Publication number | US20020057796 A1 |

Publication type | Application |

Application number | US 09/931,013 |

Publication date | May 16, 2002 |

Filing date | Aug 17, 2001 |

Priority date | Dec 24, 1998 |

Also published as | US7995752, US20060029222 |

Publication number | 09931013, 931013, US 2002/0057796 A1, US 2002/057796 A1, US 20020057796 A1, US 20020057796A1, US 2002057796 A1, US 2002057796A1, US-A1-20020057796, US-A1-2002057796, US2002/0057796A1, US2002/057796A1, US20020057796 A1, US20020057796A1, US2002057796 A1, US2002057796A1 |

Inventors | Robert Lambert, Robert Gallant, Scott Vanstone |

Original Assignee | Lambert Robert J., Robert Gallant, Vanstone Scott A. |

Export Citation | BiBTeX, EndNote, RefMan |

Referenced by (55), Classifications (6), Legal Events (1) | |

External Links: USPTO, USPTO Assignment, Espacenet | |

US 20020057796 A1

Abstract

This invention provides a method for accelerating multiplication of an elliptic curve point Q(x,y) by a scalar k, the method comprising the steps of selecting an elliptic curve over a finite field Fq where q is a prime power such that there exists an endomorphism ψ, where ψ (Q)=λ−Q for all points Q(x,y) on the elliptic curve; and using smaller representations k_{i }of the scalar k in combination with the mapping ψ to compute the scalar multiple of the elliptic curve point Q.

Claims(16)

a) selecting an elliptic curve over a finite field F such that there exists an endomorphism ψ where ψ(Q)=λ·Q for all points Q(x,y) on the elliptic curve, and λ is an integer,

b) establishing a representation of said scalar k as a combination of components k_{i }and said integer λ

c) combining said representation and said point Q to form a composite representation of a multiple corresponding to kQ and

d) computing a value corresponding to said point kQ from said composite representation of kQ.

a) selecting an elliptic curve over a finite field F such that there exists an endomorphism ψ where ψ(Q)=λQ for all points Q (x,y) on the elliptic curve, λ is an integer,

b) establishing a representation of said key k as a combination of components k_{i }and said integer λ,

c) combining said representation and said point Q to form a composite representation of a multiple corresponding to the public key kQ and

d) computing a value corresponding to said key kQ from said composite representation of kQ.

a) decomposing said scalar k into a pair of components k_{0}, k_{1 }for point multiplication to obtain respective points on said curve which when combined provide said point kP;

b) determining a signed representation in non-adjacent form of each of said first and second components;

c) generating a table having a plurality of signed bit combinations contained in said representations and corresponding point multiples of said combinations to provide portions of said respective points;

d) establishing for each of said representations a window having a width less then the length of each of said representations;

e) initiating a sequential examination of said representations by said windows to obtain a position for one of said windows in one of said representations contaning a respective one of said combinations in said table;

f) retrieving from said table the one of said point multiples corresponding to said respective one of said signed bit combinations in said table to obtain therefrom one of said portions;

g) accumulating said portion and continuing examination of said representations with a doubling of said accumulator for each bit-wise shift of said windows to obtain a representation of said coordinate of said point kP in said accunulator.

Description

- [0001]This invention relates to a method for performing computations in cryptographic systems utilizing elliptic curves.
- [0002]This application is a continuation-in-pat of U.S. patent application Ser. No. 09/885,959, filed on Jun. 22, 2001, which is a continuation of International Application No. PCT/CA99/01222, filed on Dec. 23, 1999, and claims the priority of Canadian Patent Application No. 2,257,008, filed on Dec. 24, 1998, the content of all of which is incorporated herein by reference.
- [0003]A public-key data communication system may be used to transfer information between a pair of correspondents. At least part of the information exchanged is enciphered by a predetermined mathematical operation by the sender and the recipient may perform a complementary mathematical operation to decipher the information.
- [0004]Each correspondent has a private key and a public key that is mathematically related to the private key. The relationship is such that it is not feasible to determine the private key from knowledge of the public key. The keys are used in he transfer of data, either to encrypt data that is to be transferred or to attach a signature to allow verification of the authenticity of the data.
- [0005]For encryption, one correspondent uses the public key of the recipient to encrypt the message and sends it to the recipient. The recipient then uses her private key to decipher the message.
- [0006]A common key may also be generated by combining one parties public key with the other parties private key. It is usual in such cases to generate new private and corresponding public keys for each communication session, usually referred to as session keys or ephemeral keys, to avoid the long-term keys of the parties being compromised.
- [0007]The exchange of messages and generation of the public keys may therefore involve significant computation involving exponentiation when the cryptographic system utilizes in Z*p, the finite field of integers mod p where p is a prime or the analogous operation of point multiplication when the system utilizes an elliptic curve. In an elliptic curve system, an ephemeral key pair is obtained by generating a secret integer, k and performing a point multiplication in the seed point Q to provide the ephemeral public key kQ. Similarly, the generation of a common ephemeral session key will require multiplication of a public key k
_{a}Q, which is a point on the curve, with a secret integer kb of the other correspondent so that point multiplication is again required. - [0008]A similar procedure is used to sign a message except that the sender applies his private key to the message. This permits any recipient to recover and verify the message using the senders public key.
- [0009]Various protocols exist for implementing such a scheme and some have been widely used. In each case, however, the sender is required to perform a computation to sign the information to be transferred and the receiver is required to perform a computation to verify the signed information.
- [0010]In a typical implementation a signature component s has the form:—
- s=ae+k (mod n)
- [0011]where; in an elliptic curve crypto system,
- [0012]P is a point on the underlying curve which is a predefined parameter of the system;
- [0013]k is a random integer selected as a short term private or session key;
- [0014]R=kP is the corresponding short term public key,
- [0015]a is the long term private key of the sender;
- [0016]Q=aP is the senders corresponding public key;
- [0017]e is a secure hash, such as the SHA-1 hash function, of a message m and the short term public key R; and
- [0018]n is the order of the curve.
- [0019]The sender sends to the recipient a message including m, s, and R and the signature is verified by computing the value R
^{1}=(sP−eQ) which should correspond to R. If the computed values correspond then the signature is verified. - [0020]In order to perform the verification it is necessary to compute the point multiplications to obtain sP and eQ, each of which is computationally complex. Where the recipient has adequate computing, power this does not present a particular problem but where the recipient has limted computing power, such as in a secure token or a “Smart card” application, the computations may introduce delays in the verification process.
- [0021]Key generation and signature protocols may therefore be computationally intensive. As cryptography becomes more widely used there is an increasing demand to implement cryptographic systems that arm faster and that use limited computing power, such as may be found on a smart card or wireless device.
- [0022]Elliptic curve cryptography (ECC) provides a solution to the computation issue. ECC permits reductions in key and certificate size that translates to smaller memory requirements, and significant cost savings. ECC can not only significantly reduce the cost, but also accelerate the deployment of smart cards in next-generation applications. Additionally, although the ECC algorithm allows for a reduction in key size, the same level of security as other algorithms with larger keys is maintained.
- [0023]However, there is still a need to perform faster calculations on the keys so as to speed up the information transfer while maintaining a low cost of production of cryptographic devices.
- [0024]Computing multiples of a point on an elliptic curve is one of the most frequent computations performed in elliptic curve cryptography, One method of speeding up such computations is to use tables of precomputed multiples of a point. This technique is more useful when a point is known beforehand. However, there are cases when multiples of previously unknown points are required (for example, in ECDSA verification). Thus there is a need for a system and method for facilitating point multiplications.
- [0025]In general terms, the present invention represents the scalar k as a combination of components k
_{i }and an integer λ derived from an endomonphisim in the underlying curve. - [0026]The method is based on the observation that, given an elliptic curve (EC) having complex multiplication mapping over a finite field, there is an λ, which is he solution to aquadratic, for which the complex multiplication mapping is equivalent to multiplying a point Q by λ. It will often be less computationally expensive to compute λQ via the complex multiplication map, compared to treating λ as a integer and performing the EC multiplication. In practice, point multiplication by other scalars (not just λ) is required. It is also shown how the multiplication mapping may be used to compute other multiples of the point.
- [0027]In accordance with this invention there is provided a method for accelerating multiplication of an elliptic curve point Q(xy) by a scalar k, the method comprising the steps of: selecting an elliptic curve over a finite field F such that there exists an endomorphismn ψ, where ψ(Q)=λ−Q for all points Q(xjy) on the elliptic curve; and using smaller representation k
_{i }of the scalar k in combination with the mapping ψ to compute the scalar multiple of the elliptic curve point Q. - [0028]These and other features of the preferred embodiments of the invention will become more apparent in the following detailed description in which reference is made to the appended drawings wherein:
- [0029][0029]FIG. 1 is a schematic diagram of a communication system;
- [0030][0030]FIG. 2 is a flow chart showing the steps of implementing a first embodiment of the present invention.
- [0031][0031]FIG. 3 is a flow chart showing the steps of providing parameters required to implement the method of FIG. 2.
- [0032]For convenience in the following description, like numerals refer to like structures in the drawings. Referring to FIG. 1, a data communication system
**10**includes a pair of correspondents, designated as a sender**12**, and a recipient**14**, connected by a communication channel**16**. Each of the correspondents**12**,**14**includes a cryptographic processor**18**,**20**respectively that may process digital information and prepare it for transmission through the channel**16**as will be described below. Each of the correspondents**12**,**14**also includes a computational unit**19**,**21**respectively to perform mathematical computations related to the cryptographic processors**18**,**20**. The processors**18**,**20**maybe embodied in an integrated circuit incorporated in the processor or may be implemented as instructions encoded on a data carrier to implement a predetermined protocol in conjunction with a general purpose processor. For the purpose of illustration it will be assumed that the correspondent**12**is in the form of a smart card having a dedicated processor**18**with relatively limited computing power. The processor**20**may be a central server communicating with the card by channel**16**and channel**16**may be a wireless communication channel if preferred. - [0033]The cryptographic processors
**18**implement an elliptic curve cryptographic system, of ECC, and one of the functions of the cryptographic processor**18**is to perform point multiplications of the form k−Q, where k is an integer and Q a point on the underlying elliptic curve, so that they may be used as a key pair k, kQ in a cryptographic scheme. As noted above, cryptographic computations such as the multiplication of an elliptic curve point by a scalar value are computationally expensive. - [0034]A method for accelerating scalar multiplication of an elliptic curve point Q(xy) is shown in FIG. 2 and indicated generally by the numeral
**50**. The subject algorithm increases the speed at which the processors**12**can for example sign and verify messages for specific classes of elliptic curves. The method is based on the observation that given the general equation for an elliptic curve E: - y
^{2}+a_{1}xy+a_{3}y=x^{3}+a_{2}x^{2}+a_{4}x+a_{6}(1) - [0035]over a finite field, exemplified as F
_{q }(q is a prime power) and when there exists an endomorphism ψ, where ψ(Q)=λ−Q for all points Q(x,y) on the elliptic curve, then multiplication of the point Q by an integer k may be accelerated by utilizing combinations of smaller representations k_{i }of k in combination with the mapping ψ. The mapping ψ also allows precomputation of group elements and combinations thereof, which maybe used in subsequent calculation of kQ. - [0036]Referring now to FIG. 2, a flow chart of a general embodiment for accelerating point multiplication on an elliptic curve, is shown by numeral
**50**. The system parameters are first selected. As an initial step an underlying elliptic curve E is selected to have certain characteristics. In a first embodiment of the invention the generalized elliptic curve (1) may be expressed in the following form: - E:y
^{2}=x^{3}+b mod p; where p is a prime. (2) - [0037]Firstly, the modulus p can be determined such that there is a number, γ where γ ∈ F
_{p }(F_{p }is the field of size p consisting of all integers mod p), and γ^{3}≡1 mod p (a cube root of unity). If for example p=7, then γ=2, since 2^{3 }mod 7=1. Such a γ does not necessarily exist for all p, and therefore this must be taken into consideration when choosing the value of p. Typically, the chosen p should be at least 160 bits in length for adequate cryptographic strength. - [0038]After the curve E has been selected, a mapping function ψ is determined. The mapping function ψ: (x,y)→(γx, y), simply maps one set of points on the curve to another set of points on the curve. There exists an integer λ such that ψ(Q)=λ−Q for all points Q(x,y) of interest on the elliptic curve, E. This integer λ may be found by noting that λ
^{3}≡1 mod n, where n is the number of points on the elliptic curve E over F_{p }i.e. the number of points on E(F_{p}). There may exist more than one solution for λ in λ^{3}≡1 mod n, but only one of those solutions will satisfy the mapping function ψ. It is important to note that since λ^{3 }mod p=1, both Q and ψ(Q) satisfy the equation for E. Therefore, instead of having to perform lengthy calculations to determine the results of multiplication by λ, it can be done very efficiently using the results of the mapping function so that multiplication by λ can be done very efficiently. - [0039]A seed point Q is selected and the system parameters E, p, Q, λ, ψ(Q), and γ are stored in the card
**12**, as indicated at**52**, at manufacture time for use by the cryptographic processor**18**. To implement a cryptographic procedure such as encryption, key agreement or signature it is necessary to select an integer k for use as an ephemeral private key k and generate a corresponding public key kQ. - [0040]The value of k may be expressed as:—
- k=(k
_{0}+k_{1}λ)mod n (3) - [0041]where n is the number of points on E(F
_{p}) and k_{0 }and k_{1 }are integers. The point k−Q then becomes: - k−Q=(k
_{0}Q+k_{1}λQ)mod n (4) - [0042]For some cryptographic operations the value of k may be chosen at random and in these cases, rather than select k it is possible to select values for k
_{0 }and k_{1 }at random, having a length of [log_{2}(n)]/2 not including sign bits, (i.e. the length of the k_{1}'s are chosen to be at least one half the length k) and then calculate the value for k using equation (3). Having selected the values of k_{0}, k_{1 }as indicated a 54 in FIG. 2, the right side of equation (4) can be calculated quickly using an algorithm analogous to the “Simultaneous Multiple Exponentiation” as described in the “Handbook of Applied Cryptography” (HAC) by Menezes et. al.(Algorithm 14.88) and indicated at 56. For convenience the algorithm is reproduced below. It may be noted that in an additive group exponentiation is analogous to addition, thus replacing the multiplication in the algorithm with addition, yields the following:Algorithm 1 Simultaneous Multiple Addition INPUT; group elements g _{0}, g_{1}, ..., g_{l−1 }and non negative t-bit integers e_{0}, e_{1}, ..., e_{l−1}.OUTPUT: g _{0}e_{0 }+ g_{1}e_{1 }+ ... + g_{l−1}e_{l−1}.step 1. Precomputation. For i from 0 to (2 ^{l }− 1):G _{i }← Σ_{j=0}^{l−1}g_{j}i_{j}where i = (i _{l−1 }... i_{0})_{2}step2. A ← 0 step3. For i from 1 to t do the following: A ← A + A,A ← A + G _{i}_{ t }step4. Return (A) where A = g _{0}e_{0 }+ g_{1}e_{1 }+ ... + g_{l−1}e_{l−1} - [0043]Applying this algorithm to equation (4) it can be seen that there are two group elements, g
_{0}, g_{1 }namely Q and λQ, so that 1=2 and two integers e_{0}, e_{1 }namely k_{0}k_{1}. The algorithm permits precomputation of some of the values and initially G_{i }is precomputed. The results of precomputation of G_{i }with t=2 is shown in table 1.TABLE 1 i 0 1 2 3 G _{i}0 g _{0}g _{1}g _{0 }+ g_{1} - [0044]After performing a point addition to construct the point: Q+ψ(Q). It is possible to fill in table 1 with the computed elements to yield table 2. These elements may be pre-computed and stored in memory as shown at step 58 in FIG. 2.
TABLE 2 i 0 1 2 3 G _{i}0 Q ψ(Q) Q + ψ(Q) - [0045]Before step of the algorithm can be performed, G
_{I, }has to be determined and accordingly I_{l }through I_{t }have to be found as indicated at 60. A notional matrix or combing table may be constructed using the binary representation of k_{i}. If, for example, k_{0}=30 and k_{1}=10, then t has the value five since the maximum number of bits in the binary representation of k_{0 }through k_{1 }is five and the notional matrix constructed from their binary representation is shown in Table 3. I_{i }is determined by the number represented in the i^{th }column where the first row contains the least significant bit, the second row contains the next significant bit etc. Therefore it can be seen from table 3 that I_{1}=I_{2}(11)=3, I_{3}=(01)=1, I_{4}=3, and I_{5}=0.TABLE 3 i 1 2 3 4 5 k _{0}1 1 1 1 0 k _{1}0 1 0 1 0 I _{i}1 3 1 3 0 - [0046]All the components needed to complete the algorithm are available and the iteration of step three is performed as shown at 62.
- [0047]Initially A←O and i is set to 1.
- [0048]I
_{i}=I_{1 }which from table 3 is equal to 1. G_{I}_{ 1 }is therefore G_{1 }which from table 2 is Q. The value of A from the iteration for I=1 is therefore O+Q=Q. - [0049]For the next iteration where i=2 the initial value of A is Q so A←Q+Q=2Q I
_{i}=I_{2}=3 from table 3. G_{I}_{ 2 }therefore equates to G_{3 }from table 2 which is Q+ψ(Q). - [0050]A+G
_{I}_{ 1 }therefore is computed as 2Q+Q+ψQ=3Q+ψQ. - [0051]The iterations continue for each value of i set out in table 4 until after the 5
^{th }iteration the value for koq=k, λQ, i.e. kQ is computed.TABLE 4 i A 1 Q 2 3Q + ψ(Q) 3 7Q + 2ψ(Q) 4 15Q + 5ψ(Q) 5 30Q + 10ψ(Q) - [0052]Each iteration requires a point doubling (A+A) and a point addition (A+G
_{I}_{ 1 }) although in some cases the value of G_{I}_{ 1 }may be 0 that will reduce the computation. - [0053]Thus it may be seen that this method will require a number of point doubles equal to max {log
_{2}(k_{i})}, and almost as many point additions. The number of point additions can be reduced using windowing (Alg. 14.85 HAC) and exponent recoding techniques. Since the value of i and G_{i }can be precomputed, the point additions are easily performed by retrieving the appropriate precomputed element G_{I }from table 2. Once kP has been computed, it maybe used as the correspondents**12**ephemeral public key in encrypting or signing transmissions over the channel**16**. - [0054]To summarize, for cryptographic operations like encryption and Diffie-Hellman, signature, an integer k is required with a corresponding public key kQ, computed. The values k
_{0 }and k_{1 }are chosen at random, each having a length one half the length of n and the term kQ=k_{1}λQ generated using a suitable algorithm. When the k's are chosen in this way, the method seems to be as secure as the random generation of k itself. Of course it is possible to choose the k_{i}'s to have fewer bits in order to improve efficiency. - [0055]In the above technique, the method of writing k=k
_{0}+k_{1}λ in conjunction with simultaneous combing achieves a speed up of the simultaneous multiple addition algorithm. The technique of writing k=k_{0}+k_{1}λ may also be used with the scalar multiplication techniques to advantage, namely with winding, combing ,etc. - [0056]For some mappings ψ, it is also possible to use more than two sub k's. It is possible for some ψ's to write k=k
_{0}+_{1}λ+k_{2}λ^{2 }allowing the value of k to be computed by applying the simultaneous multiple addition algorithm. - [0057]In a second embodiment of the invention a different form of the generalized elliptic curve equation (1) is used, namely:
- y
^{2}=(x^{3}−ax) mod p (5) - [0058]Once again, p will be a prime number having at least 160 bits. For this type of curve, the properties required for γ are different. It is now required to find a value such that γ
^{2}=−1 mod p. A change in the property of γ requires a different mapping function ψ′ to be used, In this embodiment the mapping takes the form ψ′: (x, y)→(−x, γy). If (x,y) is on the curve, then ψ′(x,y) is also on the curve. In this case λ^{4}≡1 mod n (n is still the number of points on E(F_{p})), and therefore λ can be calculated. The mapping ψ′(Q)=λ−Q is performed as before and once again multiplication by λ can be done very efficiently for this curve. The equation for k in this embodiment is the same as in the first embodiment and is represented by: - k=(k
_{0}+k_{1}λ) mod n (6) - [0059]This equation is the same as in the previous embodiment, having only two group elements. Thus using the group elements Q and Q+ψ′(Q) in the algorithm 1, the point k−Q may be calculated. This computation will require a number of point doubles equal to max {log
_{2}(k_{i})}, and a similar number of point additions. As described earlier the number of point additions can be reduced using windowing and exponent recoding techniques. - [0060]This method applies to other elliptic curves, so long as there exists an efficiently computable endomorphism, ψ.
- [0061]The above embodiments assume that k can be chosen at random and therefore k
_{0 }and k_{1 }can be selected instead and determine k. For cryptographic protocols, where it is not possible to choose k, it is first necessary to find k_{0}, k_{1 }of the desired “short” form from the given value of k such that k=(k_{0}+k_{1}λ) mod n. In some cases, more than two k's can be used to advantage. - [0062]As may be seen in tie embodiments described above when a point is known beforehand, tables can be built to speed multiplication. However, there are cases when multiples of previously unlmown points are required (for example, this can occur in ECDSA verification) and it is then necessary to take the value of k as provided and then determine suitable representations for k
_{i}. - [0063]Thus in a third embodiment, system parameters and a value k is provided, the point Q, the required multiple k, and the complex multiplication multiple λ are known. It is necessary to determine the “short” k
_{i}'s from the value for k, which is predetermined. A method for doing this described as follows and illustrated in the flow chart of FIG. 3. As a pre-computation (not requiring k) we compute two relations: - a
_{0}+b_{0}λ≡0 mod n - a
_{1}+b_{1}λ≡0 mod n - [0064]such that a
_{i }and b_{i }are numbers smaller than n. It is preferable that a_{i }and b_{i }are as small as possible, however, the present method has advantages even when a_{i }and b_{i }are not minimal. The pair, a_{i }and b_{i}, where a_{i }and b_{i }are both small, can be viewed as a vector, u_{i }with a smnall Euclidean length, Typically the method described below produces k_{0 }and k_{1 }having representations one half the size of the original k. - [0065]In the present embodiment, kQ can be computed efficiently by utilizing precomputed, short vector representations to obtain an expression of the form:
- k
_{0}Q+λk_{1}Q - [0066]This is accomplished by using precomputed vectors to derive fractions f
_{0 }and f_{1 }that do not require knowledge of k. A vector z is generated from the combination of fractions f_{0 }and f_{1 }and k. The vector z is used to calculate a second vector v′ where v′=(vo,v_{1}) and the value of kQ calculated as - vo
^{1}Q+λv_{1}^{1}Q (8) - [0067]The method of achieving this solution is described below in greater detail.
- [0068]To produce small a
_{i }and b_{i}, it is possible to make use of the L^{3}—lattice basis reduction algorithm (HAC p.118), which would directly result in short basis vectors. However, in this preferred embodiment the simple extended Euclidean algorithm is employed on the pair (n, λ). The extended Euclidean algorithm on (n, λ) produces linear combinations c_{i}n+d_{i}λ=r_{i}, where the representation of r_{i }(e.g. bit-length) decreases and the representation of c_{i }and d_{i }increases with i. - [0069]The two smallest values of |(d
_{i}, r_{i})| resulting from using the extended Euclidean algorithm are saved. The size of these vectors are measured with the squared Euclidean norm |(d_{i},)|=d_{i}^{2}+r_{1}^{2}. The terms in these minimal relations are denoted {circumflex over (d)}_{0}, {circumflex over (r)}_{0 }and {circumflex over (d)}_{1}, {circumflex over (r)}_{1}. And will typically occur in the middle of the algorithm. Even if the minimal relations are not retained, suboptimal relations may still give the method an advantage in the calculation of point multiples. - [0070]The values of a
_{i }and b_{i }are constructed by defining a_{0=−{circumflex over (r)}}_{0}, b_{0}={circumflex over (d)}_{0 }and a_{1}=−{circumflex over (r)}_{1}, b_{1}=d_{0 }all of which may be precomputed. The next task is to find a small representation for the multiple k. - [0071]Given the computation of a
_{0},b_{0 }and a_{i},b_{i }it is possible to designate the vectors u_{0},u1, where u_{0}=(a_{0}, b_{0}) and u_{1}=(a_{1}, b_{1}). These vectors satisfy a_{i}+b_{i}λ=0 (mod n). The multiplication of the group elements Q by the vector v=(v_{0}, v_{1}) is defined as (v_{0}+v_{1}λ)Q. Since a_{i}+b_{i}λ0 (mod n), u_{0}R=u_{1}R=0 for any group element R. Hence for any integers z_{0 }and z_{1}, v′R=(v−z_{0}u_{0}−z_{1}u_{1})R for any group element R. - [0072]Integers z
_{0 }and z_{1 }may be chosen such that the vector v′=v−z_{0}u_{0}−z_{1}u_{1 }has components that are as small as possible. Again, this method will have an advantage if the components of v′ are small, but not necessarily minimally so. - [0073]The appropriate z
_{0 }and z_{1 }are calculated by converting the basis of v into the basis {u_{0}, u_{1}}. The conversion between basis involves matrix multiplication. To convert the vector v=(v_{0}, v_{1}) from the {u_{0}, u_{1}} basis to the standard orthonormnal basis {(1,0),(0,1)},${v}_{\left\{\left(1,0\right),\left(0,1\right)\right\}}={v}_{\left({u}_{0},{u}_{1}\right)}\ue89eM=\left({v}_{0},{v}_{1}\right)\ue8a0\left[\begin{array}{cc}{a}_{0}& {b}_{0}\\ {a}_{1}& {b}_{1}\end{array}\right]$ - [0074]To convert in the other direction, from the standard orthonormal basis {(1,0),(0,1)} to the (u
_{0}, u_{1}) basis, the multiplication is simply by the inverse of M,${v}_{\left({u}_{0},{u}_{1}\right)}={v}_{\left\{\left(1,0\right),\left(0,1\right)\right\}}\ue89e\mathrm{inverse}\ue8a0\left(M\right)={v}_{\left\{\left(1,0\right),\left(0,1\right)\right\}}\ue89e\frac{1}{{a}_{0}\ue89e{b}_{1}-{a}_{1}\ue89e{b}_{0}}\ue8a0\left[\begin{array}{cc}{b}_{1}& -{b}_{0}\\ -{a}_{1}& {a}_{0}\end{array}\right]$ - [0075]Since the vector v=k, 0) has a zero component, the bottom row of inverse(M) is not required, and therefore to convert to the {u
_{0}, u_{1}} basis only the fractions${f}_{0}=\frac{{b}_{1}}{{a}_{0}\ue89e{b}_{1}-{a}_{1}\ue89e{b}_{0}}$ $\mathrm{and}$ ${f}_{1}=\frac{{b}_{0}}{{a}_{0}\ue89e{b}_{1}-{a}_{1}\ue89e{b}_{0}}$ - [0076]are needed.
- [0077]The fractions f
_{0 }and f_{1 }may be precomputed to enough precision so that this operation may be effected only with multiplication. It should be noted that the computations leading to these fractions do not depend upon k, therefore they can be computed once when the elliptic curve is chosen as a system parameter, and do not need to be recalculated for each k. Similarly the vectors v, u_{0 }and u_{1 }may be precomputed and stored. - [0078]Once a value of k is selected or determined the value of kQ may be computed by first calculating z=(z
_{0}, z_{1}), where z is defined as (z_{0}, z_{1})=(round(kf_{0}), round(kf_{1})). Other vectors near to z will also be useful, therefore rounding could be replaced with floor or ceiling functions or some other approximation. - [0079]Once a suitable z has been deteried, an efficient equivalent to v (k,0) is calculated by v′=(v
_{0}′, v_{1}′)=v−z_{0}u_{0}−z_{1}u_{1}. The phrase “efficient equivalent” implies a vector v′ such that v′P=vP and v′ has small coefficients. The value kQ is then calculated as v_{0}′Q+v_{1}′λQ. This value can be calculated using simultaneous point addition as described above, with enhanced efficiency obtained from the use of non-adjacent form (NAF) recoding as described above and as described in H.A.C. 14.7 at page 627, Thus, even where k is predetermined, values of k_{0 }and k_{1 }can be computed and used with the mapping function to obtain a value of kQ and hus he key pair k, kQ. - [0080]For the case where k is to be separated into 3 portions k=k
_{0}+k_{1}λ+k_{2}λ^{2}, small vectors can be obtained from L^{3}-row-reducing$\left[\begin{array}{ccc}1& 0& -{\lambda}^{2}\\ 0& 1& -\lambda \\ 0& 0& -n\end{array}\right]\ue89e\text{\hspace{1em}}\ue89e\mathrm{to}\ue89e\text{\hspace{1em}}\left[\begin{array}{c}{u}_{2}\\ {u}_{1}\\ {u}_{0}\end{array}\right]$ - [0081]A small vector equivalent (three-dimensional row) can be obtained in a similar way to the two-dimensional case.
- [0082]Using these methods to determine the value of k−Q greatly reduces the processing power required by the cryptographic processors
**12**. It also increases the speed at which these repetitive calculations can be done which, in turn, reduces the time to transfer information. - [0083]It will be appreciated that once the scalar multiple k has been represented in terms of shortened components k=k
_{0}+k_{1}λ+k_{2}λ+. . . k_{m-1}λ^{m-1}, other options for efficient elliptic curve scalar multiplication may be used in place of or in conjunction with the simultaneous multiple addition algorithm. These options include windowing (fixed and sliding), combing, bit recoding and combinations of these techniques. - [0084]One particularly beneficial technique permits tables built for one component of the multiplication, say k
_{0}, to be reused for other components k_{1 }etc. This is accomplished by transforming the computed table elements by applying the mapping γ as required. - [0085]As a further exemplification, an embodiment where k can be recast as k=k
_{0}+k_{1}λ+k_{2}λ^{2}, where k has m-bits and k_{i }have roughly m/3 bits is described below. - [0086]Once the components ki have been determined, they may be recoded from the binary representation to the signed binary representation having less non-zero bits. This recoding can take the Non-Adjacent-Form (NAF), where every 1 or −1 bit in the representation if k
_{i }is non-adjacent to another non-zero in the signed binary string. This recoding is described in H.A.C. 14.7 p. 627. - [0087]Once each k
_{i }has been recoded, a table can be constructed to aid in computing k_{i}λ^{i}P. - [0088]A NAF windowing table precomputes certain short-bit length multiples of λ
^{i}P. The width of the window determines the size of the table. As k_{i }has been recordedto have no adjacent non zeros, odd window widths are suitable. A 3-bit wide NAF window would contain1 101 10 − 1 - [0089]The recoded k
_{i }values are built by concatenating these windows, and padding where necessary with zeros (H.A.C., p. 616). - [0090]The required number of additions can be reduced with use of this table, since it is necessary to add or subtract an EC point only for every window encountered instead of for every non zero bit.
- [0091]Initially therefore this technique is applied to the computation of k
_{0}P. - [0092]The table built for the k
_{0}P calculation can be applied to the k,λP calculation if the table elements are mapped with the ψ mapping using the operator γ. Similarly, k_{2}λ^{2}P can be accelerated by using the table built for k_{0}P, but mapping the table elements with γ^{2}. - [0093]In applying the sliding window technique to the components, only one set of doublings need be performed.
- [0094]To illustrate this example of a preferred embodiment the following example will be used:
- If k=[1011010111101]
_{2}+[111010101101]_{2}λ, - [0095]then recoding
- [0096]k=[10−100−10−100−101]+[1000−10−10−10−101]λ, =k
_{0}′=k_{1}′λ - [0097]A 3-bit window table on P is precomputed containing 1·P, [10−1]·P, [101]·P. This requires two EC additions, and two EC doublings.
- [0098]After this, kP can be calculated as
- kP=[10−100−10−100−101]P+[1000−10−10−10−101]·λP
- [0099]by adding/subtracting elements from the table.
- [0100]This can be done using an accumulator A as follows:
A ← 0 ; initialize A += ψ(1 · P) ; consuming the top bit of k _{0}^{r}A ← 2A ; double A A ← 2A A ← [10 − 1] P ; consuming the top 3 bits of k _{0}^{r}A ← 2 ^{4}A; A −= [101]ψP ; consuming a 3 bit window of k _{1}^{r}A ← 2A ; double A A −= [101]P ; consuming 3 bits of k _{1}^{r}A ← 2 ^{4}AA −= [101]ψP ; consuming 3 bits of k _{1}^{r}A ← 2 ^{2}AA −= [10 − 1]P ; consuming the last of k _{0}^{r}A += ψP ; producing kP. - [0101]It will be recognized from the above example that the windows in k
_{0 }and k_{1 }need not be aligned. This is evidenced by the fact that the accumulator is doubled between computations of the windows in k_{0 }and the computations of the windows in k_{1}, indicating a shift of window between evaluating k_{0}P and k_{1}P. - [0102]In summary, the previously described technique is as follows. Given an elliptic curve E and an endomorphism ψ, there corresponds an integer λ such that λQ=ψ(Q) for all points Q∈E. Select an integer m and compute an equivalent number m of “short basis vectors” b
_{1}, b_{2}, . . . , bm . . . Each such basis vector corresponds to an integer, and each such integer is divisible by the number of points n=#E(F_{p}^{m}) (i.e. the number of points). Now, given an integer k, (0<k<n), we write k=Σk_{i}·λ^{1}, where the k_{i}'s are chosen to be “short”. This is done by finding the difference between a certain vector (which represents k) and a nearby vector in the lattice generated by b_{1}, b_{2}, . . . , b_{m}. - [0103]The following embodiment explicitly describes an application of the previously described technique (endomorphism and basis conversion and “Shamir's trick”) to elliptic curves defined over composite fields. In particular, we describe an application to curves E(F
_{p}^{m}) where p is an odd prime is described. The following embodiments exemplify techniques for such curves. - [0104]This technique is described in the case where the map ψ is the Frobenius map ψ(x,y)=(x
^{p},y^{p}) and E′_{A,B}(F_{p}^{m}) where A,B∈F_{p}. - [0105]In this case, it is known that the Frobenius map satisfies the ψ
^{2}−tψ+p=0, where t=p+1−#E(F_{p}^{m}). - [0106]It follows that λ
^{2}−tλ+p=0 mod n and so λ^{2−I}−pλ^{i}=0 mod n. - [0107]Note that the vectors;
(λ ^{m-1 }. . .λ ^{2}, λ^{1}, λ^{0})b _{1}(0, 0, 0, . . . 0, 1, -t, p) b _{2}( 1, -t, p, 0) (1, -t, p, 0, 0, . . . . . ., 0) (-t, p, 0, 0, . . . . . ., 0, 1) b _{m}(p, 0, 0, 0, . . . 0, 1, -t) - [0108]consist of m “short” basis vectors of the vector space Q
^{n}. It follows that to compute k−Q on such a curve we can proceed using the vectors b_{1},b_{2}. . . b_{m }and the technique described previously. - [0109]In the above embodiments it will be appreciated that k,λQ can be obtained from ψ(kQ) is the mapping is more efficient than addition.
- [0110]In a firther embodiment, the above methods are used to verify a digital signature on a message. A sender sends a message m, a signature component s, and a short term public key R=kP. As indicated above, in a typical digital signature protocol, the signature component s is generated using the formula s=ae+k. The value a is a long term private key of the sender, and e is a hash of the message m.
- [0111]Verification requires computing the value sP=eQ which should correspond to R, where Q=aP is a long term public key of the sender. This is the case since k=s−ae.
- [0112]Accordingly, Algorithm 1 may be applied to compute a sum g
_{0}e_{0}+g_{1}e_{1 }of scalar multiples of two group elements go and go, where the scalars are s and −e and the group elements are P and Q. A further improvement is obtained by using the NAF as above. - [0113]For ease of explanation, the method will be illustrated for computing αP+βQ. In the preferred embodiment of verfying a signature, α=s and β=−e.
- [0114]In this case, it may no longer be possible to reuse tables built for one component of the multiplication for other components, unless the relationship between the points P and Q is known to the verifier. Usually, the verifier knows P and Q, but not the scalar a that related P and Q (i.e. Q=aP). In this case, it is necessary to use a table for each of P and Q. Then a sliding window method may be used by adding/subtracting elements from the tables.
- [0115]The following example illustrates this embodiment:
- If α=[101101011101]
_{2 }and β=[111010101101]_{2}, - then k=[1011010111]
_{2}+[111010101101]_{2 }a, - and recoding α=[10−100−10−100−101]
_{2 }and β=[1000−10−10−10−101]_{2}, - [0116]A 3-bit window table on P and a 3-bit window table on Q are precomputed containing 1·P, [10−1]·P, [101]·P and 1·Q, [10−1]·Q, [101]·Q respectively. This requires two EC additions, and two EC doublings for each table.
- [0117]After this, kP can be calculated as
- kP=αP+βQ=[10-100-10-100-101]P +[1000-10-10-10-101]·Q
- [0118]by adding/subtracting elements from the tables.
- [0119]This can be done using an accumulator A as follows:
A ← 0 ; initialize A += 1 · Q ; consuming the top bit of β A ← 2A ; double A A ← 2A A += [10 − 1]P ; consuming the top 3 bits of α A ← 2 ^{4}A; A −= [101]Q ; consuming a 3 bit window of β A ← 2A ; double A A −= [101]P ; consuming 3 bits of β A ← 2 ^{4}AA −= [101]Q ; consuming 3 bits of β A ← 2 ^{2}AA −= [10 − 1]P ; consuming the last of α A += Q ; producing kP. - [0120]The signature is accepted as originating from the sender if the calculated value of kP is equal to the value of R received with the signature.
- [0121]Again, it will be appreciated that the windows need not be aligned and that shiting of the windows produces a double of the accumulator for each bit shift of the window.
- [0122]Although the invention has been described with reference to certain specific embodiments, various modifications thereof will be apparent to those skilled in the art without departing from the spirit and scope of the invention as outlined in the claims appended hereto.

Referenced by

Citing Patent | Filing date | Publication date | Applicant | Title |
---|---|---|---|---|

US6738478 * | Oct 5, 1999 | May 18, 2004 | Certicom Corp. | Power signature attack resistant cryptography |

US6826586 * | Dec 15, 2000 | Nov 30, 2004 | Sun Microsystems, Inc. | Method for efficient computation of point doubling operation of elliptic curve point scalar multiplication over finite fields F(2m) |

US7191341 | Jan 23, 2003 | Mar 13, 2007 | Broadcom Corporation | Methods and apparatus for ordering data in a cryptography accelerator |

US7209555 * | Oct 24, 2002 | Apr 24, 2007 | Matsushita Electric Industrial Co., Ltd. | Elliptic curve converting device, elliptic curve converting method, elliptic curve utilization device and elliptic curve generating device |

US7434043 | Jan 23, 2003 | Oct 7, 2008 | Broadcom Corporation | Cryptography accelerator data routing unit |

US7519179 * | May 27, 2004 | Apr 14, 2009 | Sony Corporation | Information transmission apparatus and method, information reception apparatus and method, and information-providing system |

US7545932 * | Oct 29, 2004 | Jun 9, 2009 | Thomson Licensing | Secure authenticated channel |

US7568110 | Jan 23, 2003 | Jul 28, 2009 | Broadcom Corporation | Cryptography accelerator interface decoupling from cryptography processing cores |

US7600131 | Jul 6, 2000 | Oct 6, 2009 | Broadcom Corporation | Distributed processing in a cryptography acceleration chip |

US7802098 * | May 30, 2001 | Sep 21, 2010 | France Telecom Sa | Cryptography method and smart cards microcircuit |

US7809946 | Oct 23, 2008 | Oct 5, 2010 | Thomson Licensing | Secure authenticated channel |

US7856101 | Feb 7, 2007 | Dec 21, 2010 | King Fahd University Of Petroleum And Minerals | Method for elliptic curve scalar multiplication |

US7903811 * | Jul 12, 2006 | Mar 8, 2011 | Samsung Electronics Co., Ltd. | Cryptographic system and method for encrypting input data |

US7991154 * | May 14, 2008 | Aug 2, 2011 | Univeristy of Castilla-La Mancha | Exponentiation method using multibase number representation |

US7996670 | Jul 6, 2000 | Aug 9, 2011 | Broadcom Corporation | Classification engine in a cryptography acceleration chip |

US8145895 | Feb 27, 2009 | Mar 27, 2012 | Sony Corporation | Information transmission apparatus and method, information reception apparatus and method, and information-providing system |

US8204232 | Jan 18, 2006 | Jun 19, 2012 | Certicom Corp. | Accelerated verification of digital signatures and public keys |

US8295484 | Dec 9, 2005 | Oct 23, 2012 | Broadcom Corporation | System and method for securing data from a remote input device |

US8429408 * | Jun 11, 2010 | Apr 23, 2013 | Certicom Corp. | Masking the output of random number generators in key generation protocols |

US8442216 | Oct 28, 2008 | May 14, 2013 | Certicom Corp. | Fault detection in exponentiation and point multiplication operations using a montgomery ladder |

US8457307 | Jul 10, 2008 | Jun 4, 2013 | Certicom Corp. | Method and system for generating implicit certificates and applications to identity-based encryption (IBE) |

US8467535 | Mar 7, 2011 | Jun 18, 2013 | Certicom Corp. | Accelerated verification of digital signatures and public keys |

US8745376 * | Oct 14, 2011 | Jun 3, 2014 | Certicom Corp. | Verifying implicit certificates and digital signatures |

US8788827 | Sep 14, 2012 | Jul 22, 2014 | Certicom Corp. | Accelerated verification of digital signatures and public keys |

US8806197 | May 23, 2012 | Aug 12, 2014 | Certicom Corp. | Accelerated verification of digital signatures and public keys |

US9071445 | May 3, 2013 | Jun 30, 2015 | Certicom Corp. | Method and system for generating implicit certificates and applications to identity-based encryption (IBE) |

US9264426 | Sep 14, 2012 | Feb 16, 2016 | Broadcom Corporation | System and method for authentication via a proximate device |

US9288192 | Sep 14, 2012 | Mar 15, 2016 | Broadcom Corporation | System and method for securing data from a remote input device |

US20020124031 * | Dec 15, 2000 | Sep 5, 2002 | Sheueling Chang | Method for efficient computation of point doubling operation of elliptic curve point scalar multiplication over finite fields F(2m) |

US20030023846 * | Aug 12, 2002 | Jan 30, 2003 | Broadcom Corporation | Classification engine in a cryptography acceleration chip |

US20030081771 * | Oct 24, 2002 | May 1, 2003 | Yuichi Futa | Elliptic curve converting device, elliptic curve converting method, elliptic curve utilization device and elliptic curve generating device |

US20030163699 * | May 30, 2001 | Aug 28, 2003 | Jean-Claude Pailles | Cryptography method and smart cards microcircuit |

US20040123119 * | Jan 23, 2003 | Jun 24, 2004 | Broadcom Corporation | Cryptography accelerator interface decoupling from cryptography processing cores |

US20040123120 * | Jan 23, 2003 | Jun 24, 2004 | Broadcom Corporation | Cryptography accelerator input interface data handling |

US20040123121 * | Jan 23, 2003 | Jun 24, 2004 | Broadcom Corporation | Methods and apparatus for ordering data in a cryptography accelerator |

US20040123123 * | Sep 24, 2003 | Jun 24, 2004 | Buer Mark L. | Methods and apparatus for accessing security association information in a cryptography accelerator |

US20050036612 * | May 27, 2004 | Feb 17, 2005 | Sony Corporation | Information transmission apparatus and method, information reception apparatus and method, and information-providing system |

US20060093138 * | Oct 29, 2004 | May 4, 2006 | Alain Durand | Secure authenticated channel |

US20060133604 * | Dec 9, 2005 | Jun 22, 2006 | Mark Buer | System and method for securing data from a remote input device |

US20070064932 * | Jan 18, 2006 | Mar 22, 2007 | Marinus Struik | Accelerated verification of digital signatures and public keys |

US20080044010 * | Jul 12, 2006 | Feb 21, 2008 | Ihor Vasyltasov | Cryptographic system and method for encrypting input data |

US20080063189 * | Nov 10, 2006 | Mar 13, 2008 | North Dakota State University | Optimal signed-digit recoding for elliptic curve cryptography |

US20080205638 * | Feb 7, 2007 | Aug 28, 2008 | Al-Gahtani Theeb A | Method for elliptic curve scalar multiplication |

US20090046852 * | Jul 10, 2008 | Feb 19, 2009 | Vanstone Scott A | Method and system for generating implicit certificates and applications to identity-based encryption (ibe) |

US20090063863 * | Oct 23, 2008 | Mar 5, 2009 | Thomson Licensing | Secure authenticated channel |

US20090113252 * | Oct 28, 2008 | Apr 30, 2009 | Lambert Robert J | Fault detection in exponentiation and point multiplication operations using a montgomery ladder |

US20090323933 * | May 14, 2008 | Dec 31, 2009 | Longa Patrick | Exponentiation method using multibase number representation |

US20110194694 * | Mar 7, 2011 | Aug 11, 2011 | Certicom Corp. | Accelerated Verification of Digital Signatures and Public Keys |

US20110307698 * | Jun 11, 2010 | Dec 15, 2011 | Certicom Corp | Masking the output of random number generators in key generation protocols |

US20130097420 * | Oct 14, 2011 | Apr 18, 2013 | Certicom Corp. | Verifying Implicit Certificates and Digital Signatures |

DE102010050194A1 * | Nov 4, 2010 | May 10, 2012 | Tu Darmstadt | Method for setting cryptographically secure connection between computer systems e.g. mobile phone, involves determining fractional values of cryptographic data for interaction of computer systems, in parallel |

WO2005114802A2 * | Apr 4, 2005 | Dec 1, 2005 | North Dakota State University | Optimal signed-digit recoding for elliptic curve cryptography |

WO2005114802A3 * | Apr 4, 2005 | Oct 26, 2006 | Univ North Dakota | Optimal signed-digit recoding for elliptic curve cryptography |

WO2006076800A1 * | Jan 18, 2006 | Jul 27, 2006 | Certicom Corp. | Accelerated verification of digital signatures and public keys |

WO2009055904A1 * | Oct 28, 2008 | May 7, 2009 | Certicom Corp. | Fault detection in exponentiation and point multiplication operations using a montgomery ladder |

Classifications

U.S. Classification | 380/28 |

International Classification | G06F7/72 |

Cooperative Classification | G06F7/725, H04L9/3073 |

European Classification | H04L9/30L, G06F7/72F1 |

Legal Events

Date | Code | Event | Description |
---|---|---|---|

Nov 30, 2001 | AS | Assignment | Owner name: CERTICOM CORP., CANADA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:LAMBERT, ROBERT J.;GALLANT, ROBERT;VANSTONE, SCOTT A.;REEL/FRAME:012331/0786 Effective date: 20010911 |

Rotate