HAL Id: hal-01134020
https://hal.inria.fr/hal-01134020
Submitted on 29 Mar 2015
HAL is a multi-disciplinary open access
archive for the deposit and dissemination of
sci-entific research documents, whether they are
pub-lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.
L’archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d’enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.
Hardware and Arithmetic for Hyperelliptic Curves
Cryptography
Gabriel Gallin, Arnaud Tisserand, Nicolas Veyrat-Charvillon
To cite this version:
Gabriel Gallin, Arnaud Tisserand, Nicolas Veyrat-Charvillon. Hardware and Arithmetic for
Hyperel-liptic Curves Cryptography. RAIM: 7ème Rencontre Arithmétique de l’Informatique Mathématique,
Apr 2015, Rennes, France. 2015. �hal-01134020�
HAH Project, IRISA–IRMAR
Hardware and Arithmetic for Hyperelliptic
Curves Cryptography
Gabriel Gallin, Arnaud Tisserand & Nicolas Veyrat-Charvillon
1. Elliptic Curve Cryptography (ECC)
encryption
signature
key gen.
etc
pr
otocol
le
vel
[
k ]
P
ADD
(
P, Q)
DBL
(
P)
P + P
cur
ve
le
vel
x
±
y
x
×
y
. . .
field
le
vel
E : y
2
=
x
3
+
4x + 20 over GF(1009)
Points on E :
P, Q= (x , y ) or (x , y , z)
Coordinates: x , y , z ∈ GF(·)
GF(p), GF(2
m
), t :
160–600
bits
k = (k
t−1
k
t−2
. . .
k
1
k
0
)
2
∈ N
Scalar multiplication operation
for
i
from
0
to
t − 1
do
if
k
i
=
1
then
Q =
ADD
(
P, Q)
P =
DBL
(
P)
Point addition/doubling operations
sequence of finite field operations
DBL
: v
1
=
z
1
2
,
v
2
=
x
1
− v
1
, . . .
ADD
: w
1
=
z
1
2
,
w
2
=
z
1
× w
1
, . . .
GF(p) or GF(2
m
) operations
operation modulo large prime (GF(p))
or irreducible polynomial (GF(2
m
))
2. Side Channel Attacks (SCAs)
DBL DBL DBL
ADD
DBL
ADD
DBL DBL
0 0 0
1
1
0
Side channels:
I
Power consumption
I
Electromagnetic radiation
I
Computation timings
Attacks:
I
Simple analysis
I
Differential analysis (statistics)
I
Templates and learning
3. Protections & Counter-Measures Against SCAs
I
Uniform comp. durations
I
Uniform power/EM profile
I
Random behavior
I
Circuit reconfiguration
I
detection/correction codes
I
Add noise (!)
Example: use redundant number systems
k
R
1
(k )
[R
1
(k )]
P
R
2
(k )
[R
2
(k )]
P
R
3
(k )
[R
3
(k )]
P
R
4
(k )
[R
4
(k )]
P
R
5
(k )
[R
5
(k )]
P
R
6
(k )
[R
6
(k )]
P
. . .
. . .
Random recoding: ∀i
[
R
i
(
k )]
P = [k ]P
4. From ECC to HECC
field size
ADD
DBL
ECC
`
bits
mul RX OUTsub RY OUT mul RZ OUT PZ mul PZ mul PZ mul PZ PX PX mul PY mul PY QY QY QX QX QZ QZ QZ QZ mul v18 add v12 add sub v13 mul v10 v10 v10 mul v11 v11 sub v11 mul v16 v17 v14 v14 sub v0 v1 v1 v2 v2 sqr v2 sub v3 v4 v4 v5 sqr v5 mul v6 v7 v7 v8 v9 v9
Cost: 12M + 2S
mul RX OUT sub RY OUT add RZ OUT PZ mul PZ mul PZ PX sqr PX mul PX PY PY mul PY a a add add v18 v18 add v19 v19 sub add v12 v12 sub v12 v13 add add v10 v10 v10 v11 mul v16 sqr v17 v17 v15 mul v23 add v23 sqr v22 v20 add v25 v25 v24 v24 add v0 add v1 v1 add v1 v2 v3 v4 sqr v4 v5 v6 v6 v6 v6 v7 v7 add v8 v8 v9 v9Cost: 6M + 5S
HECC
2
`
bits
mul RU0 OUT mul RU1 OUT
add RV0 OUT add RV1 OUT mul RZ OUT PZ mul PZ mul PZ mul PZ add PZ mul PZ mul PZ mul PZ mul PZ QV0 QV0 QV1 QV1 QU1 add QU1 QU1 QU0 QU0 QU0 PU0 mul PU0 mul PU0 mul PU0 PU1 PU1 mul PU1 mul PU1 PV1 PV1 mul QZ mul QZ QZ QZ QZ QZ PV0 PV0 sub v18 mul v18 add v19 mul v19 add v12 mul v13 mul v13 mul v10 sqr v11 add v16 mul v17 sqr v14 mul v14 mul v14 v15 add v85 mul v84 mul v87 add v86 add sub v81 mul v80 sub v83 v82 sqr v69 v69 mul v69 mul sub v68 sub v67 mul v67 sub v66 v66 sub v65 add v64 v64 mul v63 v63 sub v61 v60 v60 add v78 v79 v74 v76 mul v77 mul v70 v70 v71 v72 mul v73 v73 v23 mul mul v41 sub v40 mul v43 v43 v43 v43 mul v43 mul v43 add v42 add mul v45 add v44 sub add v47 add v46 v49 v48 sub v22 mul v22 v21 v21 v21 v21 v20 mul v27 v26 v26 add v25 sub v25 sub v24 v29 v28 mul v56 add v56 v56 sub v57 add v54 v54 v54 v52 v53 v50 v51 v58 v58 v59 v30 v30 v30 v30 mul v30 mul v30 v31 v31 v31 v31 v32 v32 v32 v32 v33 mul v34 v35 v35 sqr v35 add v35 v35 v36 add v37 v37 v38 v39 v0 v0 v0 v0 v0 v1 sub v1 v2 v3 v3 v3 sub v4 v5 v5 v5 v6 v6 v6 v6 v6 v6 v6 v6 add v7 v8 v9 v9 v9
Cost: 47M + 4S
mul RU0 OUT mul RU1 OUT sub RV0 OUT sub RV1 OUT mul RZ OUT PZ mul PZ mul PZ sub PZ mul PZ mul PZ sub PZ mul PZ mul PZ mul PZ mul PZ sqr PZ mul PZ mul PZ PU0 add PU0 PU0 mul PU0 add PU0 mul PU0 mul PU0 PU1 sqr PU1 add PU1 mul PU1 PU1 mul PU1 mul PU1 PU1 Z sub Z PV1 mul PV1 sqr PV1 add PV1 PV1 PV0 mul PV0 add PV0 PV0 add sub v18 add v18 v18 v19 add mul v12 add v13 v13 v13 add v13 mul mul v10 sqr v10 mul v10 v11 mul v11 v16 v17 v14 v15 v15 v15 v80 v69 mul v68 v68 sub v67 mul v66 v65 add v65 sqr v64 v64 mul v64 mul v63 add v62 mul v62 sub v61 v60 v60 add v78 v79 mul sub v74 v75 sub v76 v77 v71 add v72 v73 v41 v40 v40 v40 v40 sub sqr v43 mul v43 v42 mul add v45 add v44 mul v47 v46 v49 v48 sub v23 v22 v21 add v20 sub v27 add v26 mul v26 v25 v24 v29 v28 sub v56 v57 v57 v57 v54 add v54 v54 v55 v53 v53 v53 v50 v51 v51 v51 mul v59 v59 v59 v30 v30 v31 sub v32 v33 add v33 v34 v34 add v34 v35 v36 v37 v38 v38 v38 v38 v39 v39 v39 v0 v0 v1 mul v1 sub v2 v3 v4 v4 v4 add v5 v6 v6 sqr v6 v7 v8 v9 v9
