Complete addition formulas for prime order elliptic curves Joost - PowerPoint PPT Presentation

Complete addition formulas for prime order elliptic curves Joost Renes 1 Craig Costello 2 Lejla Batina 1 j.renes@cs.ru.nl 1 Radboud University, Nijmegen, The Netherlands 2 Microsoft Research, Redmond, USA 16 February 2016 16 February 2016 1 / 39

About me ◮ PhD student (supervisor Lejla Batina) ◮ Digital Security Group ◮ Radboud University (Nijmegen, The Netherlands) ◮ (Academic) Interests: ◮ Efficient and secure implementations of curve-based crypto ◮ Side-channel analysis ◮ (Hyper)elliptic-curve cryptography ◮ Isogeny-based cryptography ◮ http://www.cs.ru.nl/~jrenes/ 16 February 2016 2 / 39

Outline ◮ Elliptic curve intro ◮ Complete formulas & comparison ◮ Background Feel free to ask questions at any time! 16 February 2016 3 / 39

Elliptic curves E ( k ): elliptic curve over a field k with char( k ) � = 2 , 3 Every elliptic curve can be written in short Weierstrass form ◮ Embedded in P 2 as E : Y 2 Z = X 3 + aXZ 2 + bZ 3 ◮ The point O = (0 : 1 : 0) is called the point at infinity ◮ Affine points ( x : y : 1) given by y 2 = x 3 + ax + b ◮ The points on E form an abelian group under point addition ⊕ (with neutral element O ) ◮ Scalar multiplication ( k , P ) �→ [ k ] P ( k ∈ Z , P ∈ E ) 16 February 2016 4 / 39

Elliptic curve cryptography (ECC) Elliptic curve discrete logarithm problem (ECDLP) Given two points P , Q ∈ E such that Q ∈ � P � . Find k ∈ Z such that Q = [ k ] P . Commonly k is a secret, Q is public ◮ Key exchange: ECDH ◮ Signatures: ECDSA, EdDSA 16 February 2016 5 / 39

Weierstrass model O Figure: E / R : y 2 = x 3 + ax + b 16 February 2016 6 / 39

Addition O Q P P ⊕ Q Figure: E / R : y 2 = x 3 + ax + b 16 February 2016 7 / 39

Addition O Q ◮ if P � = ± Q ◮ if P � = O ◮ if Q � = O P P ⊕ Q Figure: E / R : y 2 = x 3 + ax + b 16 February 2016 7 / 39

Doubling O P [2] P Figure: E / R : y 2 = x 3 + ax + b 16 February 2016 8 / 39

Doubling O P [2] P ◮ if P � = O Figure: E / R : y 2 = x 3 + ax + b 16 February 2016 8 / 39

Implementation (Homogeneous addition) ( X 1 : Y 1 : Z 1 ) ⊕ ( X 2 : Y 2 : Z 2 ) = ( X 3 : Y 3 : Z 3 ), where: � X 3 = ( X 2 Z 1 − X 1 Z 2 ) ( Y 2 Z 1 − Y 1 Z 2 ) Z 1 Z 2 − ( X 2 Z 1 − X 1 Z 2 ) 3 − 2( X 2 Z 1 − X 1 Z 2 ) X 1 Z 2 � , � Y 3 = ( Y 2 Z 1 − Y 1 Z 2 ) 3( X 2 Z 1 − X 1 Z 2 ) X 1 Z 2 − ( Y 2 Z 1 − Y 1 Z 2 ) Z 1 Z 2 + ( X 2 Z 1 − X 1 Z 2 ) 3 � − ( X 2 Z 1 − X 1 Z 2 ) 3 Y 1 Z 2 , Z 3 = ( X 2 Z 1 − X 1 Z 2 ) 3 Z 1 Z 2 .  P = Q  ⇒ X 3 = Y 3 = Z 3 = 0 ( not in P 2 ! ) But: P = O  = Q = O 16 February 2016 9 / 39

Implementation (Homogeneous doubling) [2]( X : Y : Z ) = ( X 3 : Y 3 : Z 3 ), where ( aZ 2 + 3 X 2 ) 2 − 8 XY 2 Z � � X 3 = 2 YZ , Y 3 = ( aZ 2 + 3 X 2 ) � 12 XY 2 Z − ( aZ 2 + 3 X 2 ) 2 � − 8 Y 4 Z 2 , Z 3 = 8 Y 3 Z 3 . ⇒ X 3 = Y 3 = Z 3 = 0 ( not in P 2 ! ) But: P = O = 16 February 2016 10 / 39

OpenSSL code example int ec_GFp_simple_add(...) { (...) if (a == b) return EC_POINT_dbl(group, r, a, ctx); if (EC_POINT_is_at_infinity(group, a)) return EC_POINT_copy(r, b); if (EC_POINT_is_at_infinity(group, b)) return EC_POINT_copy(r, a); (...) } 16 February 2016 11 / 39

OpenSSL code example int ec_GFp_simple_add(...) { (...) if (a == b) return EC_POINT_dbl(group, r, a, ctx); if (EC_POINT_is_at_infinity(group, a)) return EC_POINT_copy(r, b); if (EC_POINT_is_at_infinity(group, b)) return EC_POINT_copy(r, a); (...) } 16 February 2016 11 / 39

Exceptional cases ◮ Curves implemented using formulas with exceptional cases ◮ Handled by if-statements: ◮ Code complexity ◮ Bugs ◮ Non-time-constant ◮ Potential vulnerabilities 16 February 2016 12 / 39

Standardized curves need to deal with this ◮ The example curves originally specified in the working drafts of ANSI, versions X9.62 and X9.63 [Acc99a; Acc99b]. ◮ The five NIST prime curves specified in FIPS 186-4, i.e. P-192, P-224, P-256, P-384 and P-521. ◮ The seven curves specified in the German brainpool standard [ECC05], i.e., brainpoolPXXXr1 , where XXX ∈ { 160 , 192 , 224 , 256 , 320 , 384 , 512 } . ◮ The eight curves specified by the UK-based company Certivox [Cer15], i.e., ssc-XXX , where XXX ∈ { 160 , 192 , 224 , 256 , 288 , 320 , 384 , 512 } . ◮ The three curves specified (in addition to the above NIST prime curves) in the Certicom SEC 2 standard [Cer10]. This includes secp256k1 , which is the curve used in the Bitcoin protocol. 16 February 2016 13 / 39

A (partial) solution ◮ In 2007 Bernstein and Lange introduce Edwards curves ◮ Efficient exception-free addition formulas ◮ Problem: the curves have a cofactor ⇒ Not possible for prime order curves ◮ Also the case for twisted Edwards and Hessian curves 16 February 2016 14 / 39

Attempts for prime order curves ◮ For all NIST prime curves [BL09]: 26 M + 8 S + ... ◮ Unified formulas [BJ02]: 11 M + 6 S + ... ◮ Complete system of two addition laws [Bos+15] Goal : efficient complete addition formulas for prime order curves 16 February 2016 15 / 39

The result: complete addition formulas Complete addition formulas for odd order subgroups ( X 1 : Y 1 : Z 1 ) ⊕ ( X 2 : Y 2 : Z 2 ) = ( X 3 : Y 3 : Z 3 ), where: X 3 = ( X 1 Y 2 + X 2 Y 1 )( Y 1 Y 2 − a ( X 1 Z 2 + X 2 Z 1 ) − 3 bZ 1 Z 2 ) − ( Y 1 Z 2 + Y 2 Z 1 )( aX 1 X 2 + 3 b ( X 1 Z 2 + X 2 Z 1 ) − a 2 Z 1 Z 2 ) , Y 3 = ( Y 1 Y 2 + a ( X 1 Z 2 + X 2 Z 1 ) + 3 bZ 1 Z 2 )( Y 1 Y 2 − a ( X 1 Z 2 + X 2 Z 1 ) − 3 bZ 1 Z 2 ) + (3 X 1 X 2 + aZ 1 Z 2 )( aX 1 X 2 + 3 b ( X 1 Z 2 + X 2 Z 1 ) − a 2 Z 1 Z 2 ) , Z 3 = ( Y 1 Z 2 + Y 2 Z 1 )( Y 1 Y 2 + a ( X 1 Z 2 + X 2 Z 1 ) + 3 bZ 1 Z 2 ) + ( X 1 Y 2 + X 2 Y 1 )(3 X 1 X 2 + aZ 1 Z 2 ) . In particular this would work in any prime order group, including those on Edwards and Hessian curves 16 February 2016 16 / 39

Operation count � 12 M + 3 m a + 2 m 3b + 23 a P ⊕ Q any a : 8 M + 3 S + 3 m a + 2 m 3b + 15 a [2] P � 12 M + 2 m b + 29 a P ⊕ Q a = − 3: 8 M + 3 S + 2 m b + 21 a [2] P � 12 M + 2 m 3b + 19 a P ⊕ Q a = 0: 6 M + 2 S + 1 m 3b + 9 a [2] P 16 February 2016 17 / 39

A comparison (any a ) ◮ This work (addition): 12 M + 3 m a + 2 m 3b + 23 a ◮ This work (doubling): 8 M + 3 S + 3 m a + 2 m 3b + 15 a ◮ For all NIST prime curves [BL09]: 26 M + 8 S + ... ◮ Unified formulas [BJ02]: 11 M + 6 S + ... ◮ Jacobian coordinates addition: 12 M + 4 S + 7 a ◮ Jacobian coordinates doubling: 3 M + 6 S + 1 m a + 13 a 16 February 2016 18 / 39

A comparison (any a ) ◮ This work (addition): 12 M + 3 m a + 2 m 3b + 23 a ◮ This work (doubling): 8 M + 3 S + 3 m a + 2 m 3b + 15 a ◮ For all NIST prime curves [BL09]: 26 M + 8 S + ... ◮ Unified formulas [BJ02]: 11 M + 6 S + ... ◮ Jacobian coordinates addition: 12 M + 4 S + 7 a ◮ Jacobian coordinates doubling: 3 M + 6 S + 1 m a + 13 a 16 February 2016 18 / 39

A comparison (any a ) ◮ This work (addition): 12 M + 3 m a + 2 m 3b + 23 a ◮ This work (doubling): 8 M + 3 S + 3 m a + 2 m 3b + 15 a ◮ For all NIST prime curves [BL09]: 26 M + 8 S + ... ◮ Unified formulas [BJ02]: 11 M + 6 S + ... ◮ Jacobian coordinates addition: 12 M + 4 S + 7 a ◮ Jacobian coordinates doubling: 3 M + 6 S + 1 m a + 13 a 16 February 2016 18 / 39

A software comparison: OpenSSL NIST no. of ECDH operations (per 10s) factor curve complete incomplete slowdown P-192 35274 47431 1.34x P-224 24810 34313 1.38x P-256 21853 30158 1.38x P-384 10109 14252 1.41x P-521 4580 6634 1.44x Table: Number of ECDH operations in 10 seconds for the OpenSSL implementation of the five NIST prime curves. Timings were obtained by running the “ openssl speed ecdhpXXX ” command on an Intel Core i5-5300 CPU @ 2.30GHz, averaged over 100 trials of 10s each. 16 February 2016 19 / 39

A hardware comparison: FPGA implementation [MRB16] For all prime order curves over prime fields of up to 522 bits ◮ A single set of formulas ◮ Built on top of Montgomery modular multiplier ◮ Additions very cheap compared to multiplications ◮ No distinction between multiplications and squarings ◮ Benefit a lot from parallelizing formulas 16 February 2016 20 / 39

Parallelizing n Cost Area × Time 1 17 M + 23 a 17 M + 23 a 2 9 M 2 + 12 a 2 18 M + 24 a 3 6 M 3 + 8 a 3 18 M + 24 a 4 5 M 4 + 7 a 4 20 M + 28 a 5 4 M 5 + 6 a 5 20 M + 30 a 6 3 M 6 + 6 a 6 18 M + 36 a 16 February 2016 21 / 39

Parallelizing n Cost Area × Time 1 17 M + 23 a 17 M + 23 a 2 9 M 2 + 12 a 2 18 M + 24 a 3 6 M 3 + 8 a 3 18 M + 24 a 4 5 M 4 + 7 a 4 20 M + 28 a 5 4 M 5 + 6 a 5 20 M + 30 a 6 3 M 6 + 6 a 6 18 M + 36 a 16 February 2016 21 / 39