Vorapong Suppakitpaisarn vorapong@mist.i.u-tokyo.ac.jp , Eng. 6 Room 363

1. Discrete Methods in Mathematical InformaticsLecture 4: Elliptic Curve Cryptography Implementation(I)27th November 2012 Vorapong Suppakitpaisarn vorapong@mist.i.u-tokyo.ac.jp, Eng. 6 Room 363 Download Slide: http://misojiro.t.u-tokyo.ac.jp/~vorapong/

2. Course Information (Many Changes from Last Week) Schedule Grading 10/9 – Elliptic Curve I (2 Exercises) (What is Elliptic Curve?) 10/16 – Elliptic Curve II (1 Exercises) (Elliptic Curve Cryptography[1]) 10/23 – Elliptic Curve III (2 Exercises) (Elliptic Curve Cryptography[2]) 10/30 – Cancelled 11/6 – Online Algorithm I (Prof. Han) 11/13 – Online Algorithm II (Prof. Han) 11/20 – Cancelled 11/27 – Elliptic Curve IV (2 Exercises) (ECC Implementation I) 12/4 – Cancelled From 12/11 – To be Announced • For my part, you need to submit 2 Reports. • Report 1: Select 3 from 6 exercises in Elliptic Curve I – IIISubmission Deadline: 14 November • Report 2: Select 2 from 4 exercises in Elliptic Curve IV – VSubmission Deadline: TBD • Submit your report at Department of Mathematical Informatics’ office • [1st floor of this building]

3. Report I • 48126220 • 48126228 • 48126229 • 48126230 • 48126232 • 37126946 • 37126947 • 48117204 • 48116219 • 48126202 • 48126203 • 48126206 • 48126207 • 48126210 • 48126212 • 48126219 Submitted IDs • 48126109 • 48126119 • 48126122 • 48126141 • 48126143 • 48126144

4. Elliptic Curve Cryptography ECC Protocol P Generate P2 E(F) Generate positive integers a Receive Q = bP Compute aQ = abP Receive P Receive S = aP Generate positive integer b Compute bS = abP aP Point Addition bP Scalar Multiplication Compute rP = 14P r = 14 = (0 1 1 1 0)2 2Point Additions 3 Point Doubles P 3P 7P 14P O 2P 6P 14P Elliptic Curve Arithmetic A= -4, B= 4 Field Arithmetic

5. Elliptic Curve Cryptography ECC Protocol P Generate P2 E(F) Generate positive integers a Receive Q = bP Compute aQ = abP Receive P Receive S = aP Generate positive integer b Compute bS = abP aP Point Addition bP Scalar Multiplication Compute rP = 14P r = 14 = (0 1 1 1 0)2 2Point Additions 3 Point Doubles P 3P 7P 14P O 2P 6P 14P Elliptic Curve Arithmetic A= -4, B= 4 Field Arithmetic

6. Field Multiplication Montgomery Multiplication [Montgomery 1985] Slow Division Algorithm??? Classical Method: O(n2) Karatsuba’s Method (Practical): O(nlg 3) = O(n1.585…) Furer’s Method (STOC2007): O(nlogn2O(lg* n)) As Fast As Multiplication

7. Montgomery Reduction Montgomery Reduction Example

8. Field Squaring Montgomery Multiplication • Let the computation time of • one field multiplication be [m], • one field squaring be [s], • one field inversion be [i].

9. Elliptic Curve Cryptography ECC Protocol P Generate P2 E(F) Generate positive integers a Receive Q = bP Compute aQ = abP Receive P Receive S = aP Generate positive integer b Compute bS = abP aP Point Addition bP Scalar Multiplication Compute rP = 14P r = 14 = (0 1 1 1 0)2 2Point Additions 3 Point Doubles P 3P 7P 14P O 2P 6P 14P Elliptic Curve Arithmetic A= -4, B= 4 Field Arithmetic

10. Projective Coordinate [cf. Cohen, Miyaji, Ono, 1998] Affine Coordinate Projective Coordinate P 3P 7P 14P P = (x1,y1) (x1 : y1 : 1) O 2P 6P 14P Point Double in Projective Coordinate 2Point Additions > 2[i] 3 Point Doubles > 3[i] 2P = (x2,y2) (X2 : Y2 : Z2) Point Addition in Projective Coordinate 5 Point Inversions 3P = (x3,y3) (X3 : Y3 : Z3) … 2 Point Inversions (X14 : Y14 : Z14)

11. Point Addition In Projective Coordinate Goal Projective Coordinate Affine Coordinate

12. Efficiency Affine Coordinate Projective Coordinate [m] [m] [i]+[m] 2[m] [s] [s]+2[m] [s]+[m] [m] [m] [m] [m] [m] [m] Cost

13. Exercise Affine Coordinate Exercise 6

14. Other Coordinates

15. Elliptic Curve Cryptography ECC Protocol P Generate P2 E(F) Generate positive integers a Receive Q = bP Compute aQ = abP Receive P Receive S = aP Generate positive integer b Compute bS = abP aP Point Addition bP Scalar Multiplication Compute rP = 14P r = 14 = (0 1 1 1 0)2 2Point Additions 3 Point Doubles P 3P 7P 14P O 2P 6P 14P Elliptic Curve Arithmetic A= -4, B= 4 Field Arithmetic

16. Scalar Multiplication and Binary Representation • Scalar Multiplication on Elliptic Curve CryptographyS= P + P + … + P = rP whenr1 is positive integer, S,Pis a member of the curve • Double-and-add method • Let r = 14 = (01110)2 Compute rP = 14Pr = 14 = (0 1 1 1 0)2 r times Weight = 3 P 3P 7P 14P O 2P 6P 14P 3 – 1 =2Point Additions 4 – 1 = 3 Point Doubles Average # of Point Doubles? Average # of Point Additions? For [0,2n-1], n - 1 times? For [0,2n-1], n/2 - 1 times? (Average Weight = n/2)

17. Redundant Binary Representation • Change Digit Set can help Scalar Multiplication faster • Represent each digit using {0, 1, -1} instead of {0,1}. • Redundant, then use Minimum Weight Conversion to find Minimum Weight Expansion (the expansion that have the minimum joint weight) Weight = 2 Compute rP = 14Pr = 14 = (1 0 0 -1 0)2 14P P 2P 4P 7P O 14P 2P 4P 8P 3 – 1 = 2Point Additions 4 – 1 = 3 Point Doubles 2 – 1 =1Point Additions 5 – 1 = 4 Point Doubles Average # of Point Doubles? Average # of Point Additions? For [0,2n-1], n - 1 times? For [0,2n-1], n/2 - 1 times? (Average Weight = n/2) Average # of Point Doubles? Average # of Point Additions? For [0,2n-1], n times? For [0,2n-1], n/3 - 1 times? (Average Weight = n/3)

18. Non-Adjacent Form Definition S = (sn-1sn-2 … s0) is DS-Expansion of positive integer r iff Definition S = (sn-1sn-2 … s0) is Minimum Weight DS-Expansion of positive integer r iff Definition S = (sn-1sn-2 … s0) is Non-Adjacent Form of positive integer r iff Optimality S is Minimum Weight {0, ±1}-Expansionof rif S is Non-Adjacent Form of r

19. Algorithm Algorithm Simple Fact n - 1 consecutive 1’s n - 2 consecutive 1’s Ex Example 1 0 0 0 -1 1 0 0 0 -1

20. Average Hamming Density Definition Algorithm Pr[st= 0] = 0.5 Pr[st= 1] = 0.5 Proposition Proof 0.5 0.5 0.25 0.5 2/3 1/3 0.5 0.25 1 3 3 0.25 2/3 1/3 0.5 12/6 2 2 0 1 1 2/3 1/3 0.25 1 1 4/6 0.5

21. Redundant Binary Representation • Change Digit Set can help Scalar Multiplication faster • Represent each digit using {0, 1, -1} instead of {0,1}. • Redundant, then use Minimum Weight Conversion to find Minimum Weight Expansion (the expansion that have the minimum joint weight) Weight = 2 Compute rP = 14Pr = 14 = (1 0 0 -1 0)2 14P P 2P 4P 7P O 14P 2P 4P 8P 3 – 1 = 2Point Additions 4 – 1 = 3 Point Doubles 2 – 1 =1Point Additions 5 – 1 = 4 Point Doubles Average # of Point Doubles? Average # of Point Additions? For [0,2n-1], n - 1 times? For [0,2n-1], n/2 - 1 times? (Average Weight = n/2) Average # of Point Doubles? Average # of Point Additions? For [0,2n-1], n times? For [0,2n-1], n/3 - 1 times? (Average Weight = n/3)

22. Double-Base Number System [Dimitrov, Cooklev, IEEE Trans. on Circuits and Systems, 1995] Base 2 Base 3 23 22 21 20 33 32 31 30 24 34 (1 (0 0 0 1 14 = -1 0)2 14 = -1 -1 -1)2 P 2P 4P 7P 14P P 2P 5P 14P O O 2P 4P 8P 14P 3P 6P 15P 1 Point Additions 4 Point Doubles 3 Point Additions 3 Point Triples Hard to introduce to Scalar Multiplication 1 Too General 1 14 = 2330 + 2131

23. Double-Base Chain [Dimitrov, Imbert, Mishra, Math of Computation, 2008] Double-Base Number System when and With More Restriction

24. Double-Base Number System [Dimitrov, Cooklev, IEEE Trans. on Circuits and Systems, 1995] Double Base Number System (DBNS) Double Base Chains (DBC) 1 1 1 1 14 = 2231 + 2130 14 = 2330 + 2131 1 1 1 1 1 1 127 = 2233 + 2132+ 2130 127 = 2233 + 2132+ 2130

25. Double-Base Chain[Dimitrov, Imbert, Mishra, Math of Computation, 2008] Double-Base Number System when and With More Restriction k = 127 = 2233 + 2132 + 2030 Digit 1 0 1 0 0 1 Base 2233 2133 2132 2032 2031 3030 Similar to Double-and-add Methods P 2P 7P 14P 42P 127P O 2P 6P 14P 42P 126P 2 Point Additions, 2 Point Doubles, 3 Point Triples Given k Given Cadd- Computation time of aPoint Addition Given Cdbl - Computation time of a Point Double Given Ctpl - Computation time of a Point Triple Find the Chain With Smallest Total Computation Time Problem

26. Algorithms [Suppakitpaisarn, Edahiro, Imai, 2012] k = 10, Ctpl = 1, Cdbl = 1, Cadd = 1 Our Results How to compute kP = 10P Plan A Plan B Compute 5P Double the point to 10P = 2 . 5P Compute 3P Triple the point to 9P = 3 . 3P Add the point with P (9P + P = 10P) Cost Cost Optimize Computation Time of 5P + Point Double = C(5P) + Cdbl= 3 + 1 = 4 Optimize Computation Time of 3P + Point Triple + Point Addition = C(3P) + Ctpl + Cadd= 1 + 1 + 1 = 3

27. Algorithm C(k/2) + Pdbl C(k/3) + Ptpl C(k/2) + Pdbl + Padd C(k/3) + Ptpl + Padd • C(k) =min( , ) if k mod 6 == 0 min( , ) if k mod 6 == 1 min( , ) if k mod 6 == 2 min( , ) if k mod 6 == 3 min( , ) if k mod 6 == 4 min( , ) if k mod 6 == 5 Our Results C(k/2) + Pdbl infinity C(k/3) + Ptpl C(k/2) + Pdbl+ Padd C(k/2) + Pdbl C(k/3) + Ptpl + Padd infinity C(k/2) + Pdbl + Padd 1 0 0 3 1 Dynamic Programming Time : lg2k Memory : lg2k 3

28. Prime Field (Fp ) • Experiments on Inverted Edward Coordinates[Bernstein, Lange, AAECC 2007] • Cdbl=6.2[m], Ctpl= 12.2[m], Cadd = 9.8[m] Our Results 3.95 % 3.88 % 3.90 % 3.90 % 3.90 %

29. Double-Base Chain[Dimitrov, Imbert, Mishra, Math of Computation, 2008] Double-Base Number System when and With More Restriction k = 127 = 2233 + 2132 + 2030 Digit 1 0 1 0 0 1 Base 2233 2133 2132 2032 2031 3030 Similar to Double-and-add Methods P 2P 7P 14P 42P 127P O 2P 6P 14P 42P 126P 2 Point Additions, 2 Point Doubles, 3 Point Triples Given k Given Cadd- Computation time of aPoint Addition Given Cdbl - Computation time of a Point Double Given Ctpl - Computation time of a Point Triple Find the Chain With Smallest Total Computation Time Given k Given Cadd= 1, Cdbl = 0, Ctpl = 0 Find the Chain With Smallest Total Computation Time Given k Given Cadd= 1, Cdbl = 0, Ctpl = 0 Find the shortest chain (the chain with smallest number of terms) Problem

30. On-Going… DBNS Double-Base Chain [Dimitrov, Cooklev, 1995] [Our Results] [Our Results] Input: k Output:mk* Tractable??? SAT??? Input: k Output:mk* Solved by DP [Our Results]

31. Exercise Exercise 6 Exercise 7

32. Thank you for your attention Please feel free to ask questions or comment.