Faster and Lower Memory Scalar Multiplication on Supersingular Curves in Characteristic Three

Abstract

Abstract. We describe new algorithms for performing scalar multiplication on supersingular elliptic curves in characteristic three. These curves can be used in pairing-based cryptography. Since in pairing-based protocols besides pairing computations also scalar multiplications are required, and the performance of the latter is not negligible, it is clearly important to improve its performance as well. The techniques presented here bring noticeable speed ups (up to 30% for methods using a variable amount of memory and up to 46.7% for methods with a small, fixed memory usage), while at the same time bringing substantial memory reductions -factors like 3 to 8 are not uncommon. The starting point for our methods is a structure theorem for unit groups of residue classes of a quadratic order associated to the Frobenius endomorphism of the considered curves. This allows us to define new digit sets whose elements are products of powers of certain generators of said groups. There are of course several choices for these generators: we chose generators associated to endomorphisms for which we could find efficient explicit formulae in a suitable coordinate system. A multiple-base-like scalar multiplication algorithm making use of these digits and these formulae brings the claimed speed up.

Symmetric digit sets for elliptic curve scalar multiplication without precomputation

“…Recent work by Avanzi and Heuberger [1] , Avanzi, Heuberger and Prodinger [2] , and Kleinrahm [7] point out that for certain elliptic curves over finite fields, some roots of unity appear in where τ is the Frobenius endomorphism of the curve. These roots of unity can be used to create a digit set for a τ -adic expansion of integers, leading to a very efficient elliptic curve scalar multiplication with reduced number of precomputations.…”

“…These roots of unity can be used to create a digit set for a τ -adic expansion of integers, leading to a very efficient elliptic curve scalar multiplication with reduced number of precomputations. In [1,2] a primitive 6-th root of unity ζ occurs in for a supersingular Koblitz curve in characteristic 3; ζ is used to create a digit set which noticeably speeds up scalar multiplication and decreases memory requirements at the same time. In [7] a curve in characteristic 5 with is analysed; the digit set built with the help of i needs no precomputation at all.…”

“…Koblitz [9] suggested a NAF τ -and-add algorithm for a family of supersingular curves in characteristic 3; this method was later improved by Blake, Murty and Xu [4] . Avanzi, Heuberger and Prodinger [2] exploited the existence of the 6-th roots of unity in to create a sixpartite digit set that decreased memory consumption by a factor three; Avanzi and Heuberger [1] also provided a precomputationless factored digit set. A similar study was undertaken by Kleinrahm [7] , examining a curve in characteristic 5 where the 4-th roots of unity belong to .…”