Patent Grant
12101403
The present disclosure relates to scalar multiplication, and in particular, to an interleaved scalar multiplication for elliptic curve cryptography.
Elliptic-curve cryptography (ECC) is one of the public-key based cryptographies, and is based on the algebraic structure of elliptic curves over finite fields. ECC may allow much smaller keys compared to some other non-EC public-key based cryptographies while providing equivalent security. Scalar multiplications between scalars and parameters (e.g., EC points) are computer-intensive and dominate execution time of ECC or some other cryptography operations. However, there are various issues/problems associated with the scalar multiplication methods, particularly for example but not limited to, low efficiency and/or less resistant to side-channel attacks.
The present disclosure describes various embodiments for performing interleaved scalar multiplication for elliptic curve cryptography, addressing at least one of the issues/problems discussed above. The present disclosure improves the technical field of public-key based cryptography, particularly ECC, with at least one of the following improvements: achieving high efficiency for computing scalar multiplications, reducing the execution times for computing scalar multiplications, enhancing resistant to many forms of side-channel attacks, increasing algorithm flexibility in response to hardware contains, and/or improving cybersecurity in term of data transmission and storage.
The present disclosure describes various embodiments of methods, apparatus, and computer-readable storage medium for performing interleaved scalar multiplication for elliptic curve cryptography.
According to one aspect, an embodiment of the present disclosure provides a method for performing scalar multiplication between a scalar and a parameter. The method includes obtaining, by a device, a bit-number of a scalar, wherein the bit-number of the scalar is a number of bits in the scalar in a binary format. The device includes a memory storing instructions and a processor in communication with the memory. The method also includes factorizing, by the device, the bit-number of the scalar into a product of a plurality of factors, the plurality of factors comprising s, d, and w, wherein s, d, and w are positive integers; generating, by the device, d tables based on a parameter, each table comprising N entries, wherein N is a positive integer and a function of w; for each iteration of s iterations: multiplying, by the device, a result by two, constructing, by the device, an index for each table from w bits in the scalar in the binary format, selecting, by the device, a value from each table based on the constructed index for each table, and adding, by the device, the value selected from each table to the result and starting next iteration; and in response to completing the s iterations, determining, by the device, the result for a scalar multiplication between the scalar and the parameter.
According to another aspect, an embodiment of the present disclosure provides an apparatus for performing scalar multiplication between a scalar and a parameter. The apparatus includes a memory storing instructions; and a processor in communication with the memory. When the processor executes the instructions, the processor is configured to cause the apparatus to: obtain a bit-number of a scalar, wherein the bit-number of the scalar is a number of bits in the scalar in a binary format; factorize the bit-number of the scalar into a product of a plurality of factors, the plurality of factors comprising s, d, and w, wherein s, d, and w are positive integers; generate d tables based on a parameter, each table comprising N entries, wherein N is a positive integer and a function of w; for each iteration of s iterations: multiply a result by two, construct an index for each table from w bits in the scalar in the binary format, select a value from each table based on the constructed index for each table, and add the value selected from each table to the result and start next iteration; and in response to completing the s iterations, determine the result for a scalar multiplication between the scalar and the parameter.
In another aspect, an embodiment of the present disclosure provides a non-transitory computer readable storage medium storing instructions. When the instructions are executed by a processor, the instructions cause the processor to: obtain a bit-number of a scalar, wherein the bit-number of the scalar is a number of bits in the scalar in a binary format; factorize the bit-number of the scalar into a product of a plurality of factors, the plurality of factors comprising s, d, and w, wherein s, d, and w are positive integers; generate d tables based on a parameter, each table comprising N entries, wherein N is a positive integer and a function of w; for each iteration of s iterations: multiply a result by two, construct an index for each table from w bits in the scalar in the binary format, select a value from each table based on the constructed index for each table, and add the value selected from each table to the result and start next iteration; and in response to completing the s iterations, determine the result for a scalar multiplication between the scalar and the parameter.
The above and other aspects and their implementations are described in greater detail in the drawings, the descriptions, and the claims.
The invention will now be described in detail hereinafter with reference to the accompanied drawings, which form a part of the present invention, and which show, by way of illustration, specific examples of embodiments. Please note that the invention may, however, be embodied in a variety of different forms and, therefore, the covered or claimed subject matter is intended to be construed as not being limited to any of the embodiments to be set forth below. Please also note that the invention may be embodied as methods, devices, components, or systems. Accordingly, embodiments of the invention may, for example, take the form of hardware, software, firmware or any combination thereof.
Throughout the specification and claims, terms may have nuanced meanings suggested or implied in context beyond an explicitly stated meaning. The phrase “in one embodiment” or “in some embodiments” as used herein does not necessarily refer to the same embodiment and the phrase “in another embodiment” or “in other embodiments” as used herein does not necessarily refer to a different embodiment. Likewise, the phrase “in one implementation” or “in some implementations” as used herein does not necessarily refer to the same implementation and the phrase “in another implementation” or “in other implementations” as used herein does not necessarily refer to a different implementation. It is intended, for example, that claimed subject matter includes combinations of exemplary embodiments/implementations in whole or in part.
In general, terminology may be understood at least in part from usage in context. For example, terms, such as “and”, “or”, or “and/or,” as used herein may include a variety of meanings that may depend at least in part upon the context in which such terms are used. Typically, “or” if used to associate a list, such as A, B or C, is intended to mean A, B, and C, here used in the inclusive sense, as well as A, B or C, here used in the exclusive sense. In addition, the term “one or more” or “at least one” as used herein, depending at least in part upon context, may be used to describe any feature, structure, or characteristic in a singular sense or may be used to describe combinations of features, structures or characteristics in a plural sense. Similarly, terms, such as “a”, “an”, or “the”, again, may be understood to convey a singular usage or to convey a plural usage, depending at least in part upon context. In addition, the term “based on” or “determined by” may be understood as not necessarily intended to convey an exclusive set of factors and may, instead, allow for existence of additional factors not necessarily expressly described, again, depending at least in part on context.
Elliptic curve cryptography (ECC) is an approach to public-key cryptography based on the algebraic structure of elliptic curves over finite fields. Elliptic curves are applicable for key agreement, digital signatures, encryption, key transport and other schemes for general application within computer and communications systems.
ECC may allow much smaller keys compared to some other non-EC public-key based cryptographies while providing equivalent security. Using a smaller key size, ECC may reduce storage and transmission requirements. For example, Rivest-Shamir-Adleman (RSA) based cryptography is a widely used public-key cryptosystem for secure data transmission. In comparison to a popular RSA-based cryptography system with a large modulus and correspondingly larger key, ECC could provide the same level of security afforded by the RSA-based system with a much smaller key: for example, a 256-bit elliptic curve public key may provide comparable security to a 3072-bit RSA public key.
Scalar multiplications are compute-intensive and dominate the execution time of elliptic curve cryptographic operations. For example, when P is a point on an elliptic curve (E) of an order (N) and k is a positive integer, a multiplication between k and P may be defined as repeated addition of P by k times, i.e., k*P=P+P+ . . . +P (there are k Ps adding together). This multiplication operation may be called as elliptic curve scalar multiplication or elliptic curve point multiplication. In some implementations, P may include 2D coordinates (Px, Py), and thus, k*P may refer to k*(Px, Py)=(k*Px, k*Py). For scalar multiplication in ECC, one or both of k and P may be very large integer(s), which, for example, may be 256-bit or bigger integer(s).
Side-channel attacks on implementations of cryptosystems may include deriving secret information (e.g., private keys) by detecting (or measuring) at least one of the following: timing information, memory/cache storage/access information, or power consumption information. In elliptic curve cryptosystems, implementations of multiplication algorithms may be the primary targets for side-channel attacks.
There are various issues/problems associated with the scalar multiplication methods, particularly for example but not limited to, low efficiency and/or less resistant to side-channel attacks. The present disclosure describes various embodiments for performing interleaved scalar multiplication for elliptic curve cryptography, addressing at least one of the issues/problems discussed above. The present disclosure improves the technical field of public-key based cryptography, particularly ECC, with at least one of the following improvements: achieving high efficiency for computing scalar multiplications, reducing the execution times for computing scalar multiplications, enhancing resistant to many forms of side-channel attacks, increasing algorithm flexibility in response to hardware contains, and/or improving cybersecurity in term of data transmission and storage.
Various embodiments in the present disclosure describes methods for interleaved scalar multiplication, improving scalar multiplication algorithms in an elliptic curve cryptographic system. The operations based on various embodiments in the present disclosure may be more efficient than some other scalar multiplication algorithms and may be more resistant to side-channel attacks. As scalar multiplications are compute-intensive and dominate the execution time of elliptic curve cryptographic operations, the ECC system based on various embodiments in the present disclosure may increase performance and throughput of the ECC system, in comparison to other systems based on some other scalar multiplication algorithms.
In some implementations, a scalar k, which has n binary bits, may be represented as a n-bit binary number/integer, (k0, k1, . . . , kn-1), in a bit-level little-endian order, wherein k0, is the least significant bit, and kn-1 is the most significant bit.
In some implementations, scalar multiplications may be performed based on a binary expansion method. For example, the scalar multiplication operation may be expressed as the following algorithm, wherein the returned Q is the result for the scalar multiplication between k and P.
For n-bit scalar k, the complexity of binary expansion method is about n double operation and n/2 addition (on average, a half of bits of the scalar k is “1” and the other half of bits is “0”). When n is 256, the complexity is about 256 double and 128 additions.
In some implementations, scalar multiplication based on the binary expansion method may be vulnerable to side-channel attacks. For scalar multiplication based on the binary expansion method, given the fact that the addition of “Q+P” is only performed when the corresponding bit is “1” and the addition of “Q+P” is not performed when the corresponding bit is “0”, secret information about bits of the scalar k may be extracted by monitoring a power consumption and/or a computing time duration.
In some implementations, scalar multiplications may be performed based on a Montgomery ladder method. For example, the scalar multiplication operation may be expressed as the following algorithm, wherein the returned R0 is the result for the scalar multiplication between k and P.
For n-bit scalar k, the complexity of the Montgomery ladder method is about n double operation and n addition. If n is 256, the complexity is about 256 double and 256 additions.
In some implementations, scalar multiplication based on the Montgomery ladder method may be inefficient. For scalar multiplication based on the Montgomery ladder method, an addition operation (“R0+R1”) and a double operation (“2R0” or “2R0”) are performed for each bit in the n-bit scalar k. Since the number of addition operation and double operation does not depend on the value of each bit in the n-bit scalar k, the Montgomery ladder approach computes the point multiplication in a fixed amount of time, which may be beneficial when timing or power consumption measurements are exposed to an attacker performing a side-channel attack.
In some implementations, scalar multiplications based on the Montgomery ladder method may be vulnerable to side-channel attacks based on information other than timing or power. For example, scalar multiplications based on the Montgomery ladder method may be vulnerable to memory based side-channel attacks (e.g., flush and/or reload of memory/cache).
In some implementations, scalar multiplications may be performed based on a windowed method, wherein a single table including pre-computed values is used. In the windowed method, a window size w is selected and a table including all 2w values of ki*P is pre-computed for i=0, 1, 2, . . . , 2w−1. The algorithm may use the representation k=k0+2wk1+22wk2+ . . . +2mwkm, where m=n/w for n-bit integer K. For example, the scalar multiplication operation may be expressed as the following algorithm, wherein the returned Q is the result for the scalar multiplication between K and P.
In some implementations, the value of w in a windowed method may be chosen to be a small number so that the storage of the pre-computed values is in a reasonable size. For a non-limiting example, w=4 may be one of the best choices in practice. For n-bit scalar K, the complexity of windowed method is about n point double operations and at most n/w point addition operations.
In some implementations, scalar multiplication based on the windowed method may be vulnerable to side-channel attacks, given the fact that the point addition (“Q+kiP”) is not performed when the k is zero and the point addition (“Q+kiP”) is performed when the ki>zero. Secret information about bits of the scalar k may be extracted by monitoring a power consumption and/or a computing time duration.
In some implementations, scalar multiplications may be performed based on a safe-select windowed method, which may have high resistant to the side-channel attacks. The safe-select windowed method may use a single table including pre-computed values. In the safe-select windowed method, a window size w is selected and a table including all 2w values is pre-computed. The safe-select windowed method uses safe-select technologies. Safe-select is an implementation specific function to select the appropriate table entry without leaking information about the secret scalar. For example, by using safe-select, the scalar multiplication operation based on safe-select windowed method may be expressed as the following algorithm, wherein the returned Q is the result for the scalar multiplication between k and P.
In some implementations, for n-bit scalar K, the complexity of safe-select windowed method is about n point double operation and n/w point addition. For a non-limiting example, when n is 256 and w is 4, the complexity is about 256 double and 64 additions.
The present disclosure describes various embodiments for performing interleaved scalar multiplication program, which is an improved elliptic curve scalar multiplication algorithm. Various embodiments of interleaved scalar multiplication may be is more efficient than the basic binary expansion method and be more resistant to side-channel attacks. Various embodiments in the present disclosure may be easily implemented in software and/or hardware, increasing performance and throughput of systems that use elliptic curve cryptography.
In some implementations according to any one or any combination of the implementations or embodiments described in the present disclosure, N is equal to 2{circumflex over ( )}w.
In some implementations according to any one or any combination of the implementations or embodiments described in the present disclosure, an entry in the table with a table index of j is generated according to: (b_0+b_1*2{circumflex over ( )}64+ . . . +b_(w−1)*2{circumflex over ( )}((w−1)*d*s))*2{circumflex over ( )}(j*s)*P, wherein b_0, b_1, . . . , b_(w−1) are one-bit binary numbers, {b_0, b_1, . . . , b_(w−1)) is an entry index for the entry, j is an integer between 0 and 3, inclusive, and P is the parameter.
In some implementations according to any one or any combination of the implementations or embodiments described in the present disclosure, the method 100 may further include, before starting a first iteration of the s iterations, setting the result as zero.
In some implementations according to any one or any combination of the implementations or embodiments described in the present disclosure, the scalar comprises n bits {k_0, k_1, . . . , k_(n−1)} in a bit-level little-endian order, n being the bit-number of the scalar; i corresponds to an iteration index among the s iterations, i being an integer between 0 and (s−1), inclusive; and j corresponds to a table index among the d tables, j being an integer between 0 and (d−1), inclusive.
In some implementations according to any one or any combination of the implementations or embodiments described in the present disclosure, the constructing the index for each table from w bits in the scalar in the binary format comprises: constructing the index for each table from the w bits, k_(i+j*s+h*d*s), in the scalar in the bit-level little-endian order, h being an integer between 0 and (w−1), inclusive.
In some implementations according to any one or any combination of the implementations or embodiments described in the present disclosure, the constructed index comprises w bits of {k_(i+j*s), k_(i+j*s+d*s), . . . , k_(i+j*s+(w−1)*d*s)}.
In some implementations according to any one or any combination of the implementations or embodiments described in the present disclosure, the selecting the value from each table based on the constructed index for each table comprises: selecting the value from each table by a constant-time table look-up process based on the constructed index for each table.
In some implementations according to any one or any combination of the implementations or embodiments described in the present disclosure, in response to the bit-number of the scalar being 256, s is 16, d is 4, and w is 4; and an entry in the table with a table index of j is generated according to: (b_0+b_1*2{circumflex over ( )}64+b_2*2{circumflex over ( )}128+b_3*2{circumflex over ( )}192)*2{circumflex over ( )}(j*16)*P, wherein b_0, b_1, b_2, and b_3 are one-bit binary numbers, {b_0, b_1, b_2, b_3} is an entry index for the entry, j being an integer between 0 and 3, inclusive, and P is the parameter.
In some implementations according to any one or any combination of the implementations or embodiments described in the present disclosure, an entry in a first table is generated according to (b_0+b_1*2{circumflex over ( )}64+b_2*2{circumflex over ( )}128+b_3*2{circumflex over ( )}192)*P; an entry in a second table is generated according to (b_0+b_1*2{circumflex over ( )}64+b_2*2{circumflex over ( )}128+b_3*2{circumflex over ( )}192)*2{circumflex over ( )}16*P; an entry in a third table is generated according to (b_0+b_1*2{circumflex over ( )}64+b_2*2{circumflex over ( )}128+b_3*2{circumflex over ( )}192)*2{circumflex over ( )}32*P; and an entry in a fourth table is generated according to (b_0+b_1*2{circumflex over ( )}64+b_2*2{circumflex over ( )}128+b_3*2{circumflex over ( )}192)*2{circumflex over ( )}48*P.
In some implementations according to any one or any combination of the implementations or embodiments described in the present disclosure, in response to the bit-number of the scalar being 256, s is 16, d is 4, and w is 4; the scalar is represented by n bits {k_0, k_1, . . . , k_255} in a bit-level little-endian order; i corresponds to an iteration index among the 16 iterations, i being an integer between 0 and 15, inclusive; j corresponds to a table index among the 4 tables, j being an integer between 0 and 3, inclusive; and the constructed index comprises 4 bits of {k_(i+j*16), k_(i+j*16+64), k_(i+j*16+128), k_(i+j*16+192)}.
In some implementations according to any one or any combination of the implementations or embodiments described in the present disclosure, in response to the bit-number of the scalar being 384, s is 24, d is 4, and w is 4.
In some implementations according to any one or any combination of the implementations or embodiments described in the present disclosure, in response to the bit-number of the scalar being 512, s is 32, d is 4, and w is 4.
In the present disclosure, a notation of “m{circumflex over ( )}n” represents exponentiation operation, i.e, mn, corresponding to the base m and the exponent or power n. For example, 2{circumflex over ( )}128 represents 2128, corresponding to 2 as the base and 128 as the exponent or the power.
The electronic device 200 may include communication interfaces 202, a system circuitry 204, an input/output interfaces (I/O) 206, a display circuitry 208, and a storage 209. The display circuitry may include a user interface 210. The system circuitry 204 may include any combination of hardware, software, firmware, or other logic/circuitry. The system circuitry 204 may be implemented, for example, with one or more systems on a chip (SoC), application specific integrated circuits (ASIC), discrete analog and digital circuits, and other circuitry. The system circuitry 204 may be a part of the implementation of any desired functionality in the electronic device 200. In that regard, the system circuitry 204 may include logic that facilitates, as examples, decoding and playing music and video, e.g., MP3, MP4, MPEG, AVI, FLAC, AC3, or WAV decoding and playback; running applications; accepting user inputs; saving and retrieving application data; establishing, maintaining, and terminating cellular phone calls or data connections for, as one example, internet connectivity; establishing, maintaining, and terminating wireless network connections, Bluetooth connections, or other connections; and displaying relevant information on the user interface 210. The user interface 210 and the inputs/output (I/O) interfaces 206 may include a graphical user interface, touch sensitive display, haptic feedback or other haptic output, voice or facial recognition inputs, buttons, switches, speakers and other user interface elements. Additional examples of the I/O interfaces 206 may include microphones, video and still image cameras, temperature sensors, vibration sensors, rotation and orientation sensors, headset and microphone input/output jacks, Universal Serial Bus (USB) connectors, memory card slots, radiation sensors (e.g., IR sensors), and other types of inputs.
Referring to
The system circuitry 204 may include hardware, software, firmware, or other circuitry in any combination. The system circuitry 204 may be implemented, for example, with one or more systems on a chip (SoC), application specific integrated circuits (ASIC), microprocessors, discrete analog and digital circuits, and other circuitry. For example referring to
The storage 209 may be used to store various initial, intermediate, or final data. In one implementation, the storage 209 may be integral with a database server. The storage 209 may be centralized or distributed, and may be local or remote to the electronic device 200. For example, the storage 209 may be hosted remotely by a cloud computing service provider.
The present disclosure describes various embodiments, which may be implemented, partly or totally, on the one or more electronic device described in
In some embodiments, an interleaved scalar multiplication method may be processed and implemented as the following.
A first step includes selecting proper decomposition factors for a given scalar size in bits. This may be achieved manually or automatically in a computer program.
A second step includes, according to the selected parameters, generating pre-computed resources for the interleaved scalar multiplication algorithm. This may be achieved automatically in a computer program.
A third step includes implementing the interleaved scalar multiplication algorithm, with the specific parameters and pre-computed resources. The detailed implementation of the interleaved scalar multiplication algorithm is described in the present disclosure.
A fourth step includes performing the computation for the specific scalar multiplication.
The scalar k may be represented as a n-bit integer, (k0, k1, . . . kn-1), in a bit-level little-endian order. The scalar multiplication operation may be expressed as follow for the binary representation: k*P=P+P+ . . . +P=k0*P+k1*2*P+ . . . +kn-1*2n-1*P.
In the present disclosure, merely to simply notation for clear expression, the multiplication symbol (“*”) may be omitted in some formulas, for example, kP may refer to k*P, k2s-12sP may refer to k2s-1*2s*P, etc.
The bit length of the scalar k may be factorized/decomposed into a plurality of factors, which may be three factors, four factors, or five factors. For a non-limiting example, The bit length of the scalar k may be factorized/decomposed into three factors, and each factor is a positive small integer: n=s*d*w, wherein s is a sliding size, w is a window size, and d is a dimension size. The scalar multiplication operation may be expressed as follows for the binary representation:
The above formula may be expanded as the following.
The Ni in the above formula may be expanded as the following, wherein i is smaller than s, and is larger than or equal to zero.
The Wij in the above formula may be expanded as the following, wherein j is smaller than d, and is larger than or equal to zero.
Wij=ki+js2jsP+ki+js+ds2js+dsP+ . . . +ki+js+(w-1)ds2js+(w-1)dsP
A plurality of tables including the Wij values may be pre-computed by combination different values of associated ki bits, the details of which are described in other part of the present disclosure.
With the parameters and pre-computed resources, the interleaved scalar multiplication may be expressed as the following algorithm, wherein the returned Q is the result for the scalar multiplication between k and P.
For n-bit scalar k, the complexity of the interleaved method is about s point double operation and n/w point addition. In comparison to a safe-select windowed method, the point double computation complexity is reduced from n to s times. For a non-limiting example, when n is 256 and (s, d, w) are (16, 4, 4), respectively, the complexity of the interleaved method is about 16 double and 64 additions operations. In comparison to a safe-select windowed method, the point double computation complexity is reduced 16 times (i.e., from 256 double operations to 16 double operations). Table 1 shows an example of the reduction of the complexity for different scalar size.
In some implementations, proper decomposition factors may be determined for a given scalar size in bits, and this determinization may be achieved manually or automatically in a computer program. For the given scalar length n, decomposing the length into small factors may depend on one or more other constrains. For one example, when a system has a large computing capability and limited memory, a larger sliding size (s) may be considered, so as to accommodate a smaller window size (w) and/or a smaller dimension size (d). For another example, when a system has no constrain on the memory (e.g., a sufficiently large memory size), a larger window size and/or a larger dimension size (d) may be determined, so as to result in a smaller sliding size to reduce computing time.
For non-limiting examples, Table 2 shows several selections for (s, w, d) for a scalar with different sizes. Usually, 4 may be a preferred choice for window size w and dimension size d.
In some implementations, when the scalar length is decomposed into small factors, pre-computed tables including Wij values as entries may be generated according to the decomposed factors. This may be achieved automatically in a computer program. For the Wij values, the tables may be pre-computed by combination different values of associated ki bits for {2jsP, 2js+dsP, . . . , 2js+(w-1)dsP} according to the following.
Wij=ki+js2jsP+ki+js+ds2js+dsP+ . . . +ki+js+(w-1)ds2js+(w-1)dsP
There may be d pre-computed tables. Each table contains 2w elements/entries, and each entry in the table may be indexed by an index (or key) {ki+ns, ki+js+ds, . . . , ki+js+(w-1)ds}. The index has w-bit, and when each bit in the index takes all possible values of “0” or “1”, there are 2w indexes corresponding to the 2w elements/entries in the table, respectively.
For a non-limiting example, when n is 256 and (s, d, w) is (16, 4, 4), there are 4 pre-computed tables, each table contains 16 elements/entries, and each entry is indexed by a 4-bit index value. Table 3 shows a first pre-computed table, which may also be labeled as table number (No.) 0 with j=0.
Table 4 shows a second pre-computed table, which may also be labeled as table number (No.) 1 with j=1.
Table 5 shows a third pre-computed table, which may also be labeled as table number (No.) 2 with j=2.
Table 6 shows a fourth pre-computed table, which may also be labeled as table number (No.) 3 with j=3.
In some implementations, for a given scalar k, the constructed indexes for looking up the tables may include secret information (e.g., information about the “0” and/or “1” of the bits in the given scalar). To increase side-channel attack resistant, table lookup may be performed in constant-time, using a safe-select algorithm. With constant-time table lookup algorithm, no secret information may be leaked by side-channel attack (e.g., by monitoring timing or power consumption).
In some implementations, after the decomposed factors are determined and pre-computed tables are generated for a given P, the interleaved scalar multiplication may be performed for a given a scalar.
In some implementations, when the scalar size is big and better performance is desired, the scalar size may be decomposed into more than three factors, and each factor is a small positive integer, for example, 4 factors, 5 factors, etc.
The present disclosure is not limited to expressing the scalar in a little-endian order, which is used to provide exemplary embodiments. In some other embodiments, the scalar may be expressed in a big-endian order, and the method for performing interleaved scalar multiplication may be performed following the similar patterns as described above in the present disclosure, for example, the tables and/or formulas have similar but different patterns.
The present disclosure provides a method, an apparatus, and a non-transitory computer readable storage medium for performing interleaved scalar multiplication. The present disclosure describes various embodiments to be more efficient than some other methods and be more resistant to side-channel attacks.
The present disclosure provides at least one of the following contributions: by properly decompose the scalar size, the interleaved scalar multiplication is more efficient than some other methods, for example, the basic binary expansion method and/or the safe-select windowed method; by using proper safe-select table algorithm, the interleaved scalar multiplication is side-channel attack resistant; by introducing the dimension size, the look-up table could be relative small, so that the safe-select table look-up may be more efficient; and/or the scalar size factors may be customized, so that an implementation with a good choice of the scalar size factors may accommodate and/or balance constrains of CPU and memory for the specific circumstance.
In the embodiments and implementation of this disclosure, any steps and/or operations may be combined or arranged in any amount or order, as desired. Two or more of the steps and/or operations may be performed in parallel. Embodiments and implementations in the disclosure may be used separately or combined in any order.
The techniques described above, may be implemented as computer software using computer-readable instructions and physically stored in one or more computer-readable media. For example, human accessible storage devices and their associated media include such as optical media including CD/DVD ROM/RW with CD/DVD or the like media, thumb-drive, removable hard drive or solid state drive, legacy magnetic media such as tape and floppy disc, specialized ROM/ASIC/PLD based devices such as security dongles, and the like. Those skilled in the art may also understand that term “computer readable media” as used in connection with the presently disclosed subject matter does not encompass transmission media, carrier waves, or other transitory signals.
While the particular invention has been described with reference to illustrative embodiments, this description is not meant to be limiting. Various modifications of the illustrative embodiments and additional embodiments of the invention will be apparent to one of ordinary skill in the art from this description. Those skilled in the art will readily recognize that these and various other modifications can be made to the exemplary embodiments, illustrated and described herein, without departing from the spirit and scope of the present invention. It is therefore contemplated that the appended claims will cover any such modifications and alternate embodiments. Certain proportions within the illustrations may be exaggerated, while other proportions may be minimized. Accordingly, the disclosure and the figures are to be regarded as illustrative rather than restrictive.
| Number | Name | Date | Kind |
|---|---|---|---|
| 5737609 | Reed et al. | Apr 1998 | A |
| 20030142820 | Futa et al. | Jul 2003 | A1 |
| 20040117771 | Venkatapathy | Jun 2004 | A1 |
| 20070244944 | Bertoni et al. | Oct 2007 | A1 |
| 20080028373 | Yang et al. | Jan 2008 | A1 |
| 20080095357 | Kitamura et al. | Apr 2008 | A1 |
| 20100040225 | Venelli et al. | Feb 2010 | A1 |
| 20110075836 | Yamamoto | Mar 2011 | A1 |
| 20110296375 | Mooney | Dec 2011 | A1 |
| 20120114117 | Ebeid | May 2012 | A1 |
| 20130218937 | Naito et al. | Aug 2013 | A1 |
| 20170187530 | Ghosh | Jun 2017 | A1 |
| 20200264843 | Schwarz | Aug 2020 | A1 |
| Entry |
|---|
| International Search Report and Written Opinion for priority application No. PCT/US23/065773 dated Jul. 25, 2023, 25p. |
| ECMA International, Standard ECMA-262, ECMAScript 2021 Language Specification, 12th Edition. Jun. 2021, pp. 47-52, pp. 389-428, CH. |
| Michael D. Ernst et al., “An Empirical Analysis of C Preprocessor Use”, University of Washington, Department of Computer Science and Engineering, Jan. 18, 2000, 34p, US. |
| International Search Report and Written Opinion regarding PCT/US2023/063760 dated Sep. 21, 2023, 6 pages. |
| Islam et al., “Area-Time Efficient Hardware Implementation of Modular Multiplication for Elliptic Curve Cryptography,” Published in: IEEE Access (vol. 8); pp. 73898-73906, Apr. 16, 2020, 9 pages. |
| Raiashree et al., “Elliptic Curve Scalar Multiplication over Prime Field for both Affine and Jacobian Coordinates,” Published in: 2023 International Conference on Intelligent and Innovative Technologies in Computing, Electrical and Electronics (IITCEE), Date of Conference: Apr. 10, 2023, 2 pages. |
| Number | Date | Country | |
|---|---|---|---|
| 20240146529 A1 | May 2024 | US |
