Instead of applying a variable power of the Frobenius to a changing point as done in Steps 5 to 9 if Algorithm 3, we apply the Frobenius to the point P and accumulate directly.…”

Section: On the Use Of Normal Vs Polynomial Basesmentioning

confidence: 99%

Extending Scalar Multiplication Using Double Bases

Advances in Cryptology – ASIACRYPT 2006

Dimitrov

Doche

et al. 2006

Abstract. It has been recently acknowledged [4,6,9] that the use of double bases representations of scalars n, that is an expression of the form n = È e,s,t (−1) e A s B t can speed up significantly scalar multiplication on those elliptic curves where multiplication by one base (say B) is fast. This is the case in particular of Koblitz curves and supersingular curves, where scalar multiplication can now be achieved in o(log n) curve additions. Previous literature dealt basically with supersingular curves (in characteristic 3, although the methods can be easily extended to arbitrary characteristic), where A, B ∈ N. Only [4] attempted to provide a similar method for Koblitz curves, where at least one base must be non-real, although their method does not seem practical for cryptographic sizes (it is only asymptotic), since the constants involved are too large. We provide here a unifying theory by proposing an alternate recoding algorithm which works in all cases with optimal constants. Furthermore, it can also solve the until now untreatable case where both A and B are nonreal. The resulting scalar multiplication method is then compared to standard methods for Koblitz curves. It runs in less than log n/ log log n elliptic curve additions, and is faster than any given method with similar storage requirements already on the curve K-163, with larger improvements as the size of the curve increases, surpassing 50% with respect to the τ -NAF for the curves K-409 and K-571. With respect of windowed methods, that can approach our speed but require O(log(n)/ log log(n)) precomputations for optimal parameters, we offer the advantage of a fixed, small memory footprint, as we need storage for at most two additional points.

“…This is not a problem if a normal basis is used to represent the field, but may induce a performance penalty with a polynomial basis. A similar problem was faced by Okeya, Takagi and Vuillaume in [16], and they solved it adapting an idea by Park, Sim and Lee [17]. The technique consists in keeping a copy R of the point P in normal basis representation.…”

Section: Return (X)mentioning

confidence: 96%

Redundant τ-adic expansions I: non-adjacent digit sets and their applications to scalar multiplication

Heuberger

Prodinger

2010

Des. Codes Cryptogr.

Abstract. This paper studies τ -adic expansions of scalars, which are important in the design of scalar multiplication algorithms for Koblitz Curves, but are also less understood than their binary counterparts. At Crypto '97 Solinas introduced the width-w τ -adic non-adjacent form for use with Koblitz curves. It is an expansion of integers z = P ℓ i=0 ziτ i , where τ is a quadratic integer depending on the curve, such that zi = 0 implies zw+i−1 = . . . = zi+1 = 0, like the sliding window binary recodings of integers. We show that the digit sets described by Solinas, formed by elements of minimal norm in their residue classes, are uniquely determined. However, unlike for binary representations, syntactic constraints do not necessarily imply minimality of weight. Digit sets that permit recoding of all inputs are characterized, thus extending the line of research begun by Muir and Stinson at SAC 2003 to the Koblitz Curve setting. Two new digit sets are introduced with useful properties; one set makes precomputations easier, the second set is suitable for low-memory applications, generalising an approach started by Avanzi, Ciet, and Sica at PKC 2004 and continued by several authors since, including Okeya, Takagi and Vuillaume. Results by Solinas, and by Blake, Murty, and Xu are generalized. Termination, optimality, and cryptographic applications are considered. The most important application is the ability to perform arbitrary windowed scalar multiplication on Koblitz curves without storing any precomputations first, thus reducing memory storage to just one point and the scalar itself.