Faster Scalar Multiplication on Koblitz Curves Combining Point Halving with the Frobenius Endomorphism

Avanzi, Roberto; Ciet, Mathieu; Sica, Francesco

doi:10.1007/978-3-540-24632-9_3

Cited by 20 publications

(45 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In fact, in [2] there are three different types of sums like the one we have just seen, each of arbitrary length. For example, the first such family is given by the relation…”

Section: Frobenius-cum-halvingmentioning

confidence: 97%

“…Avanzi, Ciet, and Sica [2] combine the τ -NAF with a single point halving, thereby reducing the amount of point additions from n/3 to 2n/7. They can therefore claim an asymptotic speed-up of ≈ 14.29% on average.…”

Section: Frobenius-cum-halvingmentioning

confidence: 99%

“…Their algorithm takes an input τ -NAF s. The output is a pair of τ -adic expressions s (1) and s (2) with the property that…”

Section: Frobenius-cum-halvingmentioning

confidence: 99%

“…In [2] it is proposed to insert a halving in the "τ -and-add" method to further speed up scalar multiplication. This approach brings a nonnegligible speedup (on average 14% with suitable representations of the fields) with respect to the use of the τ -NAF, but it is not optimal.…”

Section: Introductionmentioning

confidence: 99%

“…Sections 3 and 4 are respectively devoted to the minimality of the τ -NAF and to the wide-double-NAF, our optimal improvement of the results from [2]. In particular § 4.5 contains a simple analysis of the Hamming weight of the wide-double-NAF.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Minimality of the Hamming Weight of the τ-NAF for Koblitz Curves and Improved Combination with Point Halving

Avanzi

Heuberger

Prodinger

2006

Selected Areas in Cryptography

Self Cite

View full text Add to dashboard Cite

Abstract. In order to efficiently perform scalar multiplications on elliptic Koblitz curves, expansions of the scalar to a complex base associated with the Frobenius endomorphism are commonly used. One such expansion is the τ -adic NAF, introduced by Solinas. Some properties of this expansion, such as the average weight, are well known, but in the literature there is no proof of its optimality, i.e. that it always has minimal weight. In this paper we provide the first proof of this fact. Point halving, being faster than doubling, is also used to perform fast scalar multiplications on generic elliptic curves over binary fields. Since its computation is more expensive than that of the Frobenius, halving was thought to be uninteresting for Koblitz curves. At PKC 2004, Avanzi, Ciet, and Sica combined Frobenius operations with one point halving to compute scalar multiplications on Koblitz curves using on average 14% less group additions than with the usual τ -and-add method without increasing memory usage. The second result of this paper is an improvement over their expansion. The new representation, called the widedouble-NAF, is not only simpler to compute, but it is also optimal in a suitable sense. In fact, it has minimal Hamming weight among all τ -adic expansions with digits {0, ±1} that allow one halving to be inserted in the corresponding scalar multiplication algorithm. The resulting scalar multiplication requires on average 25% less group operations than the This paper was in part written while this author was visiting the

show abstract

“…In fact, in [2] there are three different types of sums like the one we have just seen, each of arbitrary length. For example, the first such family is given by the relation…”

Section: Frobenius-cum-halvingmentioning

confidence: 97%

Section: Frobenius-cum-halvingmentioning

confidence: 99%

“…Their algorithm takes an input τ -NAF s. The output is a pair of τ -adic expressions s (1) and s (2) with the property that…”

Section: Frobenius-cum-halvingmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Minimality of the Hamming Weight of the τ-NAF for Koblitz Curves and Improved Combination with Point Halving

Avanzi

Heuberger

Prodinger

2006

Selected Areas in Cryptography

Self Cite

View full text Add to dashboard Cite

show abstract

A Complete Divisor Class Halving Algorithm for Hyperelliptic Curve Cryptosystems of Genus Two

Kitamura

Katagi

Takagi

2005

Information Security and Privacy

View full text Add to dashboard Cite

Abstract. We deal with a divisor class halving algorithm on hyperelliptic curve cryptosystems (HECC), which can be used for scalar multiplication, instead of a doubling algorithm. It is not obvious how to construct a halving algorithm, due to the complicated addition formula of hyperelliptic curves. In this paper, we propose the first halving algorithm used for HECC of genus 2, which is as efficient as the previously known doubling algorithm. From the explicit formula of the doubling algorithm, we can generate some equations whose common solutions contain the halved value. From these equations we derive four specific equations and show an algorithm that selects the proper halved value using two trace computations in the worst case. If a base point is fixed, we can reduce these extra field operations by using a pre-computed table which shows the correct halving divisor class -the improvement over the previously known fastest doubling algorithm is up to about 10%. This halving algorithm is applicable to DSA and DH scheme based on HECC. Finally, we present the divisor class halving algorithms for not only the most frequent case but also other exceptional cases.

show abstract

Short Memory Scalar Multiplication on Koblitz Curves

Okeya

Takagi

Vuillaume

2005

Cryptographic Hardware and Embedded Systems – CHES 2005

View full text Add to dashboard Cite

Abstract. We present a new method for computing the scalar multiplication on Koblitz curves. Our method is as fast as the fastest known technique but requires much less memory. We propose two settings for our method. In the first setting, well-suited for hardware implementations, memory requirements are reduced by 85%. In the second setting, well-suited for software implementations, our technique reduces the memory consumption by 70%. Thus, with much smaller memory usage, the proposed method yields the same efficiency as the fastest scalar multiplication schemes on Koblitz curves.

show abstract

Faster Scalar Multiplication on Koblitz Curves Combining Point Halving with the Frobenius Endomorphism

Cited by 20 publications

References 15 publications

Minimality of the Hamming Weight of the τ-NAF for Koblitz Curves and Improved Combination with Point Halving

Minimality of the Hamming Weight of the τ-NAF for Koblitz Curves and Improved Combination with Point Halving

A Complete Divisor Class Halving Algorithm for Hyperelliptic Curve Cryptosystems of Genus Two

Short Memory Scalar Multiplication on Koblitz Curves

Contact Info

Product

Resources

About