Lightweight Coprocessor for Koblitz Curves: 283-bit ECC Including - PowerPoint PPT Presentation

Lightweight Coprocessor for Koblitz Curves: 283-bit ECC Including Scalar Conversion with only 4300 Gates S. Sinha Roy, K. Järvinen , I. Verbauwhede KU Leuven ESAT/COSIC Leuven, Belgium K. Järvinen, CHES 2015, Sept. 14, 2015

Introduction 2/17 We present a lightweight coprocessor for the 283-bit Koblitz curve The first lightweight implementation of a high security curve The first to include on-the-fly lightweight conversion One of the smallest ECC coprocessors A large set of side-channel countermeasures K. Järvinen, CHES 2015, Sept. 14, 2015

High-level Architecture 3/17 Point multiplication Q = kP : CPU RAM K. Järvinen, CHES 2015, Sept. 14, 2015

High-level Architecture 3/17 Point multiplication Q = kP : CPU RAM ECC RAM K. Järvinen, CHES 2015, Sept. 14, 2015

High-level Architecture 3/17 Point multiplication Q = kP : CPU RAM k, P ECC RAM Q intermediate values K. Järvinen, CHES 2015, Sept. 14, 2015

High-level Architecture 3/17 Point multiplication Q = kP : CPU RAM ECC K. Järvinen, CHES 2015, Sept. 14, 2015

High-level Architecture 3/17 Point multiplication Q = kP : CPU RAM k , P ECC K. Järvinen, CHES 2015, Sept. 14, 2015

High-level Architecture 3/17 Point multiplication Q = kP : CPU RAM intermediate values ECC K. Järvinen, CHES 2015, Sept. 14, 2015

High-level Architecture 3/17 Point multiplication Q = kP : CPU RAM Q ECC K. Järvinen, CHES 2015, Sept. 14, 2015

Koblitz Curves 4/17 Binary curves which are included in many standards (e.g., NIST) Example (Point multiplication Q = kP ) · · · add dbl dbl add dbl add dbl dbl add dbl add K. Järvinen, CHES 2015, Sept. 14, 2015

Koblitz Curves 4/17 Binary curves which are included in many standards (e.g., NIST) Point doublings can be replaced with cheap Frobenius maps: φ : ( x, y ) �→ ( x 2 , y 2 ) Example (Point multiplication Q = kP ) · · · add dbl dbl add dbl add dbl dbl add dbl add · · · add add add add K. Järvinen, CHES 2015, Sept. 14, 2015

Koblitz Curves 4/17 Binary curves which are included in many standards (e.g., NIST) Point doublings can be replaced with cheap Frobenius maps: φ : ( x, y ) �→ ( x 2 , y 2 ) . . . but first the integer k needs to be converted to a τ -adic i =0 k i τ i where τ = ( µ + √− 7) / 2 ∈ C expansion k = � ℓ − 1 Example (Point multiplication Q = kP ) · · · add dbl dbl add dbl add dbl dbl add dbl add · · · conversion add add add add K. Järvinen, CHES 2015, Sept. 14, 2015

Koblitz Curves 4/17 Binary curves which are included in many standards (e.g., NIST) Point doublings can be replaced with cheap Frobenius maps: φ : ( x, y ) �→ ( x 2 , y 2 ) . . . but first the integer k needs to be converted to a τ -adic i =0 k i τ i where τ = ( µ + √− 7) / 2 ∈ C expansion k = � ℓ − 1 Example (Point multiplication Q = kP ) · · · add dbl dbl add dbl add dbl dbl add dbl add · · · conversion add add add add F 2 m Z K. Järvinen, CHES 2015, Sept. 14, 2015

Secure Lightweight Conversion K. Järvinen, CHES 2015, Sept. 14, 2015

Conversions Algorithms 6/17 Our conversion algorithms are based on: (1) the lazy reduction by Brumley and Järvinen (2) the zero-free expansion by Okeya, Takagi, and Vuillaume K. Järvinen, CHES 2015, Sept. 14, 2015

Conversions Algorithms 6/17 Our conversion algorithms are based on: (1) the lazy reduction by Brumley and Järvinen (2) the zero-free expansion by Okeya, Takagi, and Vuillaume ⇒ Only (multiprecision) additions and subtractions (1): Integer k to ρ = b 0 + b 1 τ (2): ρ to τ -adic exp. ( a 0 , a 1 ) ← (1 , 0) , ( b 0 , b 1 ) ← (0 , 0) , i ← 0 ( d 0 , d 1 ) ← ( k, 0) while | b 0 | � = 1 or b 1 � = 0 do for i = 0 to m − 1 do u ← Ψ( b 0 + b 1 τ ) u ← d 0 mod 2 b 0 ← b 0 − u d 0 ← d 0 − u ( b 0 , b 1 ) ← ( b 1 − b 0 / 2 , − b 0 / 2) ( b 0 , b 1 ) ← ( b 0 + u · a 0 , b 1 + u · a 1 ) t i ← u ( d 0 , d 1 ) ← ( d 1 − d 0 / 2 , − d 0 / 2) i ← i + 1 ( a 0 , a 1 ) ← ( − 2 a 1 , a 0 − a 1 ) t i ← b 0 ρ = ( b 0 , b 1 ) ← ( b 0 + d 0 , b 1 + d 1 ) K. Järvinen, CHES 2015, Sept. 14, 2015

Modifications for Efficiency and Improved Security 7/17 m a m ± c m b K. Järvinen, CHES 2015, Sept. 14, 2015

Modifications for Efficiency and Improved Security 7/17 16 a 16 ± c 16 b K. Järvinen, CHES 2015, Sept. 14, 2015

Modifications for Efficiency and Improved Security 7/17 16 a 16 ± c 16 b K. Järvinen, CHES 2015, Sept. 14, 2015

Modifications for Efficiency and Improved Security 7/17 16 a 16 ± c 16 b K. Järvinen, CHES 2015, Sept. 14, 2015

Modifications for Efficiency and Improved Security 7/17 16 a 16 ± c 16 b K. Järvinen, CHES 2015, Sept. 14, 2015

Modifications for Efficiency and Improved Security 7/17 16 a 16 ± c 16 b K. Järvinen, CHES 2015, Sept. 14, 2015

Modifications for Efficiency and Improved Security 7/17 16 a 16 ± c 16 b K. Järvinen, CHES 2015, Sept. 14, 2015

Modifications for Efficiency and Improved Security 7/17 16 a 16 ± c 16 b K. Järvinen, CHES 2015, Sept. 14, 2015

Modifications for Efficiency and Improved Security 7/17 16 a 16 ± c 16 b Negations (e.g., − d 0 / 2 ) take about 1/3 of cycles 1 K. Järvinen, CHES 2015, Sept. 14, 2015

Modifications for Efficiency and Improved Security 7/17 16 a 16 ± c 16 b Negations (e.g., − d 0 / 2 ) take about 1/3 of cycles 1 ⇒ We use the modification ( d 0 / 2 − d 1 , d 0 / 2) instead of ( d 1 − d 0 / 2 , − d 0 / 2) ⇒ The signs will be incorrect but can be corrected K. Järvinen, CHES 2015, Sept. 14, 2015

Modifications for Efficiency and Improved Security (cont.) 8/17 b i + u · a i , where u = d 0 mod 2 ∈ { 0 , 1 } d 0 K. Järvinen, CHES 2015, Sept. 14, 2015

Modifications for Efficiency and Improved Security (cont.) 8/17 b i + u · a i , where u = d 0 mod 2 ∈ { 0 , 1 } d 0 u = 1 ⇒ b 0 + a 0 and b 1 + a 1 u = 0 ⇒ do nothing K. Järvinen, CHES 2015, Sept. 14, 2015

Modifications for Efficiency and Improved Security (cont.) 8/17 b i + u · a i , where u = d 0 mod 2 ∈ { 0 , 1 } d 0 u = 1 ⇒ b 0 + a 0 and b 1 + a 1 u = 0 ⇒ do nothing Bad SPA leakage! K. Järvinen, CHES 2015, Sept. 14, 2015

Modifications for Efficiency and Improved Security (cont.) 8/17 b i + u · a i , where u = d 0 mod 2 ∈ { 0 , 1 } d 0 u = 1 ⇒ b 0 + a 0 and b 1 + a 1 u = 0 ⇒ do nothing Bad SPA leakage! We select u ∈ {− 1 , 1 } by using Ψ( d 0 + d 1 τ ) 2 K. Järvinen, CHES 2015, Sept. 14, 2015

Modifications for Efficiency and Improved Security (cont.) 8/17 b i + u · a i , where u = d 0 mod 2 ∈ { 0 , 1 } d 0 u = 1 ⇒ b 0 + a 0 and b 1 + a 1 u = 0 ⇒ do nothing Bad SPA leakage! We select u ∈ {− 1 , 1 } by using Ψ( d 0 + d 1 τ ) 2 u = +1 ⇒ b 0 + a 0 and b 1 + a 1 u = − 1 ⇒ b 0 − a 0 and b 1 − a 1 K. Järvinen, CHES 2015, Sept. 14, 2015

Modifications for Efficiency and Improved Security (cont.) 8/17 b i + u · a i , where u = d 0 mod 2 ∈ { 0 , 1 } d 0 u = 1 ⇒ b 0 + a 0 and b 1 + a 1 u = 0 ⇒ do nothing Bad SPA leakage! We select u ∈ {− 1 , 1 } by using Ψ( d 0 + d 1 τ ) 2 u = +1 ⇒ b 0 + a 0 and b 1 + a 1 u = − 1 ⇒ b 0 − a 0 and b 1 − a 1 Similar operations ⇒ Improved SPA resistance! K. Järvinen, CHES 2015, Sept. 14, 2015

Point Multiplication K. Järvinen, CHES 2015, Sept. 14, 2015

Point Multiplication with Zero-free Expansions 10/17 Zero-free τ -adic expansion [Okeya et al, 2005] A τ -adic representation that represents k with k i ∈ {− 1 , 1 } Example 1¯ 1¯ 11111¯ 1111¯ 1¯ 1¯ 1 . . . 1¯ 111 K. Järvinen, CHES 2015, Sept. 14, 2015

Point Multiplication with Zero-free Expansions 10/17 Zero-free τ -adic expansion [Okeya et al, 2005] A τ -adic representation that represents k with k i ∈ {− 1 , 1 } Combined with w -bit windows and precomputations ⇒ Fast point multiplication of only ℓ/w point additions ⇒ Constant pattern of point operations Example w = 2 : 1¯ 1¯ 11111¯ 1111¯ 1¯ 1¯ 1 . . . 1¯ P +1 = φ ( P ) + P 111 P − 1 = φ ( P ) − P K. Järvinen, CHES 2015, Sept. 14, 2015

Point Multiplication with Zero-free Expansions 10/17 Zero-free τ -adic expansion [Okeya et al, 2005] A τ -adic representation that represents k with k i ∈ {− 1 , 1 } Combined with w -bit windows and precomputations ⇒ Fast point multiplication of only ℓ/w point additions ⇒ Constant pattern of point operations Example w = 2 : 1¯ 1¯ 11111¯ 1111¯ 1¯ 1¯ 1 . . . 1¯ P +1 = φ ( P ) + P 111 P − 1 = φ ( P ) − P + P − 1 K. Järvinen, CHES 2015, Sept. 14, 2015

Point Multiplication with Zero-free Expansions 10/17 Zero-free τ -adic expansion [Okeya et al, 2005] A τ -adic representation that represents k with k i ∈ {− 1 , 1 } Combined with w -bit windows and precomputations ⇒ Fast point multiplication of only ℓ/w point additions ⇒ Constant pattern of point operations Example φ 2 w = 2 : 1¯ 1¯ 11111¯ 1111¯ 1¯ 1¯ 1 . . . 1¯ P +1 = φ ( P ) + P 111 P − 1 = φ ( P ) − P + P − 1 K. Järvinen, CHES 2015, Sept. 14, 2015