Hardware Operators for Pairing-Based Cryptography Part I: Because - PowerPoint PPT Presentation

5 Bilinear pairings ◮ ( ● 2 , × ), a multiplicatively-written cyclic group of order # ● 2 = # ● 1 = ℓ ◮ A bilinear pairing on ( ● 1 , ● 2 ) is a map ˆ e : ● 1 × ● 1 → ● 2 that satisfies the following conditions: • non-degeneracy: ˆ e ( P , P ) � = 1 ● 2 (equivalently ˆ e ( P , P ) generates ● 2 ) • bilinearity: e ( Q 1 + Q 2 , R ) = ˆ ˆ e ( Q 1 , R ) · ˆ e ( Q 2 , R ) ˆ e ( Q , R 1 + R 2 ) = ˆ e ( Q , R 1 ) · ˆ e ( Q , R 2 ) • computability: ˆ e can be efficiently computed ◮ Immediate property: for any two integers k 1 and k 2 e ( Q , R ) k 1 k 2 ˆ e ( k 1 Q , k 2 R ) = ˆ e ( Q , R ) k 2 k 1 ˆ k 1 Q k 2 R ˆ e Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 5 / 38

6 Pairings in cryptography ◮ At first, used to attack supersingular elliptic curves • Menezes-Okamoto-Vanstone and Frey-R¨ uck attacks, 1993 and 1994 DLP ● 1 kP Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 6 / 38

6 Pairings in cryptography ◮ At first, used to attack supersingular elliptic curves • Menezes-Okamoto-Vanstone and Frey-R¨ uck attacks, 1993 and 1994 DLP ● 1 < P DLP ● 2 e ( P , P ) k − → ˆ e ( kP , P ) = ˆ kP Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 6 / 38

6 Pairings in cryptography ◮ At first, used to attack supersingular elliptic curves • Menezes-Okamoto-Vanstone and Frey-R¨ uck attacks, 1993 and 1994 DLP ● 1 < P DLP ● 2 e ( P , P ) k − → ˆ e ( kP , P ) = ˆ kP • for cryptographic applications, we will also require the DLP in ● 2 to be hard Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 6 / 38

6 Pairings in cryptography ◮ At first, used to attack supersingular elliptic curves • Menezes-Okamoto-Vanstone and Frey-R¨ uck attacks, 1993 and 1994 DLP ● 1 < P DLP ● 2 e ( P , P ) k − → e ( kP , P ) = ˆ ˆ kP • for cryptographic applications, we will also require the DLP in ● 2 to be hard ◮ One-round three-party key agreement (Joux, 2000) ◮ Identity-based encryption • Boneh-Franklin, 2001 • Sakai-Kasahara, 2001 ◮ Short digital signatures • Boneh-Lynn-Shacham, 2001 • Zang-Safavi-Naini-Susilo, 2004 ◮ ... Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 6 / 38

7 Short signature (Boneh, Lynn & Shacham, 2001) PKI P a P Alice Bob a Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 7 / 38

7 Short signature (Boneh, Lynn & Shacham, 2001) PKI P a P Alice Bob a Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 7 / 38

7 Short signature (Boneh, Lynn & Shacham, 2001) PKI P a P Alice Bob a Message digest D Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 7 / 38

7 Short signature (Boneh, Lynn & Shacham, 2001) PKI P a P Alice Bob a Signature: Message digest aD D Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 7 / 38

7 Short signature (Boneh, Lynn & Shacham, 2001) PKI P a P Alice Bob a Signature: Message digest aD D Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 7 / 38

7 Short signature (Boneh, Lynn & Shacham, 2001) PKI P a P Alice Bob a Signature: Message digest aD D Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 7 / 38

7 Short signature (Boneh, Lynn & Shacham, 2001) PKI P a P Alice Bob a Signature: Message digest aD D Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 7 / 38

7 Short signature (Boneh, Lynn & Shacham, 2001) PKI P a P Alice Bob a aD D Signature: Message digest aD D Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 7 / 38

7 Short signature (Boneh, Lynn & Shacham, 2001) PKI P a P Alice Bob a aD D Signature: Message a P P digest aD D Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 7 / 38

7 Short signature (Boneh, Lynn & Shacham, 2001) PKI P a P Alice Bob a aD D Signature: Message a P P ˆ e ( D , aP ) ˆ e ( aD , P ) digest aD D Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 7 / 38

8 Outline of the talk ◮ Pairing-based cryptography ◮ Pairings over elliptic curves ◮ Finite-field arithmetic ◮ Implementation results ◮ Concluding thoughts Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 8 / 38

9 Pairings over elliptic curves ◮ We first define • ❋ q , a finite field, with q = 2 m , 3 m or p • E , an elliptic curve defined over ❋ q • ℓ , a large prime factor of # E ( ❋ q ) Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 9 / 38

9 Pairings over elliptic curves ◮ We first define • ❋ q , a finite field, with q = 2 m , 3 m or p • E , an elliptic curve defined over ❋ q • ℓ , a large prime factor of # E ( ❋ q ) ◮ ● 1 = E ( ❋ q )[ ℓ ], the ❋ q -rational ℓ -torsion of E : ● 1 = { P ∈ E ( ❋ q ) | ℓ P = O} Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 9 / 38

9 Pairings over elliptic curves ◮ We first define • ❋ q , a finite field, with q = 2 m , 3 m or p • E , an elliptic curve defined over ❋ q • ℓ , a large prime factor of # E ( ❋ q ) ◮ ● 1 = E ( ❋ q )[ ℓ ], the ❋ q -rational ℓ -torsion of E : ● 1 = { P ∈ E ( ❋ q ) | ℓ P = O} ◮ ● 2 = µ ℓ , the group of ℓ -th roots of unity in ❋ × q k : q k | U ℓ = 1 } ● 2 = { U ∈ ❋ × Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 9 / 38

9 Pairings over elliptic curves ◮ We first define • ❋ q , a finite field, with q = 2 m , 3 m or p • E , an elliptic curve defined over ❋ q • ℓ , a large prime factor of # E ( ❋ q ) ◮ ● 1 = E ( ❋ q )[ ℓ ], the ❋ q -rational ℓ -torsion of E : ● 1 = { P ∈ E ( ❋ q ) | ℓ P = O} ◮ ● 2 = µ ℓ , the group of ℓ -th roots of unity in ❋ × q k : q k | U ℓ = 1 } ● 2 = { U ∈ ❋ × ◮ k is the embedding degree, the smallest integer such that µ ℓ ⊆ ❋ × q k • usually large for ordinary elliptic curves • bounded in the case of supersingular elliptic curves (4 in characteristic 2; 6 in characteristic 3; and 2 in characteristic > 3) Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 9 / 38

9 Pairings over elliptic curves ◮ We first define • ❋ q , a finite field, with q = 2 m , 3 m or p • E , an elliptic curve defined over ❋ q • ℓ , a large prime factor of # E ( ❋ q ) ◮ ● 1 = E ( ❋ q )[ ℓ ], the ❋ q -rational ℓ -torsion of E : ● 1 = { P ∈ E ( ❋ q ) | ℓ P = O} ◮ ● 2 = µ ℓ , the group of ℓ -th roots of unity in ❋ × q k : q k | U ℓ = 1 } ● 2 = { U ∈ ❋ × ◮ k is the embedding degree, the smallest integer such that µ ℓ ⊆ ❋ × q k • usually large for ordinary elliptic curves • bounded in the case of supersingular elliptic curves (4 in characteristic 2; 6 in characteristic 3; and 2 in characteristic > 3) Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 9 / 38

10 The Tate pairing E ˆ e Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 10 / 38

10 The Tate pairing E P = ( x P , y P ) Q = ( x Q , y Q ) ˆ : E ( ❋ q )[ ℓ ] × E ( ❋ q )[ ℓ ] e ( , ) P Q Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 10 / 38

10 The Tate pairing ˆ e ( P , Q ) E µ ℓ P = ( x P , y P ) Q = ( x Q , y Q ) ⊆ ❋ × ˆ : E ( ❋ q )[ ℓ ] × E ( ❋ q )[ ℓ ] − → µ ℓ e q k ( , ) �− → ˆ e ( P , Q ) P Q Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 10 / 38

10 The Tate pairing ˆ e ( P , Q ) E µ ℓ P = ( x P , y P ) Q = ( x Q , y Q ) ⊆ ❋ × ˆ : E ( ❋ q )[ ℓ ] × E ( ❋ q )[ ℓ ] − → µ ℓ e q k ( , ) �− → e ( P , Q ) ˆ P Q ◮ Computation via Miller’s iterative algorithm: • m / 2 iterations over ❋ 2 m and ❋ 3 m ( η T pairing) • log 2 p iterations over ❋ p Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 10 / 38

11 Security considerations aP Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 11 / 38

11 Security considerations aP dlog ● 1 a Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 11 / 38

11 Security considerations aP dlog ● 1 a ◮ Discrete logarithm problem should be hard in ● 1 Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 11 / 38

11 Security considerations aP dlog ● 1 a ◮ Discrete logarithm problem should be hard in ● 1 aP Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 11 / 38

11 Security considerations aP dlog ● 1 a ◮ Discrete logarithm problem should be hard in ● 1 aP P Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 11 / 38

11 Security considerations aP dlog ● 1 a ◮ Discrete logarithm problem should be hard in ● 1 aP a ˆ e ( P , P ) ˆ e P Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 11 / 38

11 Security considerations aP dlog ● 1 a ◮ Discrete logarithm problem should be hard in ● 1 aP a ˆ e ( P , P ) dlog ● 2 ˆ e a P Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 11 / 38

11 Security considerations aP dlog ● 1 a ◮ Discrete logarithm problem should be hard in ● 1 aP a e ( P , P ) ˆ dlog ● 2 ˆ e a P ◮ Discrete logarithm problem should be hard in ● 2 Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 11 / 38

12 Security considerations e : E ( ❋ q )[ ℓ ] × E ( ❋ q )[ ℓ ] → µ ℓ ⊆ ❋ × ˆ q k Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 12 / 38

12 Security considerations e : E ( ❋ q )[ ℓ ] × E ( ❋ q )[ ℓ ] → µ ℓ ⊆ ❋ × ˆ q k ◮ Discrete logarithm in ● 1 = E ( ❋ q )[ ℓ ] (Pollard’s ρ ): √ ℓ ≈ √ q ◮ Discrete logarithm in ● 2 = µ ℓ ⊆ ❋ × q k (FFS or NFS): � � 1 2 c · (ln q k ) 3 · (ln ln q k ) exp 3 Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 12 / 38

12 Security considerations e : E ( ❋ q )[ ℓ ] × E ( ❋ q )[ ℓ ] → µ ℓ ⊆ ❋ × ˆ q k ◮ Discrete logarithm in ● 1 = E ( ❋ q )[ ℓ ] (Pollard’s ρ ): � 1 � √ ℓ ≈ √ q = exp 2 · (ln q ) ◮ Discrete logarithm in ● 2 = µ ℓ ⊆ ❋ × q k (FFS or NFS): � � 1 2 c · (ln q k ) 3 · (ln ln q k ) exp 3 Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 12 / 38

12 Security considerations e : E ( ❋ q )[ ℓ ] × E ( ❋ q )[ ℓ ] → µ ℓ ⊆ ❋ × ˆ q k ◮ Discrete logarithm in ● 1 = E ( ❋ q )[ ℓ ] (Pollard’s ρ ): � 1 � √ ℓ ≈ √ q = exp 2 · (ln q ) ◮ Discrete logarithm in ● 2 = µ ℓ ⊆ ❋ × q k (FFS or NFS): � � 1 2 c · (ln q k ) 3 · (ln ln q k ) exp 3 ◮ The discrete logarithm problem is usually easier in ● 2 than in ● 1 • current security: ∼ 2 80 , equivalent to 80-bit symmetric encryption or RSA-1024 • recommended security: ∼ 2 128 (AES-128, RSA-3072) Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 12 / 38

13 Security considerations e : E ( ❋ q )[ ℓ ] × E ( ❋ q )[ ℓ ] → µ ℓ ⊆ ❋ × ˆ q k ◮ The embedding degree k depends on the field characteristic q Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 13 / 38

13 Security considerations e : E ( ❋ q )[ ℓ ] × E ( ❋ q )[ ℓ ] → µ ℓ ⊆ ❋ × ˆ q k ◮ The embedding degree k depends on the field characteristic q Base field ( ❋ q ) ❋ 2 m ❋ 3 m ❋ p Embedding degree ( k ) 4 6 2 Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 13 / 38

13 Security considerations e : E ( ❋ q )[ ℓ ] × E ( ❋ q )[ ℓ ] → µ ℓ ⊆ ❋ × ˆ q k ◮ The embedding degree k depends on the field characteristic q Base field ( ❋ q ) ❋ 2 m ❋ 3 m ❋ p Embedding degree ( k ) 4 6 2 Lower security ( ∼ 2 64 ) m = 239 m = 97 | p | ≈ 256 bits Medium security ( ∼ 2 80 ) m = 373 m = 163 | p | ≈ 512 bits Higher security ( ∼ 2 128 ) m = 1103 m = 503 | p | ≈ 1536 bits Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 13 / 38

13 Security considerations e : E ( ❋ q )[ ℓ ] × E ( ❋ q )[ ℓ ] → µ ℓ ⊆ ❋ × ˆ q k ◮ The embedding degree k depends on the field characteristic q Base field ( ❋ q ) ❋ 2 m ❋ 3 m ❋ p Embedding degree ( k ) 4 6 2 Lower security ( ∼ 2 64 ) m = 239 m = 97 | p | ≈ 256 bits Medium security ( ∼ 2 80 ) m = 373 m = 163 | p | ≈ 512 bits Higher security ( ∼ 2 128 ) m = 1103 m = 503 | p | ≈ 1536 bits ◮ ❋ 2 m : simpler finite field arithmetic Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 13 / 38

13 Security considerations e : E ( ❋ q )[ ℓ ] × E ( ❋ q )[ ℓ ] → µ ℓ ⊆ ❋ × ˆ q k ◮ The embedding degree k depends on the field characteristic q Base field ( ❋ q ) ❋ 2 m ❋ 3 m ❋ p Embedding degree ( k ) 4 6 2 Lower security ( ∼ 2 64 ) m = 239 m = 97 | p | ≈ 256 bits Medium security ( ∼ 2 80 ) m = 373 m = 163 | p | ≈ 512 bits Higher security ( ∼ 2 128 ) m = 1103 m = 503 | p | ≈ 1536 bits ◮ ❋ 2 m : simpler finite field arithmetic ◮ ❋ 3 m : smaller field extension Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 13 / 38

13 Security considerations e : E ( ❋ q )[ ℓ ] × E ( ❋ q )[ ℓ ] → µ ℓ ⊆ ❋ × ˆ q k ◮ The embedding degree k depends on the field characteristic q Base field ( ❋ q ) ❋ 2 m ❋ 3 m ❋ p Embedding degree ( k ) 4 6 2 Lower security ( ∼ 2 64 ) m = 239 m = 97 | p | ≈ 256 bits Medium security ( ∼ 2 80 ) m = 373 m = 163 | p | ≈ 512 bits Higher security ( ∼ 2 128 ) m = 1103 m = 503 | p | ≈ 1536 bits ◮ ❋ 2 m : simpler finite field arithmetic ◮ ❋ 3 m : smaller field extension ◮ ❋ p : prohibitive field sizes Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 13 / 38

13 Security considerations e : E ( ❋ q )[ ℓ ] × E ( ❋ q )[ ℓ ] → µ ℓ ⊆ ❋ × ˆ q k ◮ The embedding degree k depends on the field characteristic q Base field ( ❋ q ) ❋ 2 m ❋ 3 m ❋ p Embedding degree ( k ) 4 6 2 Lower security ( ∼ 2 64 ) m = 239 m = 97 | p | ≈ 256 bits Medium security ( ∼ 2 80 ) m = 373 m = 163 | p | ≈ 512 bits Higher security ( ∼ 2 128 ) m = 1103 m = 503 | p | ≈ 1536 bits ◮ ❋ 2 m : simpler finite field arithmetic ◮ ❋ 3 m : smaller field extension ◮ ❋ p : prohibitive field sizes Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 13 / 38

14 Computation of the Tate pairing ˆ e : E ( ❋ p m )[ ℓ ] × E ( ❋ p m )[ ℓ ] → µ ℓ ⊆ ❋ × p km Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 14 / 38

14 Computation of the Tate pairing ˆ e : E ( ❋ p m )[ ℓ ] × E ( ❋ p m )[ ℓ ] → µ ℓ ⊆ ❋ × p km ◮ Arithmetic over ❋ p m : • polynomial basis: ❋ p m ∼ = ❋ p [ x ] / ( f ( x )) • f ( x ), degree- m polynomial irreducible over ❋ p Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 14 / 38

14 Computation of the Tate pairing ˆ e : E ( ❋ p m )[ ℓ ] × E ( ❋ p m )[ ℓ ] → µ ℓ ⊆ ❋ × p km ◮ Arithmetic over ❋ p m : • polynomial basis: ❋ p m ∼ = ❋ p [ x ] / ( f ( x )) • f ( x ), degree- m polynomial irreducible over ❋ p ◮ Arithmetic over ❋ × p km : • tower-field representation • only arithmetic over the underlying field ❋ p m Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 14 / 38

14 Computation of the Tate pairing ˆ e : E ( ❋ p m )[ ℓ ] × E ( ❋ p m )[ ℓ ] → µ ℓ ⊆ ❋ × p km ◮ Arithmetic over ❋ p m : • polynomial basis: ❋ p m ∼ = ❋ p [ x ] / ( f ( x )) • f ( x ), degree- m polynomial irreducible over ❋ p ◮ Arithmetic over ❋ × p km : • tower-field representation • only arithmetic over the underlying field ❋ p m ◮ Operations over ❋ p m : Characteristic 2 Characteristic 3 Base field ( ❋ p m ) ❋ 2 m ❋ 2 313 ❋ 3 m ❋ 3 127 27 ⌊ m 119 ⌊ m + / − 2 ⌋ + 75 4287 4 ⌋ + 260 3949 7 ⌊ m 25 ⌊ m × 2 ⌋ + 29 1121 4 ⌋ + 93 868 17 ⌊ m a p 6 m + 9 1887 2 ⌋ + 8 1079 a − 1 1 1 1 1 Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 14 / 38

14 Computation of the Tate pairing ˆ e : E ( ❋ p m )[ ℓ ] × E ( ❋ p m )[ ℓ ] → µ ℓ ⊆ ❋ × p km ◮ Arithmetic over ❋ p m : • polynomial basis: ❋ p m ∼ = ❋ p [ x ] / ( f ( x )) • f ( x ), degree- m polynomial irreducible over ❋ p ◮ Arithmetic over ❋ × p km : • tower-field representation • only arithmetic over the underlying field ❋ p m ◮ Operations over ❋ p m : Characteristic 2 Characteristic 3 Base field ( ❋ p m ) ❋ 2 m ❋ 2 313 ❋ 3 m ❋ 3 127 27 ⌊ m 119 ⌊ m + / − 2 ⌋ + 75 4287 4 ⌋ + 260 3949 7 ⌊ m 25 ⌊ m × 2 ⌋ + 29 1121 4 ⌋ + 93 868 17 ⌊ m a p 6 m + 9 1887 2 ⌋ + 8 1079 a − 1 1 1 1 1 ◮ Software not well suited to small characteristic: need for hardware acceleration Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 14 / 38

15 Outline of the talk ◮ Pairing-based cryptography ◮ Pairings over elliptic curves ◮ Finite-field arithmetic ◮ Implementation results ◮ Concluding thoughts Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 15 / 38

15 Outline of the talk ◮ Pairing-based cryptography ◮ Pairings over elliptic curves ◮ Finite-field arithmetic (only in characteristic 3) ◮ Implementation results ◮ Concluding thoughts Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 15 / 38

16 Arithmetic over ❋ 3 m ◮ f ∈ ❋ 3 [ x ]: degree- m irreducible polynomial over ❋ 3 f = x m + f m − 1 x m − 1 + · · · + f 1 x + f 0 Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 16 / 38

16 Arithmetic over ❋ 3 m ◮ f ∈ ❋ 3 [ x ]: degree- m irreducible polynomial over ❋ 3 f = x m + f m − 1 x m − 1 + · · · + f 1 x + f 0 ◮ ❋ 3 m ∼ = ❋ 3 [ x ] / ( f ) ◮ a ∈ ❋ 3 m : a = a m − 1 x m − 1 + · · · + a 1 x + a 0 ◮ Each element of ❋ 3 stored using two bits Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 16 / 38

17 Addition over ❋ 3 m a b a + b ◮ r = a + b = ( a m − 1 + b m − 1 ) x m − 1 + · · · + ( a 1 + b 1 ) x + ( a 0 + b 0 ) Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 17 / 38

17 Addition over ❋ 3 m a m − 1 b m − 1 a 1 b 1 a 0 b 0 a b a + b ( + ) ( + ) ( + ) a m − 1 b m − 1 a 1 b 1 a 0 b 0 mod 3 mod 3 mod 3 ◮ r = a + b = ( a m − 1 + b m − 1 ) x m − 1 + · · · + ( a 1 + b 1 ) x + ( a 0 + b 0 ) • coefficient-wise additions over ❋ 3 : r i = ( a i + b i ) mod 3 Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 17 / 38

17 Addition over ❋ 3 m a m − 1 b m − 1 a 1 b 1 a 0 b 0 a b + 0 1 2 0 0 1 2 1 1 2 0 2 2 0 1 a + b ( + ) ( + ) ( + ) a m − 1 b m − 1 a 1 b 1 a 0 b 0 mod 3 mod 3 mod 3 ◮ r = a + b = ( a m − 1 + b m − 1 ) x m − 1 + · · · + ( a 1 + b 1 ) x + ( a 0 + b 0 ) • coefficient-wise additions over ❋ 3 : r i = ( a i + b i ) mod 3 • addition over ❋ 3 : small look-up tables Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 17 / 38

18 Addition, subtraction and accumulation over ❋ 3 m load add/sub enable c 0 c 2 c 5 + / − a R 0 r + / − b R 1 0 c 1 c 3 c 4 load add/sub accumulate • sign selection: multiplication by 1 or 2 − a ≡ 2 a (mod 3) • feedback loop for accumulation Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 18 / 38

19 Multiplication over ❋ 3 m ◮ Parallel-serial multiplication • multiplicand loaded in a parallel register • multiplier loaded in a shift register ◮ Most significant coefficients first (Horner scheme) � m � ◮ D coefficients processed at each clock cycle: cycles per multiplication D Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 19 / 38

20 Multiplication over ❋ 3 m ◮ Example for D = 3 (3 coefficients per iteration): x m − 1 x 2 · · · x 1 a b Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 20 / 38

20 Multiplication over ❋ 3 m ◮ Example for D = 3 (3 coefficients per iteration): x m − 1 x 2 · · · x 1 a b Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 20 / 38

20 Multiplication over ❋ 3 m ◮ Example for D = 3 (3 coefficients per iteration): x m − 1 x 2 · · · x 1 a b · b m − 1 a · b m − 2 a b m − 3 · a Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 20 / 38

20 Multiplication over ❋ 3 m ◮ Example for D = 3 (3 coefficients per iteration): x m − 1 x 2 · · · x 1 a b · x 2 · b m − 1 a · · x b m − 2 a b m − 3 · a Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 20 / 38

20 Multiplication over ❋ 3 m ◮ Example for D = 3 (3 coefficients per iteration): x m − 1 x 2 · · · x 1 a b · x 2 · b m − 1 a · · x b m − 2 a b m − 3 · a Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 20 / 38

20 Multiplication over ❋ 3 m ◮ Example for D = 3 (3 coefficients per iteration): x m − 1 x 2 · · · x 1 a b · x 2 ( · ) mod f b m − 1 a ( · · x ) mod f b m − 2 a b m − 3 · a Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 20 / 38

20 Multiplication over ❋ 3 m ◮ Example for D = 3 (3 coefficients per iteration): x m − 1 x 2 · · · x 1 a b · x 2 ( · ) mod f b m − 1 a ( · · x ) mod f b m − 2 a b m − 3 · a r (partial sum) Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 20 / 38

20 Multiplication over ❋ 3 m ◮ Example for D = 3 (3 coefficients per iteration): x m − 1 x 2 · · · x 1 a b · x 2 · x 2 ( ( b m − 1 · · ) mod f ) mod f b m − 1 a a ( b m − 2 · ( · · x · x ) mod f ) mod f b m − 2 a a b m − 3 b m − 3 · · a a r (partial sum) Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 20 / 38

20 Multiplication over ❋ 3 m ◮ Example for D = 3 (3 coefficients per iteration): x m − 1 x 2 · · · x 1 a b · x 2 · x 2 ( ( b m − 1 · · ) mod f ) mod f b m − 1 a a ( b m − 2 · ( · · x · x ) mod f ) mod f b m − 2 a a b m − 3 b m − 3 · · a a r (partial sum) Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 20 / 38

20 Multiplication over ❋ 3 m ◮ Example for D = 3 (3 coefficients per iteration): x m − 1 x 2 · · · x 1 a b · x 2 · x 2 ( ( b m − 1 · · ) mod f ) mod f b m − 1 a a ( b m − 2 · ( · · x · x ) mod f ) mod f b m − 2 a a b m − 3 · b m − 3 · a a r (partial sum) · b m − 4 a · b m − 5 a b m − 6 · a Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 20 / 38

20 Multiplication over ❋ 3 m ◮ Example for D = 3 (3 coefficients per iteration): x m − 1 x 2 · · · x 1 a b · x 2 · x 2 ( b m − 1 · ( · ) ) mod f mod f b m − 1 a a ( ( b m − 2 · · · x · x ) mod f ) mod f b m − 2 a a b m − 3 · b m − 3 · a a · x 3 r (partial sum) · x 2 · b m − 4 a · · x b m − 5 a b m − 6 · a Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 20 / 38

20 Multiplication over ❋ 3 m ◮ Example for D = 3 (3 coefficients per iteration): x m − 1 x 2 · · · x 1 a b · x 2 · x 2 ( b m − 1 · ( · ) ) mod f mod f b m − 1 a a ( ( b m − 2 · · · x · x ) mod f ) mod f b m − 2 a a b m − 3 · b m − 3 · a a · x 3 r (partial sum) · x 2 · b m − 4 a · · x b m − 5 a b m − 6 · a Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 20 / 38

20 Multiplication over ❋ 3 m ◮ Example for D = 3 (3 coefficients per iteration): x m − 1 x 2 · · · x 1 a b · x 2 · x 2 ( b m − 1 · ( · ) ) mod f mod f b m − 1 a a ( b m − 2 · ( · · x · x ) mod f ) mod f b m − 2 a a b m − 3 · b m − 3 · a a · x 3 ( r (partial sum) ) mod f · x 2 ( · ) mod f b m − 4 a ( · · x ) mod f b m − 5 a b m − 6 · a Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 20 / 38

20 Multiplication over ❋ 3 m ◮ Example for D = 3 (3 coefficients per iteration): x m − 1 x 2 · · · x 1 a b · x 2 · x 2 ( b m − 1 · ( · ) ) mod f mod f b m − 1 a a ( b m − 2 · ( · · x · x ) mod f ) mod f b m − 2 a a b m − 3 · b m − 3 · a a · x 3 ( r (partial sum) ) mod f · x 2 ( · ) mod f b m − 4 a ( · · x ) mod f b m − 5 a b m − 6 · a r (partial sum) Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 20 / 38

20 Multiplication over ❋ 3 m ◮ Example for D = 3 (3 coefficients per iteration): x m − 1 x 2 · · · x 1 a b · x 2 · x 2 ( ( b m − 1 · · ) ) mod f mod f b m − 1 a a ( ( b m − 2 · · · x · x ) ) mod f mod f b m − 2 a a b m − 3 · b m − 3 · a a · x 3 · x 3 ( ( r (partial sum) ) mod f ) mod f r · x 2 · x 2 ( b m − 4 · ( · ) ) mod f mod f b m − 4 a a ( ( b m − 5 · · · x · x ) mod f ) mod f b m − 5 a a b m − 6 b m − 6 · · a a r (partial sum) Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 20 / 38

20 Multiplication over ❋ 3 m ◮ Example for D = 3 (3 coefficients per iteration): x m − 1 x 2 · · · x 1 a b · x 2 · x 2 ( ( b m − 1 · · ) ) mod f mod f b m − 1 a a ( ( b m − 2 · · · x · x ) ) mod f mod f b m − 2 a a b m − 3 · b m − 3 · a a · x 3 · x 3 ( ( r (partial sum) ) mod f ) mod f r · x 2 · x 2 ( b m − 4 · ( · ) ) mod f mod f b m − 4 a a ( ( b m − 5 · · · x · x ) mod f ) mod f b m − 5 a a b m − 6 b m − 6 · · a a r (partial sum) Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 20 / 38

20 Multiplication over ❋ 3 m ◮ Example for D = 3 (3 coefficients per iteration): x m − 1 x 2 · · · x 1 a b · x 2 · x 2 ( ( b m − 1 · · ) ) mod f mod f b m − 1 a a ( ( b m − 2 · · · x · x ) ) mod f mod f b m − 2 a a b m − 3 · b m − 3 · a a · x 3 · x 3 ( ( r (partial sum) ) mod f ) mod f r · x 2 · x 2 ( b m − 4 · ( · ) ) mod f mod f b m − 4 a a ( ( b m − 5 · · · x · x ) mod f ) mod f b m − 5 a a b m − 6 b m − 6 · · a a r (partial sum) · · · Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 20 / 38

21 Multiplication over ❋ 3 m ◮ Computing the partial products b j · a : • coefficient-wise multiplication over ❋ 3 : ( b j · a i ) mod 3 • multiplications over ❋ 3 : small look-up tables Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 21 / 38

21 Multiplication over ❋ 3 m ◮ Computing the partial products b j · a : • coefficient-wise multiplication over ❋ 3 : ( b j · a i ) mod 3 • multiplications over ❋ 3 : small look-up tables ◮ Multiplication by x j : simple shift (only wires) Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 21 / 38

21 Multiplication over ❋ 3 m ◮ Computing the partial products b j · a : • coefficient-wise multiplication over ❋ 3 : ( b j · a i ) mod 3 • multiplications over ❋ 3 : small look-up tables ◮ Multiplication by x j : simple shift (only wires) ◮ Modulo f reduction: • f = x m + f m − 1 x m − 1 + · · · + f 1 x + f 0 gives x m ≡ ( − f m − 1 ) x m − 1 + · · · + ( − f 1 ) x + ( − f 0 ) (mod f ) • highest degree of polynomial to reduce: m + D − 1 • if f is carefully selected ( e.g. a trinomial or pentanomial), only a few multiplications and additions over ❋ 3 Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 21 / 38

21 Multiplication over ❋ 3 m ◮ Computing the partial products b j · a : • coefficient-wise multiplication over ❋ 3 : ( b j · a i ) mod 3 • multiplications over ❋ 3 : small look-up tables ◮ Multiplication by x j : simple shift (only wires) ◮ Modulo f reduction: • f = x m + f m − 1 x m − 1 + · · · + f 1 x + f 0 gives x m ≡ ( − f m − 1 ) x m − 1 + · · · + ( − f 1 ) x + ( − f 0 ) (mod f ) • highest degree of polynomial to reduce: m + D − 1 • if f is carefully selected ( e.g. a trinomial or pentanomial), only a few multiplications and additions over ❋ 3 • example for m = 97: f = x 97 + x 12 + 2 Jean-Luc Beuchat – Hardware Operators for Pairing-Based Cryptography – Part I: Because size matters 21 / 38